From time to time I see systems that don't allow passwords longer than 8 chars: isn't that a security risk? What am I missing, here, that might have lead to such decision?
3
-
1$\begingroup$ It depends on the context where this occurs. If the hacker does not have the option of freely trying any number of passwords, this is quite safe, as the probability of hitting the password by chance is like $2^{-50}$. $\endgroup$– user16034Jul 28 at 5:39
-
$\begingroup$ You're younger than my first computer by several decades, aren't you? $\endgroup$– Andrej BauerJul 28 at 18:46
-
$\begingroup$ @AndrejBauer I don't know, unless your first computer comes from the 1940s, in which case several would only mean 3... my first computer had ©1982 written at boot... $\endgroup$– PierpaoloJul 30 at 8:41
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
Yes, absolutely, it is poor design from a security perspective. You're not missing anything. It could result from historical inertia (a lousy excuse) or from ignorance.
See What technical reasons are there to have low maximum password lengths? and Do passwords need a max length?.
$\begingroup$
$\endgroup$
3
The reason is saving space. In the old days every byte was precious, and security didn't matter because everyone was a nice person.
-
$\begingroup$ I'm talking about modern systems, where I don't think an extra couple of bytes for a password do that much difference... ;-) $\endgroup$ Jul 30 at 8:42
-
$\begingroup$ And I am telling you that old habits die hard. $\endgroup$ Jul 30 at 16:38
-
$\begingroup$ so, like, those who've implemented this system are old fellas, I get it :-) thanks for clarifying ;-) $\endgroup$ Aug 3 at 13:31