I need to create a password longer than 20 characters

[tkandell]

PayPal does not accept passwords longer than 20 characters.

THIS IS NOT LONG ENOUGH.

I have already had "long" passwords with a combination of letters, numbers and other characters in my Yahoo Mail hacked and many others have had that happen too with other webmail services. I don't care that much about the strength of my passwords on many websites, but PayPal has complete access to my entire bank account and credit card and this one password needs to be a strong as possible. 

The best way to have people put in long passwords is to have them enter an entire sentence or two, since that's much easier to remember than a random "word" of 8-20 characters which usually won't include numbers or punctuation.

This is exactly why many people have difficulty in remembering their passwords, because they are too short to be easily  verbally remembered and recited.

Computing power is getting so cheap that very shortly passwords of 8-20 characters are going to be routinely cracked.

When this happens to PayPal, PayPal is going to basically have to be shut down, at least until all transactions during that time are verified and everyone applies for new credit card numbers from their banks. Mark my words, you heard it hear first. There is a chance to prevent this from happening.

Please fix this ASAP.

[tkandell]

Why has this not been fixed yet?

I want an answer. I don't care about Facebook or anything else. They are not linked to my bank account. PayPal is, and that's the one password I *need* to be as secure as possible!

[balazer]

Umm... A password 20 characters in length is more than long enough. If you choose something that is sufficiently random, no one is going to be able to guess it or "crack" it.

If you've had accounts with long passwords compromised before, it's because someone stole your password, not because someone guessed it. Perhaps you were the victim of a phishing scam and you entered your password into a bogus web site. Perhaps you logged into your account on a PC that had spyware running on it. Perhaps your password was saved in an insecure place, like in a compromised PC or e-mail account.

Here are some simple security practices that will greatly decrease your chances of someone gaining unauthorized access to an account:

* Use a different password for PayPal than you use for any of your other web site logins.

* Choose a password that is sufficiently hard to guess (random looking and not too short).

* Make sure your PC has up-to-date antivirus software. It wouldn't hurt to also scan it with Spybot Search & Destroy and AdAware Free.

* Use Gmail as your e-mail provider and turn on 2-step verification for your Google account.

* Never click on a link in an e-mail message to paypal.com or to any other financial institution. Instead, type paypal.com into your browser's location bar, or use your browser's bookmarks.

* Make sure that your accounts have accurate recovery e-mail addresses and security questions, so that in the event you lose access to your account, you will be able to get it back. 

If you're feeling extra paranoid and you want extra security for your financial accounts, do some or all of the following:

* Make sure you never log into paypal.com using any PC except your own.

* Sign up for PayPal's Security Key.

[albion01]

If Paypal were using a salted hash then there would be no length requirement because the entry in the database is always the same length.  A typical sign that a web site is storing your password as plane text in their database is a password length requirement.  Kinda scary considering ...

-Craig