I’d happily use a passphrase with multiple unrelated 8-12 character words but for some reason most businesses have upper limits on how many characters can be used…
This was Microsoft - for their online services such as Hotmail or Outlook.com or Azure - well into the 21st century. They first lifted that limit in 1999, then re-established that in 2012. They only re-reversed it back to a longer option (up to 256 characters) in 2019.
Some sites require special characters in their passwords, other websites don’t even allow them. I use a password manager, but still have to tweak the password generation rule for some sites.
Look at you with the heavy security. No need for that, right on the monitor should be fine. In fact to avoid confusion you should write ‘Computer PW: correcthorsebatterystaple’ so you don’t forget what the note is there for.
And more and more businesses are also limiting what characters you use, as well.
Like, my random generator uses characters from the entire European UTF-8 printable character set. This expands the number of usable characters from about 68-74 (the typical uppercase, lowercase, 0-9 & special characters) to about 1,200 characters. This includes all Latin, Cyrillic, and Greek variations used across Europe.
Just using the wider UTF-8 range nearly always doubles the bitwise complexity (as KeePass measures it) for passwords of the same length, if not more, thereby dramatically reducing the ability for the password to be brute-forced. Not to mention using characters that are not expected to be in passwords in the first place - most brute forcing simply doesn’t account for that where a primarily English-speaking victim set is concerned.
Plus, the passwords are not short. I usually prefer 32 characters, and in important/mission-critical services I expand it to 64 characters.
Oh there has to be an upper limit for things like buffer overflow or just plain RAM capacity limits. But even with allowing the max possible range of characters you are still looking at something like 100,000 in a single 1mb size and I’m sure they could manage to do that and still pass it along to a high quality hashing function.
If you try putting in a password longer than that yes reject it.
I’d happily use a passphrase with multiple unrelated 8-12 character words but for some reason most businesses have upper limits on how many characters can be used…
That is the character limit on the database field where they store your password in plain text.
And don’t allow spaces, for some unknown reason.
Rule #1 “don’t implement your own security/crypto code unless you are a security expert, and even then…”
It’s BESPOKE sir
I think the worst case ive seen is a 16 character limit, not enforced at sign up, but enforced at login
This was Microsoft - for their online services such as Hotmail or Outlook.com or Azure - well into the 21st century. They first lifted that limit in 1999, then re-established that in 2012. They only re-reversed it back to a longer option (up to 256 characters) in 2019.
Like, morons.
I’ve seen this, fucking brutal UX lol
Some sites require special characters in their passwords, other websites don’t even allow them. I use a password manager, but still have to tweak the password generation rule for some sites.
Sure, but it’s going on a sticky note taped on the bottom of my keyboard
Look at you with the heavy security. No need for that, right on the monitor should be fine. In fact to avoid confusion you should write ‘Computer PW: correcthorsebatterystaple’ so you don’t forget what the note is there for.
And more and more businesses are also limiting what characters you use, as well.
Like, my random generator uses characters from the entire European UTF-8 printable character set. This expands the number of usable characters from about 68-74 (the typical uppercase, lowercase, 0-9 & special characters) to about 1,200 characters. This includes all Latin, Cyrillic, and Greek variations used across Europe.
Just using the wider UTF-8 range nearly always doubles the bitwise complexity (as KeePass measures it) for passwords of the same length, if not more, thereby dramatically reducing the ability for the password to be brute-forced. Not to mention using characters that are not expected to be in passwords in the first place - most brute forcing simply doesn’t account for that where a primarily English-speaking victim set is concerned.
Plus, the passwords are not short. I usually prefer 32 characters, and in important/mission-critical services I expand it to 64 characters.
Oh there has to be an upper limit for things like buffer overflow or just plain RAM capacity limits. But even with allowing the max possible range of characters you are still looking at something like 100,000 in a single 1mb size and I’m sure they could manage to do that and still pass it along to a high quality hashing function.
If you try putting in a password longer than that yes reject it.
That is dumb bit what’s even dumber is disabling paste.