{"action":"created","issue":{"url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/3720","labels_url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/3720/labels{/name}","comments_url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/3720/comments","events_url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/3720/events","html_url":"https://github.com/bcit-ci/CodeIgniter/issues/3720","id":65410823,"number":3720,"title":"[security] Password handling: Limit maximum allowed password length","user":{"login":"timoh6","id":851306,"avatar_url":"https://avatars.githubusercontent.com/u/851306?v=3","gravatar_id":"","url":"https://api.github.com/users/timoh6","html_url":"https://github.com/timoh6","followers_url":"https://api.github.com/users/timoh6/followers","following_url":"https://api.github.com/users/timoh6/following{/other_user}","gists_url":"https://api.github.com/users/timoh6/gists{/gist_id}","starred_url":"https://api.github.com/users/timoh6/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timoh6/subscriptions","organizations_url":"https://api.github.com/users/timoh6/orgs","repos_url":"https://api.github.com/users/timoh6/repos","events_url":"https://api.github.com/users/timoh6/events{/privacy}","received_events_url":"https://api.github.com/users/timoh6/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-03-31T09:46:19Z","updated_at":"2015-03-31T13:20:09Z","closed_at":"2015-03-31T13:18:35Z","body":"Reading http://www.codeigniter.com/userguide3/general/security.html#password-handling I noticed there is a recommendation:\r\n\r\n> DO NOT put artificial limits on your users’ passwords.\r\n> \r\n> There’s no point in forcing a rule that a password can only be up to a number of characters, or that it can’t contain a certain set of special characters.\r\n> \r\n> Not only does this reduce security instead of improving it, but there’s literally no reason to do it. No technical limitations and no (practical) storage constraints apply once you’ve hashed them, none!\r\n\r\nThis is actually not correct \"as is\" (from a security point of view), as overlong user inputs may cause different kinds of problems to the system.\r\n\r\nWith CI, it is actually a security problem at least if PBKDF2 is used (from the compatibility layer), as long passwords will cause the PBKDF2 implementation to choke on calculating the inner HMAC (i.e. if the password is, say, 100000 bytes long). As an example, hash_pbkdf2() with a million byte password, SHA-256 and 20 000 iterations from the compatibility layer takes ~130 seconds.\r\n\r\nThis could be fixed (with regards to PBKDF2) by pre-hashing the password when it has greater length than the underlying hash algoritm's block size, but this approach feels a bit hacky to say the least, as CI supports PBKDF2 with many different hash algorithms (you would need to determine the underlying block size for every hash algorithm).\r\n\r\nThat being said, I recommend you set a password length limit. It could be something \"huge\", like 1024 bytes etc. to make sure it won't affect (at least in a meaningful way) real passwords used with PBKDF2, and at the same time it mitigates the DOS possibility."},"comment":{"url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/comments/88081422","html_url":"https://github.com/bcit-ci/CodeIgniter/issues/3720#issuecomment-88081422","issue_url":"https://api.github.com/repos/bcit-ci/CodeIgniter/issues/3720","id":88081422,"user":{"login":"narfbg","id":1058011,"avatar_url":"https://avatars.githubusercontent.com/u/1058011?v=3","gravatar_id":"","url":"https://api.github.com/users/narfbg","html_url":"https://github.com/narfbg","followers_url":"https://api.github.com/users/narfbg/followers","following_url":"https://api.github.com/users/narfbg/following{/other_user}","gists_url":"https://api.github.com/users/narfbg/gists{/gist_id}","starred_url":"https://api.github.com/users/narfbg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/narfbg/subscriptions","organizations_url":"https://api.github.com/users/narfbg/orgs","repos_url":"https://api.github.com/users/narfbg/repos","events_url":"https://api.github.com/users/narfbg/events{/privacy}","received_events_url":"https://api.github.com/users/narfbg/received_events","type":"User","site_admin":false},"created_at":"2015-03-31T13:20:09Z","updated_at":"2015-03-31T13:20:09Z","body":"Oh, and thanks for noting this ... we hardly get any meaningful feedback on security features."}}