PM password capped at 8 chars?

Ok, I think I did my research on this, but I only found this discussion, which never really answered the question: Why does PerlMonks limit users' passwords to 8 characters only?

It's a left-over from the Everything codebase
There's a database constraint like char(8)
Similarly, it's to save space in the database
The site maintainers want to be able to crack anyone's password easily if needed (I'm not really that paranoid!)

I'd like to hear from the pmdev team as to why things are the way they are, and I'd really prefer to avoid delving into the whole password policy/length/writing-down debate. I just would like the option to have a longer password, without forcing anyone to adhere to a particular length or complexity requirement.

Thoughts?

UPDATE: reworded to avoid sounding demanding, sorry

$,=' ';$\=',';$_=[qw,Just another Perl hacker,];print@$_;

Comment on PM password capped at 8 chars? Select or Download Code

Replies are listed 'Best First'.
Re: PM password capped at 8 chars? by Tanktalus (Canon) on Aug 31, 2009 at 02:42 UTC
Answer: because the passwords aren't crypted. If they were, then there'd be no theoretical limit, though there could be a practical limit (e.g., crypt(3) only uses the first 8 characters of a password, and most, but not all, others probably also have implentation-defined limits). All that said, I'm not sure if there's a public discussion of what should be used or if any discussion is being held "behind closed doors." I'm not sure what the level of security sophistication is behind those closed doors (and, no, adding me to the list wouldn't likely increase the sum of security experience and knowledge noticeably), though if it were out in the open, we'd be more confident in the final solution. Of course, then we'd also get bogged down in minutiae, which may be why it's quiet except for periodic updates.	[reply]
Re^2: PM password capped at 8 chars? (or 10) by tye (Sage) on Aug 31, 2009 at 18:29 UTC
The reason that forms that accept passwords only accept 8 characters is more likely that crypt is used to generate login cookies so any characters beyond 8 would be ignored when creating the cookie. But that all is being changed (more slowly than expected or desired, as usual). Somewhat interestingly, the field in the DB for password is limited to 10 characters. So, if you work around the 8-character limit in the forms, you can set a 9- or 10-character password. Such would make it impossible to log in to the site using the existing forms and then the extra character(s) would be ignored when the cookie was created. As to why the password field is 10 characters and unhashed, I have no clue and that predates my knowledge of even of the existence of the site by several years. - tye	[reply]
Re^3: PM password capped at 8 chars? (or 10) by bv (Friar) on Aug 31, 2009 at 19:21 UTC
Oh dear. I checked my cookie and this is indeed the case. `$ echo "bv:<last13ofcookie>" > trash $ echo "<mypass>" > trash $ john -w=trash userpass Loaded 1 password hash (Traditional DES [128/128 BS SSE2]) <mypass> (bv) guesses: 1 time: 0:00:00:00 100% c/s: 25.00 trying: <mypass>` [download] The collapsing views in Recent Threads was nice, but I'm turning off Javascript for perlmonks.org now (Thanks, NoScript!). Are there any plans to rework this system, or am I whining in vain? `$,=' ';$\=',';$_=[qw,Just another Perl hacker,];print@$_;`	[reply] [d/l] [select]
Re^4: PM password capped at 8 chars? (or 10) by Anonymous Monk on Aug 31, 2009 at 23:24 UTC
Re^2: PM password capped at 8 chars? by bv (Friar) on Aug 31, 2009 at 16:57 UTC
Well, there's another think I'd like to see: hashed passwords. I'm a security guy by nature and job description, so it just bugs me to see things done less securely than they could be. As far as a public discussion, I think that the general Monk-ulace should at least be involved as partial stakeholders. I agree the method doesn't need to be discussed as much as the principle of more securely handling our accounts. `$,=' ';$\=',';$_=[qw,Just another Perl hacker,];print@$_;`	[reply] [d/l]
Re: PM password capped at 8 chars? by Burak (Chaplain) on Aug 30, 2009 at 21:01 UTC
The site maintainers want to be able to crack anyone's password easily if needed (I'm not really that paranoid!) That was funny :) Surely the maintainers of PM code are not as paranoid as you are, since the passwords are still all plain text: Status of Recent User Information Leak	[reply]
Re: PM password capped at 8 chars? by Anonymous Monk on Aug 30, 2009 at 20:52 UTC
All of the above? :)	[reply]