Should I impose a maximum length on passwords?

I can understand that imposing a minimum length on passwords makes a lot of sense (to save users from themselves), but my bank has a requirement that passwords are between 6 and 8 characters long, and I started wondering...

• Wouldn't this just make it easier for brute force attacks? (Bad)
• Does this imply that my password is being stored unencrypted? (Bad)

If someone with (hopefully) some good IT security professionals working for them are imposing a max password length, should I think about doing similar? What are the pros/cons of this?

Solution 1:

Passwords are hashed to 32, 40, 128, whatever length. The only reason for a minimum length is to prevent easy to guess passwords. There is no purpose for a maximum length.

The obligatory XKCD explaining why you're doing your user a disservice if you impose a max length:

Solution 2:

A maximum length specified on a password field should be read as a SECURITY WARNING. Any sensible, security conscious user must assume the worst and expect that this site is storing your password literally (i.e. not hashed, as explained by epochwolf).

In that that is the case:

1. Avoid using this site like the plague if possible. They obviously know nothing about security.
2. If you truly must use the site, make sure your password is unique - unlike any password you use elsewhere.

If you are developing a site that accepts passwords, do not put a silly password limit, unless you want to get tarred with the same brush.

[Internally, of course your code may treat only the first 256/1024/2k/4k/(whatever) bytes as "significant", in order to avoid crunching on mammoth passwords.]

Solution 3:

Allowing for completely unbounded password length has one major drawback if you accept the password from untrusted sources.

The sender could try to give you such a long password that it results in a denial of service for other people. For example, if the password is 1GB of data and you spend all your time accept it until you run out of memory. Now suppose this person sends you this password as many times as you are willing to accept. If you're not careful about the other parameters involved this could lead to a DoS attack.

Setting the upper bound to something like 256 chars seems overly generous by today's standards.

Solution 4:

First, do not assume that banks have good IT security professionals working for them. Plenty don't.

That said, maximum password length is worthless. It often requires users to create a new password (arguments about the value of using different passwords on every site aside for the moment), which increases the likelihood they will just write them down. It also greatly increases the susceptibility to attack, by any vector from brute force to social engineering.