5331 private links
DCRoss
Ars Scholae Palatinae
11y
960
Yesterday at 11:36 AM
#24
MTSkibum said:
Somewhere a web developer chose an arbitrary nvarchar length for the password and is storing it unencrypted in a sql database.That is how you ended up with the maximum password length.
There's more to the story, but the relevant part is that way back in 1976 UNIX systems hashed passwords with a DES based algorithm which was limited to two characters of salt and eight characters of password. It wasn't until 1994 that Paul Henning-Kemp replaced this with a more advanced hash based on MD5 for FreeBSD, and this was adopted by just about everybody. However, not only did applications keep using the old crypt(3) implementation long after that, they also stuck with the idea that having an eight character limit on your password was reasonable, and even that if you used a more secure algorithm that sixteen was fair.
With this in mind, setting fixed length fields for passwords or password hashes was considered acceptable for far longer than it should have been.
