Long Passwords Could Have Crashed Security Website

News
By published

Django discovered, and quickly patched, a security vulnerability that would have let hackers turn Django's strong password security against it.

Long passwords are great: As a user, the longer your passwords are (while still being memorable and usable), the more secure you are.

But from a developer's perspective, the complications of managing long passwords could be a security vulnerability. 

In a nutshell, the complex password-storage system used by a commercial Web framework called Django is so secure that hackers could use its own security to bring the website down.

MORE: 7 Computer-Security Fixes to Make Right Now

Django's systems are used by Instagram, Pinterest and any website that uses the service Disqus to manage its comments sections.

To encourage users to create secure, long passwords, Django didn't put a limit on password length.

Django also stores its users' passwords in an encrypted form, using a complicated algorithm called PBKDF2 to transform the passwords into what are called "cryptographic hashes."

That means any hackers who managed to break into Django's systems wouldn't be able to see the users' actual passwords; all they'd see are arbitrary-looking strings of characters that cannot be easily converted back into the original password characters.

Every time someone tries to log in to a Django website, Django's system goes through a complicated process of checking that password against all the cryptographic hashes stored on its servers.

This method has the advantage of preventing brute-force attacks, which is when hackers try to log in to a platform by writing a program that methodically tries every possible combination of characters in hopes of eventually finding the right password.

However, a Web developer recently discovered that this complicated security could actually be used against Django. 

A double-edged sword

In the case of a brute-force attack, the attacker is trying to gain access to the system. But the developer found that if the attackers are just trying to mess things up, they could go to Django's login page and repeatedly submit hundreds of extremely long "junk" passwords of thousands of characters or more.

Having to check all these junk passwords against the stored cryptographic hashes puts a heavy strain on Django's system and eventually overtaxes it.

The result is essentially a denial-of-service attack, which is when attackers bombard a server with website hits or other requests that, when combined, eventually bring the server offline.

There haven't been any known attacks that used this method. Nevertheless, Django has since patched this vulnerability by setting a limit on password length: 4096 bytes, or around 4,096 of the characters found on a keyboard. The updated version is available on Django's website. So what's the takeaway? Users should keep using long passwords. Developers, however, should be aware that strong password security could become a double-edged sword.

Email jscharr@techmedianetwork.com or follow her @JillScharr. Follow us @TomsGuide, on Facebook and on Google+.

TOPICS
Jill Scharr

Jill Scharr is a creative writer and narrative designer in the videogame industry. She's currently Project Lead Writer at the games studio Harebrained Schemes, and has also worked at Bungie. Prior to that she worked as a Staff Writer for Tom's Guide, covering video games, online security, 3D printing and tech innovation among many subjects. 

6 Comments Comment from the forums
  • Murissokah
    Unlimited size for user-entered data... seems like a pretty basic mess-up.
    Reply
  • anti-painkilla
    I cannot understand why someone would even need a 4000 character password for these websites let alone a 100 character. I would bet that the majority of the passwords are the minimum length allowed.
    Reply
  • palladin9479
    "Long passwords are great: As a user, the longer your passwords are (while still being memorable and usable), the more secure you are."

    This is very false. Longer passwords only protect against brute force attacks but not social engineering. If anything they make the user more prone to side-band attacks as humans can't easily remember such long *random* passwords and expect to change them every 90 days. Instead they write them down or store them in a text file on their desktop. That in turn makes them vulnerable to social engineering or other non-brute force attacks that focus on revealing the password or hints at the password instead of trying all random values until you hit on a match.
    Reply
  • digiex
    Hmm, what is may Facebook password now?
    Reply
  • jtd871
    I would imagine that long passwords stored as a cryptographic hash would also be vulnerable to a birthday attack.
    Reply
  • leo2kp
    This has been an issue for web security for quite a while. Not sure why they didn't start out with a password length limit. Nub mistake.
    Reply