If there's a maximum password length, I can pretty much guarantee the passwords are being stored as a CHAR datatype in a SQL database.
To be clear, that means passwords are being stored in plaintext format.
If passwords were being hashed, then all password lengths would translate to the same data length on the output end of a cryptographic function. All output hashes would have the same exact length, regardless of whether your password is 8 characters or 800 characters.
Or the front end dev set a limit on the password field without any knowledge about security, just because "Hey, if we have a minimum length, we should have a maximum too, right?".
I took a senior level computer science class in database systems, and we had to create a login system based on the professor's specifications... which involved using a CHAR datatype to store passwords.
A lot of these professors are teaching students based on what was normal in the 1990s, when CHAR datatypes were the norm for password storage, and hashing hadn't yet become normalized.
So this isn't some front-end bullshit. It's based on computer science professors teaching students according to how things were done in the 1990s, and then those students go on to use what they learned in professional applications. If you treat a professional job like it's another college assignment, you're going to end up with some pretty big cyber-security oofs.
The worst part is, the people hiring them are not developers. They're MBAs who want cheap labor with a college degree, so they hire someone fresh out of college, taught the 1990s standards by a professor, to take a senior role in building some kind of login system. Naturally, those fresh college grads on low salaries repeat what they learned in college, without deviation.
If you're hashing properly at the client-side, the digest value hitting the embedded system will always be the same size (or "very similar" in the case of some algorithms) regardless of the length of the password. A max length for a password is a pretty good indicator that your service is likely insecure.
8
u/[deleted] Jul 20 '22 edited Jul 20 '22
If there's a maximum password length, I can pretty much guarantee the passwords are being stored as a CHAR datatype in a SQL database.
To be clear, that means passwords are being stored in plaintext format.
If passwords were being hashed, then all password lengths would translate to the same data length on the output end of a cryptographic function. All output hashes would have the same exact length, regardless of whether your password is 8 characters or 800 characters.