[darumderum]

> I don't think is necessarily the case

Back then, when they enforced a maximum 16 character password, I saw enough security. Are they storing them in plaintext or what? Btw, I think they increased the limit to 32 now

[kenniskrag]

some hashing algorithm don't allow longer passwords. https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor....

[darumderum]

Well, 72 bytes is still far away from 16 characters. Also, nearly every website is able to allow passwords longer than 16 chars, so it is definitely possible somehow!? This limit is ridiculous

[kenniskrag]

also in unicode? (4 byte * 19 chars)

[TomSwirly]

1. Unicode has no idea of "bytes" at all.

2. Only in the UTF-32 encoding, which no one uses, are all characters represented by 4 bytes.

Most sites today use UTF-8 where most characters on a standard keyboard are 1 byte, and almost all characters from any language take 3 bytes.

3. Even 19 characters is a lot better than 12.

[darumderum]

No, but they don't support it anyways

[thih9]

Is this is a good reason to reject long passwords?

If that kind of hashing algorithm is a must, why not use first X bytes of the password input?

[jfrunyon]

Because then people find out that it ignores a bunch of your password and people's "password12DHpS*yoCTV44cAmg$gJj" is matched by "password123". Or "correct horse battery staple i have the most brilliant password ever" is matched by "correct horse battery staple".

[thih9]

Good point, that was too simplistic. Then again, I guess longer passwords could be preprocessed with another hashing function, one that returns a string of X bytes?

My point is that throwing a "password too long" error, especially for 32 characters or less, feels like a wrong approach to me; no matter the circumstances or the amount of backward compatibility that has to be kept.

[kenniskrag]

I understand your point but then password shucking can be problematic: https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...

[thih9]

What do you mean by problematic? The source links to YT and I can’t view a YT link.

I assume “problematic” here means “difficult but possible”. If problems arise then I guess it’s a matter of priorities; but I think that not inconveniencing the user with password length limits should be high priority.

[mikestew]

In other words, a modern version of Microsoft LAN Manager:

https://en.wikipedia.org/wiki/LM_hash

Save-ya-a-click: basically what jfrunyon describes, along with a whole lot of other insecurity goodness (and to be fair, LANMan was a long time ago).