Registering with long passwords

slateman

Not sure if this is the correct place to post this, but...

I've just created an account to post a question and encountered a problem/bug with account creation. I use a password manager and generated a 64-character string for my password, but when i then try to fill in the field for 'password confirmation' i can't enter all 64-characters (I didn't think to count the limit) So had to shorten it.

Thought some one might like to know.

Cheers

robatwork

You do realise you don't need a 64 char password for any conceivable purpose on MSE? Or anywhere else.

That is many magnitudes more than the number of atoms in the universe.

Nobody is going to crack a random 20 character string, certainly not on this site.

StumpyPumpy

vBulletin (which is what this forum is currently running on) has a default maxpassword length of 50 chars, so you will hit the same issue on most vBulletin based forums. Whilst the admin could increase this value they then risk running into other problems because vBulletin by default expects most text runs (aka a word) to be at most 50 chars which is why if you try to type a run of more than 50 chars without a break/space in a message like this: abcedefghijklmnopqrstuvwxyzabcedefghijklmnopqrstuvwxyz
you get a rogue space after the 50th character. This is not password related it is word-wrap related but illustrates another area in vBulletin where there is an arbitrary 50 char limit.

TLDR; version: It's known, it's 50 chars, it's not going to change as long as the board remains on vBulletin, which isn't very long.

SP

robatwork

StumpyPumpy wrote: »

TLDR; version: It's known, it's 50 chars, it's not going to change as long as the board remains on vBulletin, which isn't very long.

Useful description. As the OP declined to respond to my reply, can you give any possible justification to using a 64 byte password?

StumpyPumpy

robatwork wrote: »

Useful description. As the OP declined to respond to my reply, can you give any possible justification to using a 64 byte password?

On this board? No.
vBulletin stores passwords as a MD5 hash which means that all passwords are turned into 32-character hexadecimal strings in the database, so a 64 byte password would be somewhat more secure than a smaller one on the client side, but no more so against a server side attack. That doesn't even take into account the fact that MD5 hashing has been so well and truly hacked that you can find free "decrypt" tools via Google.

My best guess for justifying using such a password is behavioural not technical. The OP has probably got into the mind set where they use a password manager for every single site they access as it is easier to use a single solution universally than to flip between different ones dependent on the perceived risk of the individual site. Absolutely nothing wrong with this attitude, it is simply overkill here where there is nothing vital to hack unless users share passwords across systems which is a whole different can of worms.


SP