How on earth can you both not accept the password I copied from my password safe and tell me that I cannot use the same pasaword again?
this post was submitted on 10 Jan 2025
304 points (95.5% liked)
Cybersecurity - Memes
2063 readers
4 users here now
Only the hottest memes in Cybersecurity
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I once had to reset my password as the new one got truncated without telling me.
Yes. It was deemed too long.
It was for an company that got plenty of my personal data
Why on earth would someone truncate a password? I could make at least 10 more memea about bad handling of passwords
Why? Probably some wild row length limit being hit where a table storing user data was storing an asinine amount of data, just terrible DB organization in an org where someone said “who even needs a DBA.”
How? If you can truncate user passwords, you should never handle user passwords again, unless you’re a student or hobbyist learning a valuable lesson.
Yeah. The real reason to be alarmed is worse than the obvious one.
If a partial version of what was originally set actually works later, it implies a scary chance they're not even hashing the password before storing it.
I think it's a nonzero chance they're not hashing it. Pretty much every hashing function, in the interest of preventing collisions, provides vastly different responses on small amounts of input. Even if they were hashing it, it would just appear to be the same password in a situation where they somehow got a collision, but again, the column length for passwords would always be fixed since a hash function always outputs the same data length.
Also suggests the user may be reusing the same prefix if only the changed bits are getting truncated.
Should use different random passwords every time. Completely random or a random string of words. While it doesn't solve the cleartext password storage issue, a data breach won't compromise all your other accounts to same degree.
Doesn't hurt to also randomize usernames, emails, and even security question answers.
edit: or my new favorite passkeys, just make sure you trust whatever tool is managing your private keys.
Not how password hashing works. Demonstrated with sha256:
hunter2butitsreallylong:a9953dfbfec699349341edc857dcfe5c7a617c81f312cf57297d5b852881bab3hunter2:f52fbd32b2b3b86ff88ef6c490628285f482af15ddcb29541f94bcf526a3f6c7a hash algorithm encompasses all provided data and returns a single fixed length data response
https://en.wikipedia.org/wiki/Cryptographic_hash_function
Any changes, even just removing a few characters, drastically changes the output of the hash function (https://en.wikipedia.org/wiki/Avalanche_effect)
You have no way of knowing a user password when you are storing hashes, you can't truncate them, and the user password length doesn't matter (up to a certain point where it's technologically dumb to hash user input over a certain amount of data)
I do agree however that changing / randomizing your password is important, as someone brute forcing or running rainbow tables etc on a hash dump can quickly attack a common password across different dumps
Ultimately we don't know the implementation. I've seen some bad sites like stealth truncating on the registration form but leaving the login form unbounded so the password you pasted in both times doesn't work.
Separate issue from truncating, I get suspicious when I see passwords capped to 16-20 chars for the reason you gave that they should be stored as fixed length hashes.
That’s true, there’s no way to know what sort of back asswards string modifications are happening to the password before it makes it to a hashing function, if it ever does. But the OP did say they told him his previous password was too long, and he was required to change it, so they were either storing it in plaintext, or storing the length of it somewhere. One is really really bad, one is weird, but also bad
There's no good reason. Whoever did it, did it for a bad reason. (Oh, well, there's no good reason until you reach several thousand characters.)
That said, it could be worse. Some sites do not truncate your password at the creation form, and only truncate it on the login screen. (Yeah, that happened to me, in 2 different sites.)
Why is it always the one's for whom security is of utmost importance?
Login to meme account to share shitposting on the internet: top notch up to date security.
Login to the bank who actually handle my money: Clown ass security practices on obsolete infrastructure.
Yep, one of mine was the federal government's bounds buying portal...
They improved since then, but it's always the entity that holds your money or oversees your health...