Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?
Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?
Its even better when they don’t tell you that your password is too long, and they truncate it somewhere unknown.
Tried a randomgen 32 character password at the local sheriff’s office. Copy and pasted it directly out of my password manager into the password creation field so I know I didn’t typo it and when I tried to login it wouldn’t work. Took me a bit of troubleshooting to figure out what happened.
That happens all the fucking time, and it’s infuriating. Most recent example was with Kagi, which I eventually found out had a max of 72, truncated, no warning. I bitched out their support and they were like ‘nbd, and it should have warned you’ and I’m like ‘nope, no warning at all’ which means they didn’t bother checking if a warning actually showed or prevented the input, just ‘I wrote it so we must be good’.
They claim to have fixed this, but ugh. Took me a half an hour, and I started with the suspicion that it was being truncated. Test your shit if you’re going to be stupid, people.
What are the benefits of a password greater than 72 characters? How high do you try to go?
The longer it is, the harder for anyone to guess, write down, remember, or brute force. For that long a password, someone can actually see my password and then have effectively zero chance of being able to use it.
But maybe it’s more a ”why not?” In one side it’s generated so you can use it equally well, and in the other side it should be hashed to a standard length so they should be able to manage it equally well.
Oh that’s evil.
Ive seen an account creation or password reset that let’s you do any length password, but the actual login page has a character limit.
About 10 years ago this happened to me at chase.com. IIRC they truncated at 30 characters at the time.