Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of my password. It also gives me an uncomfortable sense that they might not be hashing.

Are there good reasons for either setting an upper length or excluding characters in passwords?

share|improve this question
21  
Sure! It makes it easier to brute-force-guess people's passwords! :P –  FrustratedWithFormsDesigner Jun 27 '11 at 15:58
3  
Are we talking valid "Technical" reasons or valid "Business" reasons? –  Loki Astari Jun 27 '11 at 17:08
1  
@Martin: I was thinking technical but either I suppose. –  chris Jun 27 '11 at 17:26
11  
@JYelton Why do you care what the original password length is? The hash will always be the same size. I certainly hope you're not storing them in plaintext... –  Pewpewarrows Jun 27 '11 at 23:04
1  
show 4 more comments

9 Answers

Limiting the length can be a measure to limit the execution time of the hashing as well as limiting bandwidth (and both of those are really marginal anyway). Other than that, there is no good reason, especially from a security point of view.

One could say: “People will forget longer passwords more easily” – but that’s really a stupid statement and doesn’t get to the point at all.

As for characters, as long as you are aware of potential encoding issues with data transfer and/or migration in the future (e.g. you will switch from ASCII to UTF-8 in 2 years) allowing more characters can only be good for passwords strengths.

share|improve this answer
4  
Given the overhead of any modern protocol length can absolutely not be a good reason -- other than a high limit like 1K just to prevent certain attacks/nonsense. –  edA-qa mort-ora-y Jun 27 '11 at 16:23
3  
Limiting the execution time of hashing is generally bad. The longer it takes to calculate a hash, the longer it takes to brute-force it. –  tdammers Jun 27 '11 at 19:50
    
Although that’s right it’s always a trade-off. You don’t want to always calculate the best hash which takes the longest. Hence asymmetric handshake vs symmetric data stream in VPN etc. –  Kissaki Jun 29 '11 at 10:27
add comment

No

There are no good reasons.

EDIT: I cannot prove that there are no good reasons, because one cannot prove a negative. I can think of no good reasons for this - as others pointed out, the hash will be the same size regardless of the size of the input, and eliminating valid characters (from the question context) just reduces the state-space. The answer seems obvious on its face: there are no good reasons. There may be a large number of reasons that sound good or that seem good, but they aren't. If they were, someone would have posted them here already, or if not here then certainly on security.stackexchange.com, and this answer would not have been so heavily upvoted.

share|improve this answer
3  
I agree, but the comment Kissaki makes about encoding is valid. Some stacks/programmers just can't seem to get the encoding correct, for them limiting to ASCII is a cheap hack to make it work. –  edA-qa mort-ora-y Jun 27 '11 at 16:24
10  
Could you at least try to elaborate? Either you don't know this for a fact, or you have reason to believe that common/existing reasons aren't valid. Giving you the benefit of the doubt and assuming the latter, you should be explaining why those reasons are not valid. –  Aaronaught Jun 27 '11 at 21:31
8  
-1 - I can think of several good reasons for limiting passwords to a given character set. Likewise, having to support touch-tone phone passwords as well as ones you type via a keyboard is also a situation you have to keep in mind. –  rjzii Jun 27 '11 at 22:47
9  
-1. No justification, just opinion. If you're going to make a blanket statement, back it up. –  Michael K Jun 27 '11 at 23:10
4  
This is now being discussed on our meta-discussion site: it would be helpful to understand why a single-word answer is so popular and what we can do to improve the quality of answers like this. –  user8 Jun 27 '11 at 23:21
show 9 more comments

Yes, there is a reason for special characters.

Disallowing special characters is more of a usability thing, rather than security related. First of all they might get mangled by encoding problems. Second, even if you'd guarantee to always use same encoding, there is still the problem of input device. You'd be depending on having full keyboard (which eliminates most mobile devices), with same keyboard layout. Later differ not only between languages, but also between OSs, layouts for Windows, Linux and OSX may be a bit different. So I see good reason not to allow password like: √Ω≈ç∫∞§…¬å∑±.

share|improve this answer
2  
unless you are providing a password to your users, that is, if they are the ones entering the password themselves then if they so choose to use some strange math symbol is really their business. now i do agree with the encoding issue here though find it more of an excuse to pass below the radar incompetence than a actual good reason to prevent certain characters arbitrarily. –  Newtopian Jun 28 '11 at 2:38
    
