RE: RE: Passwords longer than 128 characters should be rejected

Václav Suchánek, modified 1 Year ago. Junior Member Posts: 26 Join Date: 8/15/18 Recent Posts

See ASVS v4.0.3, section 2.1.2:

Verify that passwords of at least 64 characters are permitted, and that passwords of more than 128 characters are denied.

thumbnail
Zsigmond Rab, modified 1 Year ago. Liferay Master Posts: 764 Join Date: 1/5/10 Recent Posts

Hi Václav,

I believe this can be done with password policies. There you can set a Minimum Length and you can even define a Regular Expression to validate the passwords.

Regards,
Zsigmond

Václav Suchánek, modified 1 Year ago. Junior Member Posts: 26 Join Date: 8/15/18 Recent Posts

Hello Zsigmond,

Yes, you are right. For sure we can limit the length of the password with regex (portal properties). But what if we don't want to use a regex because of the following issue:
https://liferay.atlassian.net/browse/LPS-152747
In the end, we have to establish a very complex regex pattern that follows all our password policies.

Regards,
Václav

thumbnail
Zsigmond Rab, modified 1 Year ago. Liferay Master Posts: 764 Join Date: 1/5/10 Recent Posts

Hi Václav,

Watch https://liferay.atlassian.net/browse/LPD-15194.

Regards,
Zsigmond

Václav Suchánek, modified 1 Year ago. Junior Member Posts: 26 Join Date: 8/15/18 Recent Posts

Thank you, Zsigmond.