2

I password protected a directory in cPanel. When I went to access the page in my browser, I accidentally hit backspace on the password before I hit enter. Surprisingly, the page still loaded. I played around with it and realized that I could remove the last 4 or 5 characters and the password would still work. Any more than that and it would fail. I'm just curious why this behavior is happening and whether or not it's anything to worry about?

Improve this question
1
  • Are there any messages in your server logs about this?
    – sarnold
    Commented Mar 28, 2012 at 0:08

2 Answers 2

Reset to default
3

Try to use just the first eight chars. It may be truncating and removing the rest. "The traditional implementation uses a modified form of the DES algorithm. The user's password is truncated to eight characters, and those are coerced down to only 7-bits each; this forms the 56-bit DES key." - source http://en.wikipedia.org/wiki/Crypt_(Unix)

Improve this answer
1
  • You're right. 8 characters is the cutoff. I guess if I'm going to use caps or numbers or symbols to make my password more complex, I should include them in the first 8 characters.
    – user617123
    Commented Mar 28, 2012 at 0:37
1

As user1200129 notes, the traditional Unix crypt(3) algorithm truncates the password to at most 8 characters. The Apache web server also supports an MD5-based hashing algorithm that allows longer passwords and is generally more secure.

Even if cPanel won't let you create MD5-based password hashes, you could do it directly using the htpasswd shell command. If you don't have shell access to your webhost, you may still be able to create or modify the .htpasswd file on your own computer and upload it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.