Passwords longer than 128 characters should be rejectedPasswords longer than 128 characters should be rejectedhttps://liferay.dev/c/message_boards/find_thread?p_l_id=119785294&threadId=1223365952026-05-13T06:56:52Z2026-05-13T06:56:52ZRE: RE: Passwords longer than 128 characters should be rejectedVáclav Suchánekhttps://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=1223593492024-01-26T10:43:22Z2024-01-26T10:43:21Z<p>Thank you, Zsigmond.</p>Václav Suchánek2024-01-26T10:43:21ZRE: RE: Passwords longer than 128 characters should be rejectedZsigmond Rabhttps://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=1223541432024-01-23T10:38:58Z2024-01-23T10:38:57Z<p>Hi Václav,</p>
<p>Watch <a href="https://liferay.atlassian.net/browse/LPD-15194">https://liferay.atlassian.net/browse/LPD-15194</a>.</p>
<p>Regards,<br> Zsigmond</p>Zsigmond Rab2024-01-23T10:38:57ZRE: RE: Passwords longer than 128 characters should be rejectedVáclav Suchánekhttps://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=1223461082024-01-18T11:02:55Z2024-01-18T11:02:55Z<p>Hello Zsigmond,</p>
<p>Yes, you are right. For sure we can limit the length of the password
with regex (portal properties). But what if we don't want to use a
regex because of the following issue:<br>
<a href="https://liferay.atlassian.net/browse/LPS-152747">https://liferay.atlassian.net/browse/LPS-152747</a>
<br> In the end, we have to establish a very complex regex pattern
that follows all our password policies.</p>
<p>Regards,<br> Václav</p>Václav Suchánek2024-01-18T11:02:55ZRE: Passwords longer than 128 characters should be rejectedZsigmond Rabhttps://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=1223415242024-01-16T08:17:58Z2024-01-16T08:17:57Z<p>Hi Václav,</p>
<p>I believe this can be done with password policies. There you can set
a Minimum Length and you can even define a Regular Expression to
validate the passwords.</p>
<p>Regards,<br> Zsigmond</p>Zsigmond Rab2024-01-16T08:17:57ZPasswords longer than 128 characters should be rejectedVáclav Suchánekhttps://liferay.dev/c/message_boards/find_message?p_l_id=119785294&messageId=1223365942024-01-12T08:22:11Z2024-01-12T08:22:09Z<p>See ASVS v4.0.3, section 2.1.2:</p>
<p>Verify that passwords of at least 64 characters are permitted, and
that passwords of more than 128 characters are denied.</p>Václav Suchánek2024-01-12T08:22:09Z