Re: PM password capped at 8 chars?

Answer: because the passwords aren't crypted. If they were, then there'd be no theoretical limit, though there could be a practical limit (e.g., crypt(3) only uses the first 8 characters of a password, and most, but not all, others probably also have implentation-defined limits).

All that said, I'm not sure if there's a public discussion of what should be used or if any discussion is being held "behind closed doors." I'm not sure what the level of security sophistication is behind those closed doors (and, no, adding me to the list wouldn't likely increase the sum of security experience and knowledge noticeably), though if it were out in the open, we'd be more confident in the final solution. Of course, then we'd also get bogged down in minutiae, which may be why it's quiet except for periodic updates.

Comment on Re: PM password capped at 8 chars?

Replies are listed 'Best First'.
Re^2: PM password capped at 8 chars? (or 10) by tye (Sage) on Aug 31, 2009 at 18:29 UTC
The reason that forms that accept passwords only accept 8 characters is more likely that crypt is used to generate login cookies so any characters beyond 8 would be ignored when creating the cookie. But that all is being changed (more slowly than expected or desired, as usual). Somewhat interestingly, the field in the DB for password is limited to 10 characters. So, if you work around the 8-character limit in the forms, you can set a 9- or 10-character password. Such would make it impossible to log in to the site using the existing forms and then the extra character(s) would be ignored when the cookie was created. As to why the password field is 10 characters and unhashed, I have no clue and that predates my knowledge of even of the existence of the site by several years. - tye	[reply]
Re^3: PM password capped at 8 chars? (or 10) by bv (Friar) on Aug 31, 2009 at 19:21 UTC
Oh dear. I checked my cookie and this is indeed the case. `$ echo "bv:<last13ofcookie>" > trash $ echo "<mypass>" > trash $ john -w=trash userpass Loaded 1 password hash (Traditional DES [128/128 BS SSE2]) <mypass> (bv) guesses: 1 time: 0:00:00:00 100% c/s: 25.00 trying: <mypass>` [download] The collapsing views in Recent Threads was nice, but I'm turning off Javascript for perlmonks.org now (Thanks, NoScript!). Are there any plans to rework this system, or am I whining in vain? `$,=' ';$\=',';$_=[qw,Just another Perl hacker,];print@$_;`	[reply] [d/l] [select]
Re^4: PM password capped at 8 chars? (or 10) by Anonymous Monk on Aug 31, 2009 at 23:24 UTC
tye said But that all is being changed (more slowly than expected or desired, as usual). Your whining has no effect.	[reply]
Re^2: PM password capped at 8 chars? by bv (Friar) on Aug 31, 2009 at 16:57 UTC
Well, there's another think I'd like to see: hashed passwords. I'm a security guy by nature and job description, so it just bugs me to see things done less securely than they could be. As far as a public discussion, I think that the general Monk-ulace should at least be involved as partial stakeholders. I agree the method doesn't need to be discussed as much as the principle of more securely handling our accounts. `$,=' ';$\=',';$_=[qw,Just another Perl hacker,];print@$_;`	[reply] [d/l]