[deleted]
… 8-11 characters.
they wanted to one up their retail competitor 7-11, maybe?
[deleted]
Submitted 3 weeks ago by NullNet@lemmy.blahaj.zone to cybersecurity@infosec.pub
Comments
ohwhatfollyisman@lemmy.world 3 weeks ago
ohwhatfollyisman@lemmy.world 3 weeks ago
… 8-11 characters.
shouldn’t be a problem. take the dwarves and Snow White as a minimum. throw in the evil stepmom, woodsman, and magic mirror if you need them.
Jerry@feddit.online 3 weeks ago
You're absolutely right.
A worse example, pharmacy.amazon.com only uses a 4-digit passcode to log in, and it's a pharmacy site!
hemko@lemmy.dbzer0.com 3 weeks ago
Excuse me what the fuck? You need to make an account in Walmart to apply for a job?
Empricorn@feddit.nl 3 weeks ago
I just went to look at applying to Walmart
I’m assuming they meant online. I didn’t know what it’s like where you are, but basically every employer requires an account to submit an application…
hemko@lemmy.dbzer0.com 3 weeks ago
That’s fucking cancer ngl
OmegaLemmy@discuss.online 3 weeks ago
There needs to be a law to forbid passwords not providing 64 character max
Hamartiogonic@sopuli.xyz 3 weeks ago
Why stop there? 128 or 256 sound much nicer. Actually, while you’re at it, 4096 should be enough to fit a short story.
cynar@lemmy.world 3 weeks ago
There are use cases where long passwords could be problematic. 64 would be long enough for most purposes, but short enough not to cause issues for things like microcontrollers.
It should be paired with a strongly recommended larger value, however.
graycube@lemmy.world 3 weeks ago
If you allow unlimited length inputs of any kind, someone will break your system. 11 is way too short. But you do need some sort of maximum, even if it is very large.
invertedspear@lemm.ee 3 weeks ago
If you’re storing the password in the form the user entered it, you’re doing it wrong already.
graycube@lemmy.world 3 weeks ago
Even if you aren’t storing it, if you allow unlimited length someone will break your stuff.
sangriaferret@sh.itjust.works 3 weeks ago
shortwavesurfer@lemmy.zip 3 weeks ago
I use my password manager to generate 32 character or 64 character passwords whenever possible.
scott@lem.free.as 3 weeks ago
All stored passwords should be salted and hashed. That means each one uses the same amount of space, regardless of original length.
There should definitely be a minimum length but not a maximum (within limits; let’s not break web standards or the laws of thermodynamics).
14th_cylon@lemm.ee 3 weeks ago
well if there is, at least be glad when they tell you. i once met a system that let you enter whatever, and then just ignored anything behind nth (where n was ~10) character…
Fribbtastic@lemmy.world 3 weeks ago
Oh, let me tell you about Playsation that I had the pleasure of having to deal with it.
I needed to log in to my Playstation account but it told me that my username or password was wrong. Okay, send me a reset link. I got the link and set my new password.
I use Bitwarden and my password generator is set to 32 characters by default.
I generate a new password, paste that into the new password field, click okay and everything is fine, password changed. I save that new password in my vault and go back to the login site. I use the just changed credentials: Wrong username or password.
Well, turns out that the Password reset field is limited to 30 characters but the problem is that NOWHERE is it stated that your password has a max length. Not to mention that they don’t tell you that your password was modified and cut short. The login password field, however, does allow more than 30 characters.
This means that you generate a 32-character password and paste that into the password reset field, this then gets cut short to 30 characters, click save and then use the same password on the login, which is 32 characters. This now obviously doesn’t work because those passwords aren’t the same.
Fun times. The worst part is that the first support person just went “Well, everything looks fine on our side. Sucks for you. Goodbye”.
Hamartiogonic@sopuli.xyz 3 weeks ago
I’ve once had a password that was over 200 characters long. That was in a custom email server where the admin either didn’t know or care about limitations.
I used a randomly generated character soup, so there’s no way I’m ever going to memorize that nightmare of a password. Even if I print it on paper and hand to you, there’s a pretty good chance that you wouldn’t be able to type it correctly without restoring to OCR.
PlexSheep@infosec.pub 3 weeks ago
There should be a maximum, but only to cover ridiculous cases, like users pushing a 5 Kilobyte password onto the server. Hashing is expensive.
While we’re at hashing: salting is important of course, but one should also not use any hash function, but one specifically made for passwords, such as argon2. If you just use plain old sha-2, that can still be computed with quite some performance on modern hardware, hence the need for hashing functions that take up performance in a controlled way.