I'm also curious about on which system the 50 character password is used. Last I checked, Windows splits passwords into eight character units for password hashing. Thus, by caching all reasonable results from the hashing function in a hash-to-string fashion, one can get the plaintext password from the hash in virtually no time. I saw a demonstration of this approach demonstrated as a web app for about a week three years ago. So if that fifty character password is stored on a Windows system, forty-two characters worth are that much less useful.

Bigger passwords don't necessarily provide more security. Neither do more firewalls.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/320/31668#31668