@new: it's not their business. If they shoot themselves in the foot, they will still perceive as problem with your application and call your support. –  vartec Jun 28 '11 at 7:14
4  
@Newtopian: I hate it when I, as a user, get circumscribed by reason of ignorance (such as not be able to specify a "+" in my email address). Sometimes, however, it's a good idea not to give the users to much rope with which to hang themselves. I think this is such an occasion. It's not about "arbitrarily" preventing certain characters. –  Zano Jun 28 '11 at 7:28
1  
So you're advocating Greeks, Arabs, Chinese and others all use US-ASCII? –  l0b0 Jun 28 '11 at 13:34
    
@l0: no, I'm advocating that they use normal, commonly used characters in their languages, rather than some special characters, which may be absent in some layouts. –  vartec Jun 28 '11 at 13:43
add comment

There was a bit of a controversy in the security world a few years back when Chase customers discovered that their passwords were case-insensitive. It turned out their webpage was just a frontend to some 30-year-old OS/400 backend system, which had a technical limitation that it ignored case. Fixing this would apparently cost millions of dollars.

The point is, there may be expensive legacy reasons for not allowing passwords over a certain length.
(Note that I'm not condoning this excuse...)

share|improve this answer
1  
insofar this is the only good reason to limit password in any way... only if the underlying system will hold such limitations in the first place. –  Newtopian Jun 28 '11 at 2:41
add comment

Not all input devices (hardware-wise) often have all characters a full keyboard has, or likewise. If one is not using a password manager, one could find oneself in trouble entering such password, no? And Unicode is still a far way (far far way) from being a standard.

share|improve this answer
1  
Usually the people entering passwords will use the same hardware (or hardware class) for creating them and authenticating them. I do not see how this is an argument in limiting character sets or length. As for Unicode, when building the server-side (the authenticating part) why would you limit the size or character sets ? any system requiring a password to enter should be able to control how this password is entered in the system, thus, if you require unicode for your client then so be it ! –  Newtopian Jun 27 '11 at 20:11
    
@Newtopian You're assuming you don't have to interface with legacy systems, or systems outside your control. –  grahamparks Jun 27 '11 at 20:34
    
they asked for a good reason, this isn't a good reason –  Jarrod Roberson Jun 27 '11 at 22:59
2  
@Jarrod - Not being able to enter a password is not a good reason?! In any case, I didn't see you come up with a better one (or any at all). –  Rook Jun 27 '11 at 23:02
2  
@Rook you should not have used those characters if you knew you could not pick them from a device, that doesn't make it a good reason to limit them for everyone, it makes it a good reason for you personally not to use them. –  Jarrod Roberson Jun 28 '11 at 1:22
show 4 more comments

Most banks, IT departments, etc. Who enforce maximum password restrictions don't do so for technical reasons. They are perfectly aware of how password hashing works, and how to store complex passwords. They impose these limitations because it reduces the number of calls to support for people who have forgotten their passwords. Is this a good reason to impose that kind of limitation? By no means. But, nevertheless, it is the main reason.

share|improve this answer
    
I see reducing support calls as a valid Business reason (Personally I don't actually believe that there is a correlation) –  Loki Astari Jun 27 '11 at 17:10
1  
Well, there are other ways of going about resetting passwords, or educating users on how to choose sufficiently complex passwords that are easy to remember. My last few passwords at work have been > 25 characters, and I've had no trouble remembering them. Also, presumably, people who have trouble remembering their long passwords will still pick shorter passwords, though I have no clue how often that's actually true. Reducing support calls does seem like a valid business reason on the surface, but it's still a lousy reason to restrict password length. –  Greg Jackson Jun 27 '11 at 17:12
1  
I think my (and many people) would find accurately typing (not just remembering) 25 characters without seeing the output almost impossible. I have so far fixed 5 typos while typing this! –  Gerry Jun 28 '11 at 4:25
    
Well, remembering isn't the same as typing. Remembering long passwords is very easy if you know how to choose them; simply pick lines from stories or plays, or parts of poems or song lyrics. As long as you change one or two things in there (intentional misspellings, change one word to another that sounds like it or means the same thing, etc), it's quite easy and extremely secure. True, typing it may be harder, but it's no excuse for banks to force you to type less than 8/10/12 characters. –  Greg Jackson Jun 28 '11 at 6:55
    
try typing that 25-letters password on a mobile device –  Lie Ryan Jul 13 '11 at 6:40
show 1 more comment

Are there good reasons for either setting an upper length or excluding characters in passwords?

