About password length [LWN.net]

About password length

Posted May 20, 2013 17:27 UTC (Mon) by man_ls (guest, #15091)
In reply to: Fedora's invisible passwords and visible squabbles by apoelstra
Parent article: Fedora's invisible passwords and visible squabbles

I like how Lotus Notes shows a variable number of Egyptian hieroglyphs when typing your password, so nobody can guess the length of the password. Let me clarify: what I really like about it is making fun of this utterly absurd feature, no doubt born out of some manager's primeval fear of passwords so that any bit of leaked information (such as the length of the password) was a danger to the whole system. And the Egyptian hieroglyph was undoubtedly a touch of madness trying to add more "security by absurdity".

I have not heard either of password length being used to compromise the system, but that is not my thing so I am not completely sure about it. The state of the art seems to be: show keypresses as round balls ⚫, then when displaying a previous password show a predetermined length of round balls ⚫⚫⚫⚫⚫⚫⚫⚫ (not the actual password length).

to post comments

About password length

Posted May 20, 2013 21:32 UTC (Mon) by rahulsundaram (subscriber, #21946) [Link] (3 responses)

The idea that hiding password length was just a managerial decision is absurd. standard unix logins have been doing that for several decades and that was designed entirely by developers.

About password length

Posted May 20, 2013 22:24 UTC (Mon) by man_ls (guest, #15091) [Link] (2 responses)

I am ready to entertain the notion that hiding password length was a developer decision. What I cannot accept under any circumstances is that the hieroglyph bit (which is what really gets to my nerves) did not come from a deranged manager.

About password length

Posted May 20, 2013 22:59 UTC (Mon) by dlang (guest, #313) [Link]

ohh, there are plenty of deranged developers out there. I have no trouble believing that some developer thought that was 'neat'

About password length

Posted May 21, 2013 1:00 UTC (Tue) by rahulsundaram (subscriber, #21946) [Link]

Well, sort of. In the Lotus notes case, IBM managers encouraged developers to come up with "creative" ideas everywhere to increase the patent portfolio and developers came up with such brilliant ideas. It is not just IBM that does this however.