this post was submitted on 30 May 2025
115 points (99.1% liked)

privacy

4296 readers
11 users here now

Big tech and governments are monitoring and recording your eating activities. c/Privacy provides tips and tricks to protect your privacy against global surveillance.

Partners:

founded 3 years ago
MODERATORS
 

It's infuriating to create a "strong password" with letters, numbers, upper and lowercase, symbols, and non-repeating text... but it has to be only 8 to 16 characters long.

That's not a "strong" password, random characters or not.

Is there a limitation that somehow prevents these sites from allowing more than 16 characters?

I'm talking government websites, not just forums. It seems crazy to me.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 71 points 3 days ago (3 children)

It's a massive red flag. It implies that they are actually storing the password instead of a (preferably salted) hash and that they have no idea what good security practices are. Storing a hash leads to same size strings, no matter the length on the password.

[–] [email protected] 14 points 2 days ago

And there's no reason a database can't store a very long hash as well. Storage is cheap for this kind of thing.

[–] [email protected] 10 points 2 days ago (1 children)

That's why I only store and compare the first 8 characters.

[–] [email protected] 1 points 2 days ago (1 children)

Why not store the whole thing?

[–] [email protected] 8 points 2 days ago (1 children)

I'm joking of course, but the reason would be the database column is 8 characters.

[–] [email protected] 1 points 2 days ago

If only there was a SQL command that could alter an existing table...

[–] [email protected] 3 points 2 days ago (1 children)

They shouldn't be using salted hashes since a decade or more. Best is to use a memory hard password hash function like argon

[–] [email protected] 2 points 1 day ago (1 children)

Can you expand on this? My experience with Argon is looking up a Wikipedia page in response to this comment, but it looks like it uses a salt as an input?

[–] [email protected] 1 points 1 day ago* (last edited 1 day ago)

Its a password specific function. Its also memory hard.

As oposed to generation a salt and passing that with the password through sha256 or something, which is bad practice