Account passphrases longer than 16 chars don't seem to be permitted. Is there any particular reason for this? You surely don't use a VARCHAR(16) field for cleartext passwords, do you?

Hell, no. VARCHAR isn't case sensitive so we store it in cleartext using a binary field.

Kidding. I'll look into widening the lengths for you tinfoil hat types.

-Chris

You can make VARCHAR case-sensitive by selecting a case-sensitive collation. At least in MySQL.

I wouldn't consider myself a tinfoil hat type, it's just that

hey-man-see-if-u-can-crack-this-password!

is so much easier to remember than

jV3d4zS3Hc

while both are probably about as strong as one another.

/me adds hybinet's linode to his botnet

Could you put a note on the registration/update password page saying what the password requirements are?

When I registered I tried a password with whitespace, the form didn't like it much.

Passwords can't contain whitespace, because that's what it means to be a password. Passphrases can contain whitespace

Given that passwords can contain non-alpha characters, that's a very weak argument... or is "*&%&^" a word in your language?

_________________
Rgds
Stephen
(Linux user since kernel version 0.11)

Example:

My inbox is filled with too much *&%&^ spam!