up vote 1 down vote favorite
share [g+] share [fb]

I've noticed some websites, generally financial institutions, limit password length to a relatively small number. For example, mint.com limits is passwords to 16 characters (at least on the sign up page.) Why would they do that? I've read that sometimes websites will do that to limit the time password hashing algorithms run.

link|improve this question
1  
Password hashing algorithms are fast enough that a few extra bytes don't matter; even megabytes can be hashed in milliseconds. Often the passwords aren't hashed at all, though, and stored in fixed-length fields... try security.stackexchange.com – grawity Oct 8 '11 at 19:44
It means they are idiots when it comes to allowing secure passwords. – Moab Oct 8 '11 at 20:13
feedback

closed as off topic by random♦ Oct 8 '11 at 18:38

Questions on Super User are expected to generally relate to computer software or computer hardware, within the scope defined in the faq.

Browse other questions tagged or ask your own question.