Why is there a limitation on password length?!?

Hello.

I have to say I am surprised to see this topic title after signing up:

"Maximum Security for your Forums"

And had to laugh at the irony.

My problem is a very simple one. Your forum software will not allow me to have a password of sufficient length to satisfy my security needs.

Have to say I am really disappointed with this. I've spent all day researching through all the free forum hosts, looking for what I thought would be the best, and settled on Forumotion. I've used you in the past some time ago, and don't recall this being an issue before.

It's a shame, as I love what I can do with the software, but unless this is an error, to say you offer "Maximum Security for your Forums" -- and then limit the length of the password I can use for my Admin account [thereby minimising its security], well, I find it ridiculous!

I am hoping that there is something you can do about this [like removing or at least substantially increasing the limit for example!] -- otherwise it is something that I feel strongly enough about that I'll have to delete my forum and go elsewhere.

Really don't want to have to do that, as I love your software, but to not allow me to choose a passphrase length that matches my own security standards for an important admin account -- is a deal breaker -- and not "Maximum Security for your Forums" at all.

I shall await a hopefully productive reply.

Many thanks.

What exactly is the issue? Are you trying to use a short or long password?

@SLGray 
I think i know what Plat is talking about. Plat is talking about a Long Password that can fit his/her security needs for their account. I hope this helps your question SLGray.

SLGray wrote:What exactly is the issue? Are you trying to use a short or long password?

Sorry, I thought I made that quite clear, but obvliously not.

Plat wrote:My problem is a very simple one. Your forum software will not allow me to have a password of sufficient length to satisfy my security needs.

I cannot enter the passphrase I want to use, because I get about two thirds of the way through typing it in, and then I am unable to enter the rest of the combination. You've obviously got a limit set on how long the password is allowed to be.

What I would like very much, is if you could remove the limit, or at least increase it to allow more than 40 characters please.

Hey,

The limit is 25 characters long. However, this is an extremely large setting already. If you only use numbers and letters in a 25 characters password, it would take a compute 640 QUINTILLION YEARS to crack it by brute force (and there are some mechanisms that are in place to avoid it anyways). If you use one special character (#$ or whatever), it goes to 4 Septillion years! And adding all of the above with an uppercase letter, it would bump to 115 Octillion years! You can't change the limit for yourself. I mean, even bank passwords are way shorter than this. I believe you should be safe with 25 characters.

You can check your password security here: https://howsecureismypassword.net/ . If you don't wish to precisely test your password, scramble the letters, use different ones etc. The result should be the same. Just keep in mind: length + special characters + uppercase + numbers = more secure password.

Best of luck!

Thanks for your reply Ace...

I'm aware of a lot of that -- however this is a matter of my having a very specific phrase I wish to use that I cannot forget, which requires more than 40 characters, and without wanting to drop any hints, yes, it is indeed very complex in the manner the characters are rendered, in line with what you suggest.

If this is going to be a problem, to increase the security of my forum by allowing a limit of more than 40 characters, then that will be a shame, as I really like forumotion. But not enough to compromise my security standards for it. I have never known anywhere else on the web that requires a password, to place an upper limit on the length of password I am allowed to choose.

Hopefully the Admins will simply be happy to increase the limit and improve security for all [and in this case, me] -- but if not, never mind. I'll just have to start again somewhere else. Shame, but no worries.

Well, I can't speak on behalf of the company or know if they can or will or are interested in doing so . Exceptions have been made in the past regarding forum limits (for instance, back a couple of years, I guess the limit was 255 and after a french administrator requested, all forum's limits bumped to 999).

However, if you can't lower your security standard to 25 characters long, maybe it would be wise to search for a paid hosting service. Depending on the level of security and secrecy you want to have, it would be a smart choice to be in control of the server side, both database and hosting. Although I'm pretty sure FM is safe, every company/site have glitches. Facebook have them, Linked In, Adobe and etc. They have been targeted and there were literally millions of unprotected passwords, e-mails, names and even credit cards data in some cases that were leaked. If you are so worried about security, controlling your database would be great, with a paid hosting service which can (I believe), for economical reasons (paid vs free), provide you with more freedom and even more security than FM. Just a thought, though. I'd trust FM for basically most of the things. So, if you are just concerned with your account, and not necessarily the content of your forum or whatever other reasons you might have, there shouldn't be too much to worry about. If you really want to go to the next level of security though, it might be a little tricky.

Good luck with your project.

Ace wrote:However, if you can't lower your security standard to 25 characters long

As I said, it is more about having the passphrase I want to use, rather than specifically how long it is, that is important to me. The phrase has served me well for years, as it is fully customisable to tailor for all manner of sites, and is one I know I cannot ever forget. My memory is shocking, and I forget other passwords a lot, but I can never forget this one, which is why not being able to use it here [the only place I've ever found that I cannot, due to this strange upper limit on characters] is a big problem for me. I will not ever write down a password either for obvious reasons -- so you can see the issue here.

Ace wrote:maybe it would be wise to search for a paid hosting service.

Not financially viable at this point, unfortunately.


