Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I password protected a directory in cPanel. When I went to access the page in my browser, I accidentally hit backspace on the password before I hit enter. Surprisingly, the page still loaded. I played around with it and realized that I could remove the last 4 or 5 characters and the password would still work. Any more than that and it would fail. I'm just curious why this behavior is happening and whether or not it's anything to worry about?

share|improve this question

migrated from stackoverflow.com Mar 29 '12 at 12:30

This question came from our site for professional and enthusiast programmers.

    
Are there any messages in your server logs about this? –  sarnold Mar 28 '12 at 0:08

2 Answers 2

up vote 2 down vote accepted

Try to use just the first eight chars. It may be truncating and removing the rest. "The traditional implementation uses a modified form of the DES algorithm. The user's password is truncated to eight characters, and those are coerced down to only 7-bits each; this forms the 56-bit DES key." - source http://en.wikipedia.org/wiki/Crypt_(Unix)

share|improve this answer
    
You're right. 8 characters is the cutoff. I guess if I'm going to use caps or numbers or symbols to make my password more complex, I should include them in the first 8 characters. –  user617123 Mar 28 '12 at 0:37

As user1200129 notes, the traditional Unix crypt(3) algorithm truncates the password to at most 8 characters. The Apache web server also supports an MD5-based hashing algorithm that allows longer passwords and is generally more secure.

Even if cPanel won't let you create MD5-based password hashes, you could do it directly using the htpasswd shell command. If you don't have shell access to your webhost, you may still be able to create or modify the .htpasswd file on your own computer and upload it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.