Are limited length passwords a security risk?

Question

I found a webpage where users can be registered. However, it seems that the length of the password must be between 6 to 12 characters.

Is that a security risk?

Answer 1

Yes. Passwords are by nature very prone to be mishandled, and most decisions taken about its management are arbitrary or have more grounds in function than in security. In particular, any measure that trim the possible password space are particularly bad.

One example is ATM PINs. They have only 4 digits (in most cases, at least), so most of their strength relies on the fact that retries are limited. So, for a normal scenario, you have 3 tries to guess a value out of 10000. That means a probability of success of 1/3333. Humans are terrible at randomness, and as a result some PINS are more likely than others: 1111, 1234, and so on. As a result, some banks introduce rules: not repeated numbers (now you have only 5040 possible PINs), not math sequences (1234, 2468... how many of those can you build?), not keyboard patterns (L shaped PIN, a straight line, etc.). After you blacklist so many options, the attacker has now a much smaller search space to guess, and the probabilities are more favorable for them.

For a more open environment (higher capabilities for the attacker), there are lower limits that make sense, since a dictionary attack is almost trivial for short passwords. Some would say 8, some would say 10, but nobody would say 6 is reasonable. If the passwords are hashed (and salted), it comes a point where longer passwords have no increase in security, but it makes little sense to put a limit on them.

Answer 2

In addition to looking at the entropy of a short password the way the other answers have, you should consider why the site has a restricted password length. There's no valid technical reason for a modern website (or almost any other authentication system) to have a maximum password length (at least, not one any human would ever exceed by accident). Passwords shouldn't ever be stored anywhere in any form except briefly in RAM; they should be run through a Key Derivation Function (the most popular ones are called scrypt, bcrypt, and PBKDF2, in descending order of difficulty to crack) and the resulting key should be stored in the database along with the salt and other KDF inputs (aside from the password, obviously) necessary to derive said key. KDFs don't care how long your password is; they'll produce a constant-length key in any case.

If a site is enforcing a maximum password length, then it quite likely isn't running passwords though a KDF (or even a simple hash function, which is much too easy to brute force but still supports arbitrary-length passwords). That means they're storing the password either in plain text, or with reversible encryption. The first option is REALLY BAD, and the second isn't much better. People's databases get leaked pretty frequently, and when that happens the attacker can use any plain-text passwords directly, or can probably decrypt the passwords (may need to pull a file off the web server's file system, but if you can get the database you can often get files too and the key needs to be stored somewhere). Either way, the attacker can now log in as any user on that site, and can also try to log in with the same credentials on other sites because many people make the terrible mistake of re-using passwords.

So yes, you should be very suspicious of any site that enforces a maximum password length.

Answer 3

Yes, it is a security risk.

The length of your password greatly affects your accounts security.

Assuming a website only allows lower-case letters [a-z] and limits your password to 1-4 characters.

It will only take 26^4 (456,976) different permutations. Hence, it will only take a maximum of 456,976 different trials to determine your password.

If you increase its length to 12 characters, there will be a maximum of 26^12 (9.54 x 10^16) different permutations.

To put it simply, the length of your password is definitely a factor in your account's security. The longer your password is the greater the security.

If you have no choice but to settle with a limited length for you password....

Here are some ways to make your account much more secure to bruteforcing

• Add Capital Letters (PaSSwOrD)
• Add Numbers (P455w0Rd)
• Add Symbols (P@55w0R_d)

Answer 4

Please consider the whole security environment. For example, ATMs are usually monitored by camera. In that setting using a 4-digit pin may be acceptable, since fraud attempts will be caught on camera.

If a web site shuts out any user that makes two password errors, then perhaps a short password may be acceptable. However, if the web site allows unlimited password errors and uses very short passwords, then this is certainly a security hole. The reasons for this are listed in the other answers, i.e. a brute-force attack can succeed due to the small number of possible passwords.