To any admins, apologies to "bump" the topic again in this reply -- but I am looking for a simple yes or no answer please, as I really need to get on and start setting up my forum. I need to know if I am going to be able to do so with Forumotion, or not?

Will you please increase the limit on password characters to over 40 characters, or not?

Thanks.

What exactly happens when you try this password?  Do you get any kind of error message?

SLGray wrote:What exactly happens when you try this password?  Do you get any kind of error message?

There is no error message when trying to register.

I did not realise what had happened at first, as I just never expected to run out of space when typing in my password during registration.

I went to log in after registration, and kept getting the "wrong password or username" message.

I thought how strange that was, as I never forget this password, and had literally just entered it. But I had to use the "reset password option" to access my newly registered account.

I then went back to change my password to the one I wanted. That is when I noticed, that whilst typing it in to the box -- the little dots that represent the hidden combination as you are entering it, had suddenly stopped appearing, even though I was still typing in my desired password. That is when I realised there was a limit to the number of characters allowed -- and then understood why my password had not worked the first time. Because I had not realised at the time that only the first 25 characters had been accepted, and I'd just carried on typing it in.

It just needs, somewhere in your [the company's] admin panel -- for someone to simply increase the character limit allowed for passwords, and I'll be a very happy customer.

I've already done some work on my new forum [testing whilst awaiting your help], and am very happy with the way it is looking and with what I can do -- so I really don't want to have to go elsewhere. I like forumotion a lot. Just need a bit of help from you guys so I can have the complex password I need for my security.

Thanks.

I really don't think this will change but maybe you should make a poll about this on our Suggestions
Then maybe others will vote and then it maybe just maybe it will be took on by our tech team for a later date

APE wrote:I really don't think this will change but maybe you should make a poll about this on our Suggestions
Then maybe others will vote and then it maybe just maybe it will be took on by our tech team for a later date

Firstly -- I am not sure about the Staff hierarchy here -- so I'll ask, is this the "final word" on the matter as far as Forumotion are concerned?

Essentially, that nothing will be done about this for me?

I am unsure as to why I would need to go through the rigmarole of starting a poll to ask if other members would like my issue to be fixed. I'd simply like it to be fixed.

I could be wrong [obviously] but I imagine it is simply the case of a Forumotion Admin changing a setting in their ACP to allow additional characters, rather than a complete code rewrite and software update?

Also, my original title question was never actually answered. Why has such a limit been imposed in the first place?

-------------

Anyway -- whilst I've been waiting for an answer to my password length issues, I have been playing around with the software, and had many great ideas of the design and layout, that I implemented to see how they would look. I was so happy with the results, and what I have created here so far, that it would be very difficult for me to pack up and start again now elsewhere.

So I have spent some time thinking, and managed to find a way to take a section of the passphrase I usually use, to customise in a way I'll still be able to remember. So whilst I'm not "happy" about it -- I want to stay with Forumotion enough that I've made some compromises on my password, so I can keep the work I've already done.

I cannot mark this issue as "solved" -- as for me, it has not been. I have simply compromised my usual standards, for now. I would still like to see the allowed password length increased, but it is no longer a "deal breaker" for me.

I see in other threads that things are "passed on to head office" to deal with. Maybe an Admin could be kind enough to do the same for me, and ask if this improvement to your software and security can be implemented?

Thanks very much for your time everyone.

To add the setting in the ACP for the Admin would take a long time as the program has to be made from scratch as there is no setting in there already the settings are server side.

As i have said already I Don't think this will be added as 25 letters is more then we need.
I am sorry you can't use your password as you wish but this is one member in 1000's if not more we can't always have what we want in life and to add more letters to the system would only make things more slow and we would need bigger servers to hold this data and we are a free site that only has limited money.

as you may know most Forum hosts are all finding times hard right now and money is short.

We do understand you want longer passwords but trust me when i say 25 is a bigger number then some forums and sites (When FREE)

APE wrote:To add the setting in the ACP for the Admin would take a long time as the program has to be made from scratch as there is no setting in there already the settings are server side.

Ahh, I see. I'd thought it would have just been a simple ACP task.

APE wrote:As i have said already I Don't think this will be added as 25 letters is more then we need.
I am sorry you can't use your password as you wish but this is one member in 1000's if not more we can't always have what we want in life and to add more letters to the system would only make things more slow and we would need bigger servers to hold this data and we are a free site that only has limited money.

I can understand more the reasonings for it, now you've explained them to me, so no worries.

APE wrote:as you may know most Forum hosts are all finding times hard right now and money is short.

We do understand you want longer passwords but trust me when i say 25 is a bigger number then some forums and sites (When FREE)

Well I'll be contributing my bit shortly. It'll likely be a few weeks yet til I'm ready to get up and running, but once I'm ready to open my doors to the public, I'll be paying to get rid of the ads.

Thanks for your time mate.

I'm Glad i was of some help now is there anything else you need before i close this thread ?

if no Please mark this as solved by clicking on the solver button at the top of this thread.

Much thanks.

APE