3

I'm using the Oracle Verify Function 12c - the max password length seem to be < 30 charcters. Can I change that?

  • Slightly off-topic, but maybe helpful: There was an interesting discussion here that discusses at what point is a password length too long... 22 characters seems to be the limit (for the forseeable future) before the account isn't any more secure with a longer password... but probably less is even ok with PASSWORD_LOCK_TIME set for the profile since password length is primarily used to stop brute force attacks: security.stackexchange.com/questions/46666/… – Kris Johnston Sep 22 '16 at 13:10
8

Quote from the manual

Passwords can be at most 30 bytes long

(Emphasis mine)

So the answer to the question "Can I change that" is: no

3

From the 12c Oracle Database SQL Language Reference, CREATE USER (http://docs.oracle.com/database/121/SQLRF/statements_8003.htm#SQLRF01503)

Passwords must follow the rules described in the section "Database Object Naming Rules", And from that reference:

"Passwords must follow the rules described in the section "Database Object Naming Rules", "

"The following list of rules applies to both quoted and nonquoted identifiers unless otherwise indicated:

Names must be from 1 to 30 bytes long with these exceptions:"

And just to clarify - length limits on object names are hard-coded into the oracle binaries, so no you cannot make them longer.

As an aside, even having worked in a high-security enviornment, I can't imagine needing a password longer that 30 characters. If your password is sufficiently complex there quickly comes a point of diminishing returns on additional security gained by increasing the length of the password. I'd think a sufficiently complex password of 30 characters would require a quantum computer to crack in any reasonable amount of time.

  • 1
    the purpose of longer password lengths is more to support "human readable passwords". xkcd.com/936 ("Correct Horse Battery Staple" is already 28 long) Supporting this is now a NIST recommendation BTW. itispivotal.com/post/… – nemo Feb 6 '18 at 16:55
  • FYI using its standard dictionary there is less than a 0.000223% chance that a 10 word diceware password will go over 55 characters, add in 9 spaces and you get 64 chars with almost 129.25 bits of memorizable entropy. – Gregor y Jul 23 '18 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.