2

I password protected a directory in cPanel. When I went to access the page in my browser, I accidentally hit backspace on the password before I hit enter. Surprisingly, the page still loaded. I played around with it and realized that I could remove the last 4 or 5 characters and the password would still work. Any more than that and it would fail. I'm just curious why this behavior is happening and whether or not it's anything to worry about?

1
  • Are there any messages in your server logs about this? – sarnold Mar 28 '12 at 0:08
3

Try to use just the first eight chars. It may be truncating and removing the rest. "The traditional implementation uses a modified form of the DES algorithm. The user's password is truncated to eight characters, and those are coerced down to only 7-bits each; this forms the 56-bit DES key." - source http://en.wikipedia.org/wiki/Crypt_(Unix)

1
  • You're right. 8 characters is the cutoff. I guess if I'm going to use caps or numbers or symbols to make my password more complex, I should include them in the first 8 characters. – user617123 Mar 28 '12 at 0:37
1

As user1200129 notes, the traditional Unix crypt(3) algorithm truncates the password to at most 8 characters. The Apache web server also supports an MD5-based hashing algorithm that allows longer passwords and is generally more secure.

Even if cPanel won't let you create MD5-based password hashes, you could do it directly using the htpasswd shell command. If you don't have shell access to your webhost, you may still be able to create or modify the .htpasswd file on your own computer and upload it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy