the rule where it couldn’t be more than 12 characters long
This is the one I don’t get. Sure you don’t want people putting in an infinitely long password, but I like to have my passwords at around 15 characters. Why are you forcing me to make a less secure password?
Only reason I can think of is storage but even at a massive scale, this is text, paying for that storage would cost as much as a rounding error.
It’s even worse. If done correctly, the length of the password does not affect the size of the stored value. Because if you’re doing it right, you only save the hash of the password. And the length of the hash is fixed.
But they don’t (shouldn’t) store the actual password. They store a hash of the password, which is the same length regardless of length of the actual password.
There’s a type of attack where you put absurdly large inputs into fields that perform expensive calculations, like password hashing… So imagine 100 computers spamming the login form with the whole Bee Movie script 10x per second (which would be a pretty small attack)… Cheap to send, expensive to process. As others mention, the storage should be cheap, because the hashed version of the password is all the same length.
So it makes sense for apps to have SOME upper limit… But it should be like 64 or 100 or 128 or 500 or something. 12 or 16 or 20 is just obnoxious.
This is the one I don’t get. Sure you don’t want people putting in an infinitely long password, but I like to have my passwords at around 15 characters. Why are you forcing me to make a less secure password?
Only reason I can think of is storage but even at a massive scale, this is text, paying for that storage would cost as much as a rounding error.
It’s even worse. If done correctly, the length of the password does not affect the size of the stored value. Because if you’re doing it right, you only save the hash of the password. And the length of the hash is fixed.
But they don’t (shouldn’t) store the actual password. They store a hash of the password, which is the same length regardless of length of the actual password.
There’s a type of attack where you put absurdly large inputs into fields that perform expensive calculations, like password hashing… So imagine 100 computers spamming the login form with the whole Bee Movie script 10x per second (which would be a pretty small attack)… Cheap to send, expensive to process. As others mention, the storage should be cheap, because the hashed version of the password is all the same length.
So it makes sense for apps to have SOME upper limit… But it should be like 64 or 100 or 128 or 500 or something. 12 or 16 or 20 is just obnoxious.
My password generator is set to 24 characters. 12 or 15 seems a bit short.