Security hole: only the first 8 characters in password matter

http://support.fogcreek.com/default.asp?fogbugz.4.6098.1

by edw519 • 17 years ago

20 16 17 years ago

support.fogcreek.com

vaksel• 17 years ago

thats just stupid

Tangurena• 17 years ago

That's a 4 year old bug. Do you think it is fixed by now?

dodger• 17 years ago

Been fixed for ages.

cperciva2• 17 years ago

Wow. I was including the original DES CRYPT function in my BSDCan talk as a purely historical element... I guess I'll need to revise that slide now.

I don't think that RHM made mistakes often, but using only the first 8 characters of a password certainly qualifies.

hc• 17 years ago

that would be RHM

cperciva2• 17 years ago

Oops. Corrected, thanks. I wrote "Robert Morris", then realized that was ambiguous and added "(senior)", then I thought "wait, everybody just calls Robert Morris 'rtm'"...

VBprogrammer3• 17 years ago

I'm not particularly familiar with this software but it appears to be some kind of project management software. I think the odds of someone beating an 8 character well chosen password are less than the value of the data protected by said password!

swombat2• 17 years ago

That's pretty irrelevant.

VBprogrammer3• 17 years ago

In what way is suggesting that the level of security used is probably more than sufficient for the value of the data its meant to protect irrelevant?

tlb2• 17 years ago

Fogbugz often has fairly sensitive info. All our bug reports are in it, including attached data files & snippits of source code. Often customer names are in it, and sometimes customer data files. So it does matter.

ableal• 17 years ago

Worked that way in many Unix systems - e.g. HP-UX as of ten years ago.

Doesn't seem to be that important - I'd worry more about a system that would reply to 10k/s remote login requests ...

kogir• 17 years ago

Don't know if it's still the case, but Charles Schwab had the same problem. It really increased my confidence in the safety of their website.

tlb2• 17 years ago

Accepting long passwords may mislead people to use passphrases, the first 8 characters of which are very vulnerable to a dictionary attack. If you're only going to consider the first 8 characters, you should make it impossible to type more than 8 characters on the entry form.

Security hole: only the first 8 characters in password matter

Related Stories