Password length on webGUI

[nmt1900]

I suspect, that security issues brought up in this article might be already discussed here, but one other question remains - is it true, that password length is really limited to only 16 characters (and does this also apply to Merlin firmware)?

Time to Harden Your Hardware? - Krebs on Security

 

[L&LD]

I think that is the length of most routers (I just counted the characters and yes: 16), including RMerlin's.

I have always chosen maximum length passwords but never bothered to count the characters before. In most password tests, the results are 'strong' to 'very strong'.


And there are at least a couple of threads with this topic.

 

[CaptainSTX]

Based on my experience you are correct in that you are limited to 16 characters.

Using the same router and Tomato I can use 20 characters and I'm not sure what the limit is.

Does it make a difference with 16 characters including numbers and special characters (No lower case) the possible combinations are:

267,870,957,353,242,120,517,365,829,040


I'm not concerned that someone will be able to guess my password or at least in my lifetime as the time to brute force attack at 1,000 guesses per second is 85.2 thousand trillion centuries. If you are younger than me throw in some lower case letters and it could take as long as 14.1 million trillion centuries.

 

[L&LD]

CaptainSTΧ,

I'm not going to double check your numbers (I'm not that young!) but you do make a valid point.

That even 16 characters is more than enough (just don't use proper words in your passwords).

I have read that the length of the password is more important than almost any other aspect regarding security. Your 30 digit possible combinations attest to that.

 

[extensi0n]

I only notice when something doesn't take my password due to length. El cheapo routers that are long out of service now, thankfully, is one example. Ironically, my router password, based off of a license plate, (not my own plate) is exactly 16 characters...