Maximum Password Length: An indication of stroing it in cleartext?

I stumbled upon one nice post by Kevin which I found very thought provoking.
He considers, if the website is imposing a length restriction on your passwords entered, it's possible that they are storing it in clear text. May be in backend the password field is VARCHAR with maximum length defined. On the other hand, if they are hashing the password before storing it, they need not worry about the length of the password entered by the end user as the hashed password will be of 'fixed' maximum size, no matter how long/short the user enters his password. Interesting!
But what about the few banking websites, I have found that they restrict me in password length and define minimum and maximum limit? I asked Kevin and his reply was convincing:

@Nilesh: Well, it might the case that these banks are storing passwords as plaintext, but there most likely are other explanations. They are probably (hopefully) encrypting (rather than hashing) customer passwords. Or perhaps it's a situation something similar to like Greg pointed out. I'd be VERY surprised if banks--even the small ones--were storing their customer passwords in cleartext. This was common maybe 8-10 years ago, but now there are regulatory issues that almost certainly mandate at least some semblance of security.

But anyways a food for thought!


Popular posts from this blog

SQL Injection in search field

File Upload through Null Byte Injection