Why would anyone put a limit -- especially such a short one -- on password length? Please don't tell me it's because they want to store them as char(8).
The DES hashing function that Gawker used/uses has an 8 character limit, so even if you chose a longer password it would get truncated to 8 characters on the server.
This suggests that some users might have had very strong passwords ("butterflyzrfr33!") that were truncated into weak prefixes ("butterfl"). I'll need to rethink my approach to passphrases to make sure they're "frontloaded" with stronger combinations in the first few characters. Like most people, I'm sure, I tend to tag these on to the end.
Comments
I'm not familiar with Gawker, but just looking down the list, it appears that there is an 8-character limit on passwords:
(among others)Why would anyone put a limit -- especially such a short one -- on password length? Please don't tell me it's because they want to store them as char(8).
The DES hashing function that Gawker used/uses has an 8 character limit, so even if you chose a longer password it would get truncated to 8 characters on the server.
This suggests that some users might have had very strong passwords ("butterflyzrfr33!") that were truncated into weak prefixes ("butterfl"). I'll need to rethink my approach to passphrases to make sure they're "frontloaded" with stronger combinations in the first few characters. Like most people, I'm sure, I tend to tag these on to the end.