What's the point in asking the user to do what an application can do itself?

Question

I recently logged in my Microsoft account with my 25 characters password and saw this:

The only reasonable reaction I could have was: "WTF! Are they out of their mind to ask me to shorten the password instead of using maxlength property? What's next? Maybe it will ask me to compute the password hash by hand too? Or maybe I would tell myself to the app if my password is correct?"

But after all, there must be a valid reason for such thing. They can't just do it in a such terrible way without any reason.

What is the reason to inform the user that the password is limited to N characters when the actually entered password is longer, instead of silently trimming the password?

Answer 1

It doesn't really matter why MS chose to place this 16 characters limitation, let's take it as a given.

The question at hand is why did MS refrain from shortening it automatically. I can think of a few potential reasons:

1. A password is a very delicate piece of information (controls your access, must be 100% accurate and does not tolerate any mistakes). Therefore, instead of modifying it for you, they make you modify by yourself so you'll be 100% sure what's your new password is. If you fail to understand, you will not be able to access your account in the future.

2. The password field is unique because you can never view it again after entering it for the first time (unlike your email or other details which you can usually see under your account settings). Therefore, modifying it automatically can be bad practice, since a user can fail to reproduce this modification by himself in the future.

3. If your original password is too long (25 chars), you may want to choose a completely different password when you hear about the limitation. For example, assume that I have one long password and one short password, I might want to switch to the short one instead of using the first 16 chars of the long one.

4. Some people use password auto-fill (have the browser or some other tool fill their passwords automatically). These tools usually pick up the password from the initial field you type it in. If MS were to shorten it automatically on their side, the tool could pick up the long incorrect version that the user typed.

Answer 2

From Microsoft.com there is an answer to the question Why can't my Microsoft account password have more than 16 characters?:

When you sign in to your Microsoft account, you might see the following error message:

"Microsoft account passwords can contain up to 16 characters. If you've been using a password that has more than 16 characters, enter the first 16."

This doesn't mean that your password has been shortened. Actually, Windows Live ID passwords were always limited to 16 characters—any additional password characters were ignored by the sign-in process. When we changed "Windows Live ID" to "Microsoft account," we also updated the sign-in page to let you know that only the first 16 characters of your password are necessary. To avoid this error message in the future, you only need to enter the first 16 characters of your password.

It doesn't answer the question, but there is a workaround in "only need to enter the first 16 characters of your password", however that might happen when entering n arbitrary password string.

From out sister site Security we can read this technical aspect of it:

Regardless, truncating passwords or forcing short password lengths is bad password policy. It prevents easy-to-remember moderately strong passphrases; e.g., correct horse battery staple which is 28 characters long. Password lengths should not be truncated until at least ~50 characters or so. If your database requires a fixed maximum length, it probably makes sense to truncate somewhere around 100 characters or so at which point it is allows passphrases which probably have more entropy than can fit into a 128/256 bit hash which are perfectly strong hash lengths.

My own guess is some kind of legacy system which Microsoft cannot change without extensive work. Also, passwords are irreversible, and that makes it even harder for Microsoft to change their password management. In this case it's most likely technical issues that restrain the User Experience.

Answer 3

The question as to WHY they only want 16 characters is not for me to answer. It does seem silly and arbitrary.

Why they tell you this, however, rather than just taking the first 16 is so that you know your password is really only 16 characters long.

This is an extreme example, but lets say your password was:

1111111111111111X!2jb

Not the worst password, but if you only take the first 16:

1111111111111111

Now it's looking pretty silly.

So the intent is to ensure that your first 16 characters are actually some what secure.

Did they write that message in the best way? Absolutely not.

Answer 4

What's the point in asking the user to do what an application can do itself?

Awareness.

What is the reason to inform the user that the password is limited to N characters when the actually entered password is longer, instead of silently trimming the password?

Given there is a limitation in number of characters, by any reason, then not letting the user react on that would be risky.

Example: Imagine a hasty user typing "correct horse battery staple" and the application silently truncates it. The user hits enter, leaving the sign-in or sign-up page believing his password is what he wrote, when in fact it is just "correct horse ba". The user might have wanted to pick another password, if she knew.

As your example is a sign-in page, in case the process never changes, you could stay happily unaware. Would it be a sign-up page, on the other hand, I would rather be informed from the start. Maybe they have other sign in methods somewhere, for the same account, that can not handle their situation. I don't know, but somewhere around, they probably want to teach you exactly what your password is.