Comment on My password is not accepted because it is too long

sexy_peach@feddit.org ⁨1⁩ ⁨month⁩ ago

• Cris16228@lemmy.today ⁨1⁩ ⁨month⁩ ago

  Explain please, I’m curious

  source

  • bpev@lemmy.world ⁨1⁩ ⁨month⁩ ago

    So this is *mathematically correct, but practically not really. But let me give you a long answer. There’s essentially two things here that are different:

    1. Does a longer password make your password more difficult to guess? (always yes)
    2. Does a longer password make accessing the content it protects more difficult (yes, to a certain point).

    ---

    The reason for #2 in digital systems is because of hashing, which is used to protect your password in the case of a data breach. Essentially, you can think of a hashing algorithm as an algorithm that takes an input, and then always returns the same output for that input, but isn’t reversible (in theory, you can’t derive the input from the output. It’s one-way). This is why if someone hacks Facebook, they don’t necessarily have your Facebook password.

    Usually, these algorithms return a fixed-length character string. And so your data is mathematically not more safe if you exceed this length, since a random password combination can theoretically resolve to the same value as your super-long-password. This would depend on the algorithm being used / data being stored, but for example, bcrypt outputs a 60-character string. So mathematically, your password is not more secure beyond 60 characters.

    However in practice, this is a non-issue, because I think that basically the only way that collisions like this are useful is for brute-forcing a password? And the chance of a password collision in this way is something like 10^27-or-28^ (being hit by lightning every day for 10,000 years)? The much easier solution is to get your actual password. So if your password being longer makes it harder for people to guess, I’d say that adding security by way of #1 is still extremely valid.

    source

    • Cris16228@lemmy.today ⁨5⁩ ⁨weeks⁩ ago

      Oh wow! Didn’t expect a detailed explanation of this. Thank you kind Lemmy user!

      source
  • AnUnusualRelic@lemmy.world ⁨1⁩ ⁨month⁩ ago

    All passwords longer than eight characters are silently truncated anyway.

    source

    • purplemonkeymad@programming.dev ⁨1⁩ ⁨month⁩ ago

      Only by very badly designed systems. Most are not truncated but hashed. Those hashes are much longer than 8 characters.

      source
    • ChillPC@programming.dev ⁨1⁩ ⁨month⁩ ago

      Looks like somebody made a generality out of the Shamir Secret Sharing (read it thought)

      source

      • lowered_lifted@lemmy.blahaj.zone ⁨1⁩ ⁨month⁩ ago

        good read. TLDR is that Sun Microsystems database software truncated passwords to 8 characters and the OP assumed that others must do that too. I surely hope not, TBH. I thought truncating to 8 characters had to do with computational or storage efficiency back when that mattered. I’m pretty sure most database fields if they’re modern use like a 256 character limit for passwords right?

        source

        • -> View More Comments
    • Cris16228@lemmy.today ⁨1⁩ ⁨month⁩ ago

      Uh? Why?

      source

      • davidagain@lemmy.world ⁨1⁩ ⁨month⁩ ago

        Only by batshit insane system wreckers. Normal systems don’t do this at all.

        source
• Kissaki@feddit.org ⁨5⁩ ⁨weeks⁩ ago

  Is that point 24 - the limit they set?

  source
• pineapplelover@lemm.ee ⁨1⁩ ⁨month⁩ ago

  Passphrases are much stronger than any 10 character password you can conjure up

  source

  • sexy_peach@feddit.org ⁨1⁩ ⁨month⁩ ago

    How does that contradict my statement? 10 chars is pretty weak.

    source