Auth: Passwords > 72 bytes lead to wrong error message and inability to log in

[strugee]

1. What is not working as documented?

See description.

2. How can we reproduce it?

1. Run docker-compose exec photoprism photoprism passwd admin
2. Input b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b3b as the password (ditto for the "retype password" prompt)
3. See the log in section 5 of this issue
4. Try logging in with the password in the browser - notice how you get an "Invalid credentials" error

3. What behavior do you expect?

The password is set properly and I can log in using it.

4. What could be the cause of your problem?

I don't really see anything relevant in the troubleshooting guide - I checked the "cannot log in" section, but this issue originally cropped up when I upgraded, not when I manually changed the admin password. Note though that I was upgrading from a really old release; I think it was from around last November but I'm really not sure.

5. Can you provide us with example files for testing, error logs, or screenshots?

Here's the output to console:

root@230615:/photoprism$ photoprism passwd admin # I ran this inside the container
DEBU[2023-06-16T18:05:50Z] config: overriding config with values from /photoprism/storage/config/options.yml
DEBU[2023-06-16T18:05:50Z] settings: loaded from /photoprism/storage/config/settings.yml
DEBU[2023-06-16T18:05:50Z] config: running on 'Intel(R) Pentium(R) CPU 1403 v2 @ 2.60GHz', 34 GB memory detected
DEBU[2023-06-16T18:05:50Z] config: successfully initialized [77.944076ms]
INFO[2023-06-16T18:05:50Z] migrate: running database migrations
DEBU[2023-06-16T18:05:50Z] migrate: 20221015-100000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20221015-100100 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20211121-094727 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20211124-120008 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-030000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-040000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-050000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-060000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-061000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-070000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-071000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-080000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-081000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-083000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-090000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-091000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220329-093000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220421-200000 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220521-000001 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220521-000002 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220521-000003 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20220927-000100 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20221002-000100 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20230102-000001 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20230211-000001 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20230309-000001 skipped
DEBU[2023-06-16T18:05:50Z] migrate: 20230313-000001 skipped
DEBU[2023-06-16T18:05:51Z] migrate: completed in 1.267721165s
WARN[2023-06-16T18:05:51Z] config: password required to initialize 'admin' account
INFO[2023-06-16T18:05:51Z] please enter a new password for admin (minimum 8 characters)
New Password:
Retype Password:
ERRO[2023-06-16T18:06:27Z] auth: password is too short
INFO[2023-06-16T18:06:27Z] password for admin successfully changed
DEBU[2023-06-16T18:06:27Z] closed database connection

6. Which software versions do you use?

(a) PhotoPrism Architecture & Build Number: photoprism version 230615-90a18f6e7-Linux-AMD64-Plus

(b) Database Type & Version: MariaDB 10.5.19-0+deb11u2 (installed from Debian on the host)

(c) Operating System Types & Versions: Linux (Debian 11) running in a LXD container

(d) Browser Types & Versions: N/A

(e) Ad Blockers, Browser Plugins, and/or Firewall Software? No

7. On what kind of device is PhotoPrism installed?

N/A

8. Do you use a Reverse Proxy, Firewall, VPN, or CDN?

N/A

[lastzero]

Bcrypt works as designed and documented. For a detained discussion, internals and explanations, see for example:

• https://pkg.go.dev/golang.org/x/crypto/bcrypt
• https://stackoverflow.com/questions/16594613/how-to-hash-long-passwords-72-characters-with-blowfish
• https://en.m.wikipedia.org/wiki/Bcrypt

We could truncate longer passwords, but IMHO that does more harm than good.

Edit: Sorry, I'm on my phone (small screen, hard to read) and thought the issue is that you want to use a longer password. But the actual problem seems to be a wrong error message, so too short instead of too long?

[strugee]

Edit: Sorry, I'm on my phone (small screen, hard to read)

No worries at all. And yeah, when I saw 72 characters I figured it was bcrypt rearing its well-designed head 😛

But the actual problem seems to be a wrong error message, so too short instead of too long?

This is part of the problem, but not all of it. I'd be interested to hear your logic around not truncating passwords (AFAIK this is what most other apps usually do), but setting that aside, if we don't truncate passwords I would expect this to be a fatal error, with the correct error message. Right now the behavior appears to be that:

1. The error message about the password being too short is printed
2. Something is set to the database anyway (I'm assuming that this is the case because after setting a >=73 character password, the old <=72 char password does not work in the web UI any longer)
3. It becomes impossible to log in to the account

Notice the INFO[2023-06-16T18:06:27Z] password for admin successfully changed line in the issue description. This line is printed immediately after the error about the password being too short.

[lastzero]

But the actual problem seems to be a wrong error message, so too short instead of too long?

This is part of the problem, but not all of it. I'd be interested to hear your logic around not truncating passwords (AFAIK this is what most other apps usually do), but setting that aside, if we don't truncate passwords I would expect this to be a fatal error, with the correct error message. Right now the behavior appears to be that:

First of all, thanks for pointing this out, because there were indeed some problems in the password length check:

• the minimum length must be characters (i.e. runes, not bytes), otherwise a single emoji might suffice (fortunately, most users have ASCII passwords, so this probably wasn't much of an issue in practice - or at least only for users who wouldn't do this for their own safety)
• the password was rejected (set to an empty string) before the maximum length check was performed, so passwords that were too long looked empty
• the maximum length was not checked in all places, so you may have gotten an incorrect error message elsewhere too, e.g. when running the "users add" command

All of this should be fixed with my changes. @strugee I would appreciate it if you could take a look at them and test it as well.

Personally, I don't think truncating passwords is a good practice, as it ultimately means that two different passwords are considered the same if they are the same in the first 72 bytes, which is not very logical. Also, what ultimately matters is the entropy, which can be in the length like aaaaaaabbbbbccccccccccdddd or in a high "randomness" of a shorter string like XJm5aTted% - which, by the way, also is the case with many human languages.

So, if you have reason to believe that it makes no difference which method you use (because there is no error message), you may be choosing insecure passwords. In the worst case, you use different passwords for all applications, but they all start with the same 72 bytes.

Does that make sense to you?

2. Something is set to the database anyway (I'm assuming that this is the case because after setting a >=73 character password, the old <=72 char password does not work in the web UI any longer)
3. It becomes impossible to log in to the account

Of course, this should also be fixed. It happened because the photoprism passwd command is very low-level and therefore bypasses other checks. Since empty passwords are not allowed, you could no longer log in (unless you would have set a password with a valid length, as mentioned in the UI as well as by the photoprism help command, though not yet in all other parts of our documentation).

For this reason I have also improved the information that is displayed when you run the photoprism passwd command:

INFO[2023-06-19T15:04:32Z] please enter a new password for admin (4-72 characters) 
New Password: 

The only thing I can think of now is someone insisting on these 72 characters, which are really bytes. So with emojis, it's much less. However, I don't think we should confuse users with usage information like (minimum 4 runes, maximum 72 bytes), right? :D

[lastzero]

An updated development preview image is now available for testing:
https://docs.photoprism.app/release-notes/#development-preview