Hello everyone.
Time and time again, whenever I need to open an account on a website (SaaS or otherwise), I find passwords that are restricted in unsecure ways: "no more than 12 characters" (or something between 8 and 20) and only letters and numbers.
I use Bitwarden to store and generate my passwords, and I like all of my passwords to include letter (U/L), numbers, AND symbols, and I want my passwords to be 100 characters long for added security.
What is the reason for these resctrictions? By the way, not all systems have them, but I would say that at minimum 50% do, if not more. Am I missing something?
Thanks!
For me, restricting the length is a clear indication that they don't properly secure your password. It should be hashed to a consistent length regardless of the actual length of the clear-text, so it shouldn't matter, even for legacy reasons. If I see that, I know that unless the service is vital, try to find an alternative or be prepared for when they finally get broken into, one way or another. Overall their security tends to be weak if they pull stunts like that.