I'm going to make a guess and say that some of these restrictions are due to character filtering on their website (& < > #) to keep hackers out. While others are the bone-headed ideas that come out of committees of pointy haired bosses.

I've come across a number of really stupid (in my opinion) "security" decisions. As an example, one large investment company handles my IRA accounts as well as my pension. In order to do any contact with the pension requires me to type in my password on the telephone (you cannot reach them otherwise). My brokerage/IRA account uses letters (upper and lower case) as well as some punctuation - none of these characters appear on a telephone number pad. If you can't log in with the password over the phone, it lets you reset your brokerage account's password to something you can type in over the phone.

My payroll system (for the consulting company I work for) requires numbers, and only numbers - this lets them use the same database whether the user calls in (I've never done this) or uses the web interface (I only use this).

That being said, it is time to change my password at the office. They have such crazy restrictions that I estimate it will take about half a day to find a password acceptable to the system: at least 2 upper case letters, at least 2 lower case letters, at least 2 digits (which cannot be +/- 1 from the previous password's), at least 2 non-alpha/non-numeric characters, cannot match any of the last 24 passwords, cannot contain any string (forwards or backwards) that is a word (3 or more letters long) in English (also a couple other languages I don't have clearance to know). I think the minimum length is like 10-11 characters.

share|improve this answer
    
Yep I've seen those characters on the no-list. –  chris Jun 27 '11 at 18:13
3  
Simple attack: find sticky notes under keyboards because no one can remember their password. –  JeffO Jun 27 '11 at 20:04
    
@Jeff, that is correct. If I leave my notebook at home, the passwords are too complicated to remember, so I'm unable to log in. And on the payroll system, I put the username and password as part of the bookmark. –  Tangurena Jun 27 '11 at 20:38
    
"cannot contain any string (forwards or backwards) that is a word (3 or more letters long) in English" This was the one that got me. Dictionary attacks aren't effective if the password contains whole words, but rather if the whole password consists of nothing but full words... Well really one full word or very common phrases. The most secure passwords that are practical to use without writing down are passphrases that come from books, poems, song lyrics, etc -- change a few letters into numbers, misspell something, and capitalize unpredictably and no one is going to crack that password. –  Greg Jackson Jun 27 '11 at 21:29
    
Character filtering is a sure sign of untested garbage code in the background. Developers need to learn to escape strings. –  l0b0 Jun 28 '11 at 13:32
add comment

One reason for limiting characters would be due to how the password is then input.

Several banks for example, with their Internet Banking websites, ask for specific characters from a password, and you select the appropriate characters via a drop-down box.

They do this, presumably, so that keyloggers cannot detect the keypress, and thus know [characters from] your password. While I know that there are many other ways such measures could be circumvented e.g. screencapture; it is still effective against keyloggers.

If they had to allow all characters, then the length of the dropdown box would become cumbersome, and also allow for confusion between similar looking characters.

share|improve this answer
    
Surely (technical) people would just key in the letter anyway? –  Gerry Jun 28 '11 at 4:30
    
@Gerry - that's a browser specific behaviour rather than an absolute standard and it's also dependent on user knowledge to make it workable. –  Jon Hopkins Jun 28 '11 at 8:46
    
My bank used a popup applet of a keyboard for a similar reason. But it was too difficult to use and got a lot of criticism for being inaccessible (didn't work for screen readers, alternate input etc) –  james Jun 28 '11 at 13:24
    
@Jon - I did say technical people, and I don't know of any windows browsers that don't implement at least first character matching, as it is standard Windows behaviour - can't speak for Mac and *nix –  Gerry Jun 28 '11 at 20:50
    
@Gerry The browser on my Android phone doesn't allow this. I expect it's the same for a lot of mobile devices. –  RoundTower Jul 1 '11 at 19:18
add comment

Disallowing special chars like tab would be valid. You can logon or change your password with a tab char in text mode but you can't use it in a GUI or web environment. A backslash char will also present some cross-platform issues.

btw long passwords are not passwords - they are passphrases. Your average user cannot remember 2Z8d!%g#x but they can remember 'the name of my pet is fido the dog'. Longer text is harder to crack via brute force and is far less likely to be written on a note attached to the screen.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.