Full password not required to access password protected directory?

Question

I password protected a directory in cPanel. When I went to access the page in my browser, I accidentally hit backspace on the password before I hit enter. Surprisingly, the page still loaded. I played around with it and realized that I could remove the last 4 or 5 characters and the password would still work. Any more than that and it would fail. I'm just curious why this behavior is happening and whether or not it's anything to worry about?

Answer 1

Try to use just the first eight chars. It may be truncating and removing the rest. "The traditional implementation uses a modified form of the DES algorithm. The user's password is truncated to eight characters, and those are coerced down to only 7-bits each; this forms the 56-bit DES key." - source http://en.wikipedia.org/wiki/Crypt_(Unix)

Answer 2

As user1200129 notes, the traditional Unix crypt(3) algorithm truncates the password to at most 8 characters. The Apache web server also supports an MD5-based hashing algorithm that allows longer passwords and is generally more secure.

Even if cPanel won't let you create MD5-based password hashes, you could do it directly using the htpasswd shell command. If you don't have shell access to your webhost, you may still be able to create or modify the .htpasswd file on your own computer and upload it.