Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I recently logged in my Microsoft account with my 25 characters password and saw this:

The image shows a logon form with the following error: "Microsoft account passwords can contain up to 16 characters. If you've been using a password that has more than 16 characters, enter the first 16."

The only reasonable reaction I could have was: "WTF! Are they out of their mind to ask me to shorten the password instead of using maxlength property? What's next? Maybe it will ask me to compute the password hash by hand too? Or maybe I would tell myself to the app if my password is correct?"

But after all, there must be a valid reason for such thing. They can't just do it in a such terrible way without any reason.

What is the reason to inform the user that the password is limited to N characters when the actually entered password is longer, instead of silently trimming the password?

share|improve this question
3  
Every time I see a password length restriction like this it instantly makes me think they're not even hashing the passwords at all and are just storing them as plain text. Why MS have this approach just baffles me. –  JonW Oct 4 '12 at 12:55
    
@JonW: if it would be just Microsoft... PayPal restricts passwords to 20 characters. My bank website has a password length restriction and can contain only digits. Among the popular websites, most have a small length limit. –  MainMa Oct 4 '12 at 13:01
    
It's the fact it's 16 digits that is suspicious. There's a link on security.stackexchange about this issue too: security.stackexchange.com/questions/19028/… –  JonW Oct 4 '12 at 13:23
    
What conflicts with md5 hashing? –  srcspider Oct 5 '12 at 6:38
    
Just that password-length is an element of encryption -- needs to match but not to be disclosed. –  Kris Oct 5 '12 at 6:50

4 Answers 4

up vote 3 down vote accepted

It doesn't really matter why MS chose to place this 16 characters limitation, let's take it as a given.

The question at hand is why did MS refrain from shortening it automatically. I can think of a few potential reasons:

  1. A password is a very delicate piece of information (controls your access, must be 100% accurate and does not tolerate any mistakes). Therefore, instead of modifying it for you, they make you modify by yourself so you'll be 100% sure what's your new password is. If you fail to understand, you will not be able to access your account in the future.

  2. The password field is unique because you can never view it again after entering it for the first time (unlike your email or other details which you can usually see under your account settings). Therefore, modifying it automatically can be bad practice, since a user can fail to reproduce this modification by himself in the future.

  3. If your original password is too long (25 chars), you may want to choose a completely different password when you hear about the limitation. For example, assume that I have one long password and one short password, I might want to switch to the short one instead of using the first 16 chars of the long one.

  4. Some people use password auto-fill (have the browser or some other tool fill their passwords automatically). These tools usually pick up the password from the initial field you type it in. If MS were to shorten it automatically on their side, the tool could pick up the long incorrect version that the user typed.

share|improve this answer

What's the point in asking the user to do what an application can do itself?

Awareness.

What is the reason to inform the user that the password is limited to N characters when the actually entered password is longer, instead of silently trimming the password?

Given there is a limitation in number of characters, by any reason, then not letting the user react on that would be risky.

Example: Imagine a hasty user typing "correct horse battery staple" and the application silently truncates it. The user hits enter, leaving the sign-in or sign-up page believing his password is what he wrote, when in fact it is just "correct horse ba". The user might have wanted to pick another password, if she knew.

As your example is a sign-in page, in case the process never changes, you could stay happily unaware. Would it be a sign-up page, on the other hand, I would rather be informed from the start. Maybe they have other sign in methods somewhere, for the same account, that can not handle their situation. I don't know, but somewhere around, they probably want to teach you exactly what your password is.

share|improve this answer

From Microsoft.com there is an answer to the question Why can't my Microsoft account password have more than 16 characters?:

When you sign in to your Microsoft account, you might see the following error message:

"Microsoft account passwords can contain up to 16 characters. If you've been using a password that has more than 16 characters, enter the first 16."

This doesn't mean that your password has been shortened. Actually, Windows Live ID passwords were always limited to 16 characters—any additional password characters were ignored by the sign-in process. When we changed "Windows Live ID" to "Microsoft account," we also updated the sign-in page to let you know that only the first 16 characters of your password are necessary. To avoid this error message in the future, you only need to enter the first 16 characters of your password.

It doesn't answer the question, but there is a workaround in "only need to enter the first 16 characters of your password", however that might happen when entering n arbitrary password string.

From out sister site Security we can read this technical aspect of it:

Regardless, truncating passwords or forcing short password lengths is bad password policy. It prevents easy-to-remember moderately strong passphrases; e.g., correct horse battery staple which is 28 characters long. Password lengths should not be truncated until at least ~50 characters or so. If your database requires a fixed maximum length, it probably makes sense to truncate somewhere around 100 characters or so at which point it is allows passphrases which probably have more entropy than can fit into a 128/256 bit hash which are perfectly strong hash lengths.

My own guess is some kind of legacy system which Microsoft cannot change without extensive work. Also, passwords are irreversible, and that makes it even harder for Microsoft to change their password management. In this case it's most likely technical issues that restrain the User Experience.

share|improve this answer
1  
Awesome answer. Beat me to it. –  Loren Rogers Oct 4 '12 at 13:26
    
@LorenRogers Thanx! I just had to find it :-) –  Benny Skogberg MCSA Oct 4 '12 at 13:28
1  
The answer in WebApps regarding the 16 characters doesn't make too much sense, so there is no sense in quoting it.. See the comment below it. Not only that shortening the password has nothing to do with the likelihood of hashes to collide, there is also no point in checking for password collisions since users can have identical passwords. Also, keep it mind that your answer doesn't really explain why MS doesn't shorten the password automatically.. –  talkol Oct 4 '12 at 18:25
    
@talkol In that sense, this question and any other question regarding Microsoft is speculative and non-answerable (and could be closed). Unless you work for Microsoft there is no way to know why Microsoft do th. is or that. My answer just conveyes what Microsoft say about the issue at hand, but I also say it doesn't answer the question. –  Benny Skogberg MCSA Oct 4 '12 at 19:00
    
It's ok, I have no problems with the speculations, it's just that the answer in WebApps is wrong technically (without regard to MS). The cryptographic reasoning used in that answer is simply incorrect. MD5 hashes do not behave as claimed. If you can, please remove it altogether from WebApps. –  talkol Oct 4 '12 at 19:15

The question as to WHY they only want 16 characters is not for me to answer. It does seem silly and arbitrary.

Why they tell you this, however, rather than just taking the first 16 is so that you know your password is really only 16 characters long.

This is an extreme example, but lets say your password was:

1111111111111111X!2jb

Not the worst password, but if you only take the first 16:

1111111111111111

Now it's looking pretty silly.

So the intent is to ensure that your first 16 characters are actually some what secure.

Did they write that message in the best way? Absolutely not.

share|improve this answer
    
good point! like it –  talkol Oct 4 '12 at 19:12
    
This applies at the time of creating, not verifying the password, I feel. –  Kris Oct 5 '12 at 6:51
    
@Kris it should apply at the time of creation. But MS screwed up and never did that, so this is a retrofit fix for that issue. –  DA01 Oct 5 '12 at 14:52
    
Oh, a nice solution that! –  Kris Oct 6 '12 at 5:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.