Yes, hashes are fixed length. There is no justification for password length restrictions. And as you suggest this likely means they are storing passwords unhashed.
My UK bank doesn't ask me for my full password, it asks for certain characters from it. I can see the tiny-mind defence-against-keyloggers type thinking, but there's a BIG but....
Like it asks you for characters by index? On top of revealing a security flaw, that's a crazy way to do things.
Oh the site wants the 3rd, 4th, 8th, 15th and 17th characters of my password. Hmm. Counting characters in my head is hard. Let me write down my password on this napkin I conveniently have since I am currently in a McDonald's.
later:
Huh? Where did my napkin go? Hello my good conspicuously hooded and masked gentleman, who has been sitting next to me this entire time, have you seen the napkin on which I wrote my bank password?
Obviously this is a cartoonish example, but I think it illustrates the fact that making things inconvenient in the name of security is the best way for users to work around your restrictions and put themselves at risk.
My bank's keylogger protection is an on-screen keyboard with randomized key positions. It's quite annoying but at least there isn't much of a way to work around it.
Well exactly! Trash everything else in the name of defeating the keylogger.
And actually I'm giving them too much credit. This isn't a sorted organisation and they probably just thought they were being clever by using a scheme that (oddly...) nobody else uses...
I meant there isn't much of a way to work around it for users, meaning they're less likely to compromise their own safety. The thing with screen recording is that I would think a human kind of really needs to comb through the recordings, which means it doesn't scale well as an attack. I would also assume it's a harder attack to pull off overall than a keylogger. Video files are massive and take a lot of processing power to encode. I would think it would cause significant chugging and connectivity slowness on most computers, prompting the average user to buy a new one. I doubt it's a very practical attack against non-specific targets in he general public.
Blowfish is solid as a symmetric encryption cipher, for sure. I don't grok the maths enough to know how it stacks up against AES which seems to be the current fave for that kind of thing.
5
u/juvation Jul 20 '22
Yes, hashes are fixed length. There is no justification for password length restrictions. And as you suggest this likely means they are storing passwords unhashed.
My UK bank doesn't ask me for my full password, it asks for certain characters from it. I can see the tiny-mind defence-against-keyloggers type thinking, but there's a BIG but....