Discovered via iDeCo login failure? Why IT engineers are horrified by the '15-character password limit' [Security Explanation]. The unusual instruction to 'truncate to 15 characters' during the iDeCo system update has caused a stir. In an era where hashed password storage is the standard, why did this behavior raise suspicions of 'plaintext storage'?

This topic does not confirm that 'plaintext storage is certain'. However, it is certainly a behavior that makes those knowledgeable about security shudder. 🔐

Why is it scary?

Originally, passwords should be

• plaintext (the raw string)

• decryptable encryption

not, but rather

hashed and stored, which is the current standard.

For example

Password123!

↓

8f3c91d9e7b...

It becomes a one-way value like this.

The characteristics are

• the original password cannot be retrieved

• a single character difference results in a completely different value

that is what it means.

In other words

20 characters ↓ truncated to 15 characters

If you were able to log in just by doing this,

it is suspected that there might be a special implementation, such as 'knowing the original 20 characters' or 'only checking the first 15 characters from the start'.

Possible scenarios

These are the possibilities.

1. Plaintext storage (worst-case scenario) 😱

DB
Password123456789012

↓

The operator changed it to

Password1234567

and changed it to.

That is why they were able to instruct users to 'please use 15 characters'.

This is a highly problematic implementation in the modern era.

2. Reversible encryption

They were storing it encrypted, but

復号可能

because it was,

there is a possibility it was converted to 15 characters during the system update.

It is slightly better than plaintext, but

it is not recommended for authentication purposes.

3. It only looked at the first 15 characters from the start (the most likely theory)

For example,

abcdefghijklmnopqrst

even if you registered,

in reality,

abcdefghijklmno

only the first 15 characters were hashed and stored.

People who entered 20 characters

actually only had 15 characters that mattered.

After the system update

"Please enter up to 15 characters."

It became.

This theory can explain it even if it is hashed.

4. Changing only the front end

Only the browser screen specifications were changed,

while the authentication server uses the old specifications.

There are also cases of compatibility support with old systems.

Why it went viral on X

IT engineers

with just that one phrase,

"Huh?"

is what they think.

Because with hash authentication,

the operators do not know the original password.

Therefore,

the instruction itselfled to the question,

"What is the internal implementation like?"

which led to that doubt.

However, please note

At this moment,

there is no evidence that the iDeCo system was storing passwords in plaintext.

Speculation can easily run wild on social media,

and in reality,

• compatibility with the old system

• old specifications where only 15 characters were valid

• character count limits during migration

can also explain this.

Lessons to be learned from this incident

For corporate and government systems,

• 🛡️ Passwords must be hashed and stored

• 🔑 Use salted hashes

• 🚫 Plaintext storage is prohibited

• 🔄 Carefully design for both compatibility and security during system updates

these basic principles are important.

It is appropriate at this time to view this topic not as an 'incident where plaintext storage was discovered,' but as a 'case where system behavior visible to users caused security concerns.'

Discovered via iDeCo login failure? Why IT engineers are horrified by the "15-character password limit" [Security Explanation]

The unusual instruction to "truncate to 15 characters" during the iDeCo system update has caused a stir. In an era where hashed password storage is standard, why did this behavior raise suspicions of "plaintext storage"? We provide an easy-to-understand deep dive into authentication mechanisms, the challenges inherent in corporate security design, and why this makes engineers shudder. Let's learn the digital literacy necessary for the DX era.

3. 99 "Security Common Occurrences"

1. Forgetting your password and hitting the "Reset" button

2. Entering the old password by mistake and getting an error

3. Forgetting to distinguish between uppercase and lowercase letters

4. Getting annoyed when told "Incorrect password"

5. Trying every possible combination in the end

6. Successfully logging in and wondering, "Wait, what was it again?"

7. Finding it a hassle to install a password management tool

8. Ending up reusing the same password

9. Ignoring the pop-up that says "Please use a complex password"

10. The password hint being no help at all

11. Using your own nickname as a password

12. Thinking that using your birthday is the fastest way

13. Getting furious at the requirement to "include a symbol"

14. Not knowing where the symbols are and just entering a random one

15. The two-factor authentication code not arriving

16. Getting startled by the SMS notification sound

17. The time limit expiring while you are entering the authentication code

18. Authentication app dies after changing devices

19. Don't know where the backup code is

20. Forget that you registered as a 'trusted device'

21. Tend to let the browser save passwords

22. Feel nervous when others use your PC

23. Press 'Show password' to confirm

24. Don't realize Caps Lock is on

25. Don't realize Num Lock is off

26. Realize the keyboard needs cleaning

27. Get confused because specifications differ by site

28. Guess the operator's security awareness on your own

29. Learn the word 'plaintext' for the first time

30. Fail to explain the concept of hashing to a friend

31. An engineer acquaintance mutters 'Ugh...'

32. Think about the struggles of call center staff

33. Feel the limitations of manual-based support

34. The weight of the term 'system modification'

35. Cry over compatibility with old systems

36. Overlook the notification email about specification changes

37. Judge by the email subject line alone and delete it

38. Why do important emails end up in the spam folder for some reason?

39. Just logging in makes me tired

40. Forgetting the ID in the first place

41. Not noticing a typo in the email address

42. The registration confirmation email never arrives

43. There are too many input fields on the contact form

44. I can't select the 'traffic lights' in the CAPTCHA image

45. I worry too much about which parts are the bus

46. Being suspected of 'not being a robot'

47. Seeing a login history from a location I don't recognize

48. Being startled by a security notification email

49. Changing the password in a panic

50. Immediately forgetting that new password

51. Ending up writing it down in a notepad

52. Losing that notepad

53. The contradiction that a physical note is the safest

54. Hearing that an 'app' is better than 'SMS' for two-factor authentication

55. Installing an authentication app

56. Forgetting the password for that app

57. Forgetting the answers to security questions

58. Tend to choose something random like 'pet's name'

59. Forget the answer and get stuck

60. End up calling support

61. Similar exchanges continue

62. Get put on hold with 'I'll transfer you to the person in charge'

63. The hold music is long

64. The line cuts off the moment you get connected

65. The feeling of despair when you have to call back again

66. Get impressed when the representative is knowledgeable

67. Get exhausted when the representative just follows the manual

68. Cannot argue when told 'it's a specification'

69. Even if you suggest 'improvements,' they are ignored

70. Hope for the next update

71. Eventually stop using that site

72. Cannot find the unsubscribe button even when you want to quit

73. The terms of service are too long to read

74. Click 'Agree' immediately

75. Find out about a personal information leak on the news

76. Think your own password is at risk

77. Change all your passwords at once

78. Management becomes even more complex

79. Security is a trade-off with convenience

80. Ultimately, you have to compromise somewhere

81. Forgetting the master password for a password management tool

82. Finally relying on "mental memory"

83. The brain bugs out and you can't log in

84. Becoming paranoid from reading too much IT news

85. Reading between the lines of corporate announcements

86. Taking the opinions of experts on social media at face value

87. Actually, you are the biggest security risk yourself

88. Reflecting on reusing passwords

89. Vowing to be careful next time

90. Forgetting it after three days

91. Trial and error every time you log in

92. The habit of including symbols in the password input field

93. Account lockout due to repeated input errors

94. Looking at your smartphone while waiting for the lockout to be lifted

95. Checking to see if the lockout has been lifted

96. Still unable to log in after all

97. The sense of accomplishment when you finally log in

98. Destined to be forgotten again soon

99. The daily little battle of logging in