While on the topic of things to fix: When I was signing up, I hit a 16-character password limit.
Now, could anyone explain why you would put a limit of 16 characters in a password on a modern web-service? Don't the recommendations for a very safe password normally specify more than that?
I see much reason for setting a minimum amount, but not a maximum of less than a hundred characters (to give some room) at least.
I completely agree. It's ridiculous...but that's Microsoft. And I'm not just bashing them here. It seems to be something about how they implement passwords. When I was doing research for Cryptasia, I found that Hotmail/Live was by far the most restrictive of any service out there--and I was examining at hundreds. Only banks (lol) come close.
You should always limit the password length to whatever size at which the underlying storage or scrambling mechanism stops working or loses entropy. Likely, Microsoft uses a shitty hash function to scramble passwords.
The common gospel around here is to say "Use bcrypt.", but very few people say (or know?) that its maximum input length is 55 bytes, i.e. 55 ASCII characters, or far fewer unicode characters. Most implementations actually cut off the remainder, which is a very dangerous thing to do since you might have people who use a relatively simple passphrase followed by a strong password which happens to be beyond the maximum length, and is lost.
For most other hash algorithms, if you use a hash function with an output size of 256 bits, you will lose entropy if the input contains more than 256 bits of entropy. It is a little hard to measure what the maximum length should be for e.g. passwords, but the length should almost never be unlimited. It conveys a false, and in some cases, e.g. with bcrypt, quite dangerous sense of security.
Er, wait a second, how is it even possible that they validate my login just typing the first 16 chars of my old (longer) password. Were they clipping passwords to 16 chars before and not telling anyone? That sounds bad, but the alternatives sound much worse.
Comments
While on the topic of things to fix: When I was signing up, I hit a 16-character password limit.
Now, could anyone explain why you would put a limit of 16 characters in a password on a modern web-service? Don't the recommendations for a very safe password normally specify more than that?
I see much reason for setting a minimum amount, but not a maximum of less than a hundred characters (to give some room) at least.
I completely agree. It's ridiculous...but that's Microsoft. And I'm not just bashing them here. It seems to be something about how they implement passwords. When I was doing research for Cryptasia, I found that Hotmail/Live was by far the most restrictive of any service out there--and I was examining at hundreds. Only banks (lol) come close.
You should always limit the password length to whatever size at which the underlying storage or scrambling mechanism stops working or loses entropy. Likely, Microsoft uses a shitty hash function to scramble passwords.
The common gospel around here is to say "Use bcrypt.", but very few people say (or know?) that its maximum input length is 55 bytes, i.e. 55 ASCII characters, or far fewer unicode characters. Most implementations actually cut off the remainder, which is a very dangerous thing to do since you might have people who use a relatively simple passphrase followed by a strong password which happens to be beyond the maximum length, and is lost.
For most other hash algorithms, if you use a hash function with an output size of 256 bits, you will lose entropy if the input contains more than 256 bits of entropy. It is a little hard to measure what the maximum length should be for e.g. passwords, but the length should almost never be unlimited. It conveys a false, and in some cases, e.g. with bcrypt, quite dangerous sense of security.
This. I just went to try outlook and ran into this with my existing hotmail account, which uses a passphrase and naturally is longer than 16 chars.
Horribly disappointed.
Er, wait a second, how is it even possible that they validate my login just typing the first 16 chars of my old (longer) password. Were they clipping passwords to 16 chars before and not telling anyone? That sounds bad, but the alternatives sound much worse.
Probably so it can reliably store the passwords using lanman hashing.
LANMAN v1 limit is 14 characters and is disabled by default on Win 2008 and 7.
Noticed this as well, since I use KeePass. Oddly enough there didn't appear to be a restriction the type of characters used.