Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of my password. It also gives me an uncomfortable sense that they might not be hashing.
Are there good reasons for either setting an upper length or excluding characters in passwords?
Limiting the length can be a measure to limit the execution time of the hashing as well as limiting bandwidth (and both of those are really marginal anyway). Other than that, there is no good reason, especially from a security point of view.
One could say: “People will forget longer passwords more easily” – but that’s really a stupid statement and doesn’t get to the point at all.
As for characters, as long as you are aware of potential encoding issues with data transfer and/or migration in the future (e.g. you will switch from ASCII to UTF-8 in 2 years) allowing more characters can only be good for passwords strengths.
There are no good reasons.
EDIT: I cannot prove that there are no good reasons, because one cannot prove a negative. I can think of no good reasons for this - as others pointed out, the hash will be the same size regardless of the size of the input, and eliminating valid characters (from the question context) just reduces the state-space. The answer seems obvious on its face: there are no good reasons. There may be a large number of reasons that sound good or that seem good, but they aren't. If they were, someone would have posted them here already, or if not here then certainly on security.stackexchange.com, and this answer would not have been so heavily upvoted.
Yes, there is a reason for special characters.
Disallowing special characters is more of a usability thing, rather than security related. First of all they might get mangled by encoding problems. Second, even if you'd guarantee to always use same encoding, there is still the problem of input device. You'd be depending on having full keyboard (which eliminates most mobile devices), with same keyboard layout. Later differ not only between languages, but also between OSs, layouts for Windows, Linux and OSX may be a bit different. So I see good reason not to allow password like: √Ω≈ç∫∞§…¬å∑±.
There was a bit of a controversy in the security world a few years back when Chase customers discovered that their passwords were case-insensitive. It turned out their webpage was just a frontend to some 30-year-old OS/400 backend system, which had a technical limitation that it ignored case. Fixing this would apparently cost millions of dollars.
The point is, there may be expensive legacy reasons for not allowing passwords over a certain length.
(Note that I'm not condoning this excuse...)
Most banks, IT departments, etc. Who enforce maximum password restrictions don't do so for technical reasons. They are perfectly aware of how password hashing works, and how to store complex passwords. They impose these limitations because it reduces the number of calls to support for people who have forgotten their passwords. Is this a good reason to impose that kind of limitation? By no means. But, nevertheless, it is the main reason.
valid Business reason (Personally I don't actually believe that there is a correlation)
Jun 27, 2011 at 17:10
Are there good reasons for either setting an upper length or excluding characters in passwords?
I'm going to make a guess and say that some of these restrictions are due to character filtering on their website (& < > #) to keep hackers out. While others are the bone-headed ideas that come out of committees of pointy haired bosses.
I've come across a number of really stupid (in my opinion) "security" decisions. As an example, one large investment company handles my IRA accounts as well as my pension. In order to do any contact with the pension requires me to type in my password on the telephone (you cannot reach them otherwise). My brokerage/IRA account uses letters (upper and lower case) as well as some punctuation - none of these characters appear on a telephone number pad. If you can't log in with the password over the phone, it lets you reset your brokerage account's password to something you can type in over the phone.
My payroll system (for the consulting company I work for) requires numbers, and only numbers - this lets them use the same database whether the user calls in (I've never done this) or uses the web interface (I only use this).
That being said, it is time to change my password at the office. They have such crazy restrictions that I estimate it will take about half a day to find a password acceptable to the system: at least 2 upper case letters, at least 2 lower case letters, at least 2 digits (which cannot be +/- 1 from the previous password's), at least 2 non-alpha/non-numeric characters, cannot match any of the last 24 passwords, cannot contain any string (forwards or backwards) that is a word (3 or more letters long) in English (also a couple other languages I don't have clearance to know). I think the minimum length is like 10-11 characters.
Not all input devices (hardware-wise) often have all characters a full keyboard has, or likewise. If one is not using a password manager, one could find oneself in trouble entering such password, no? And Unicode is still a far way (far far way) from being a standard.
One reason for limiting characters would be due to how the password is then input.
Several banks for example, with their Internet Banking websites, ask for specific characters from a password, and you select the appropriate characters via a drop-down box.
They do this, presumably, so that keyloggers cannot detect the keypress, and thus know [characters from] your password. While I know that there are many other ways such measures could be circumvented e.g. screencapture; it is still effective against keyloggers.
If they had to allow all characters, then the length of the dropdown box would become cumbersome, and also allow for confusion between similar looking characters.
Disallowing special chars like tab would be valid. You can logon or change your password with a tab char in text mode but you can't use it in a GUI or web environment. A backslash char will also present some cross-platform issues.
btw long passwords are not passwords - they are passphrases. Your average user cannot remember 2Z8d!%g#x but they can remember 'the name of my pet is fido the dog'. Longer text is harder to crack via brute force and is far less likely to be written on a note attached to the screen.
When people type they make mistakes, called "typos". Normally people see their mistakes and correct them. For password entry usually you can't see what you've typed and therefore you can't correct your typos. You make mistakes without realising it, submit your password, and it comes back as "password invalid". Then you try again. Then you try again.
You can think of it as "3 minor little typos and then you're indistinguishable from a brute force attack". How do systems defend against brute force attacks? An explicit "Too many attempts, go away, you won't be able to log in even if you do get it right" response? Exponentially increasing delays on password entry leading to browser time-outs when the delay is too long, making it impossible to try to log in again? Approaches vary, but there's always a consequence in a well designed system.
You can think of it as "3 minor little typos and then you get some kind of denial of service".
As password length increases the risk of typos (and therefore the risk of denying an authorised person's access) increases. Anything longer than about 20 characters is going to be mistyped frequently (unless the user is smart/lazy and stores their password somewhere so they can "copy and paste" without worrying about typos, like a nice plain text file on their desktop called "passwords.txt").
It prevents the user from reusing passwords.
The user has a 20-character-long password with symbols like * and # (which are accessible on all keyboards, even phone call keyboards). But this user thinks this psasword is so safe, and nobody could have hacked it even if he gets pwned on some other website he uses the same password with (assuming the website uses a proper hashing algorithm).
Now he comes to this website that only allows [A-Za-z0-9]{8,16}. He can't use this password anymore. He is forced to choose another password. This ends the era of his 20-character-long star-hash-everywhere password. Now he is safe even if he uses the password on a site that does not hash the password.
Disclaimer: the user is me.
