Should I impose a maximum length on passwords?

Question

I can understand that imposing a minimum length on passwords makes a lot of sense (to save users from themselves), but my bank has a requirement that passwords are between 6 and 8 characters long, and I started wondering...

• Wouldn't this just make it easier for brute force attacks? (Bad)
• Does this imply that my password is being stored unencrypted? (Bad)

If someone with (hopefully) some good IT security professionals working for them are imposing a max password length, should I think about doing similar? What are the pros/cons of this?

Answer 1

A maximum length specified on a password field should be read as a SECURITY WARNING: Any sensible, security conscious user must assume the worst and expect that this site is storing your password literally (i.e. not hashed, as explained by epochwolf).

In that that is the case: (a) avoid using this site like the plague if possible [they obviously know nuts about security] (b) if you must use the site, make sure your password is unique - unlike any password you use elsewhere.

If you are developing a site that accepts passwords, DON'T put a silly password limit, unless you want to get tarred with the same brush.

[Internally, of course your code may treat only the first 256/1028/2k/4k(whatever) bytes as "significant" to avoid crunching on mammoth passwords.]

Answer 2

Storage is cheap, why limit the password length. Even if you're encrypting the password as opposed to just hashing it a 64 character string isn't going to take much more than a 6 character string to encrypt.

Chances are the bank system is overlaying an older system so they were only able to allow a certain amount of space for the password.