Password Length

[6233638]

Passwords are limited to 50 characters.
There is no mention of this anywhere on the password change form.

I use a password generator, which created a 64-character password.
The site let me change my password without any errors, but I was left unable to log in with the new password, since it had been truncated.

I just got lucky guessing that this is what had gone wrong, and that trying 50 characters of the new password worked.

[LoRd_MuldeR]

A password longer than 50 characters is exaggerating ;)

If we assume you use 64 different characters, this makes 6 bit per character. So, even if you use "only" 50 characters, you get a 300 bit password! Assuming your password was generated with a sufficiently good PRNG, this is way more than what you need to be safe - even if somebody was brute forcing your password at high rate. But, considering that the forum software only allows a limited number of login attempts until you get blocked, it is just crazy.

Anyway, I assume that the password truncation problem is actually a HTML issue. If the max length for a HTML input box is set to 50, the browser simply doesn't let you enter more characters. And if you paste a string longer than the limit, the browser silently truncates the string to fit in. I don't know if there is any method for the forum software to detect this case. And even if there is such a method, it would have to be implemented by the vBulletin developers...

[6233638]

I'm not saying it's a reasonable number, that's just what the password manager generated.
Most sites either return an error, or at least tell you the max length supported. Some kind of message would suffice.

[LoRd_MuldeR]

Most sites either return an error, or at least tell you the max length supported. Some kind of message would suffice.

As pointed out above, the browser silently truncates the input, if you paste a text into the edit box that is longer than the max. allowed length.

One solution that I can think of would be: Make the edit box accept much longer inputs (on the HTML level) than what is actually supported. Then perform a manual length verification, either in JavaScript or on the server side. This way the forum software could detect the case when the password is too long and generate a proper error message. Still, I think this would be a feature request for the vBulletin team...