Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I wanted to register a @live.com e-mail address, but it says it can't register an e-mail address having a password that contains more than 16 chars.

Why? So that it would be easier to get the real password? (if the password hashes were stolen . . .)

share|improve this question
1  
I've seen this max limit of 16 chars on other sites too. If the password is stored hashed then it should be the same size in the database no matter what the real password is, so why limit? I hope it's not because they are storing the passwords unhashed and 16 chars is the size of the database field. I really hope not. –  Rincewind42 Jul 20 '11 at 9:59
    
Bruteforceing a 16 char pass is more easy compared to brute-forcing a bigger one. (you know, there russian paying sites, those who specialize to brute-force hashes) –  LanceBaynes Jul 20 '11 at 10:26
    
This is interesting: IBM SQL & XML Data Limits The "Password access to a data source" row is 32 bytes maximum length which is the same size as a 16 character password after an MD5 hash is applied. –  Dez Mar 6 '12 at 20:48
    
Rincewind42 and Dez bring up really intereseting points; neither of those possibilities are secure. –  Patrick Klingemann Mar 21 '12 at 5:43
2  
@Dez: Applying an MD5 to a 17 char password will still be 32 bytes. A more interesting point might be that 16 characters in Unicode would be 32 bytes. –  musefan Mar 23 '12 at 17:32
show 7 more comments

1 Answer

up vote 1 down vote accepted

Actually because when you md5 a password it calculates a hash. Then the string is longer than 16 characters some "hashes" can collide between them.

For example if md5("noroof") gives 9ce405c98406f2f6d5326ee6b51d19cd it is possible that md5("ididntfixedmyroofwhenicould") could give the same hash 9ce405c98406f2f6d5326ee6b51d19cd. Remember that hashes are composed by with 32 characters of "0123456789abcdf" (for md5 in this case).

Maybe they force 16 character because the algorithm that computes the hash assures that will not have a collision in the database with a previously saved password.

share|improve this answer
6  
A hash can always create a collision - as you say, it's possible that a 17+ character password would collide with a shorter password. But, it is just as unlikely to collide as a short password is unlikely to collide, and a long password is vanishingly unlikely to collide with a brute-force-guessable short password. There's no reason to believe that long passwords are more likely to collide than short passwords - if there was some reason to believe that, the hash would be effectively broken anyway. –  Ronald Apr 9 '12 at 17:13
1  
Ronald is correct, the accepted answer is plain wrong. The likelihood of MD5 strings to collide does not depend on their length. –  talkol Oct 4 '12 at 18:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.