What control panels allow arbitrary passwords and why does Plesk allow only short ones?

Question

Hosting provider M6.net explained me that the password security of its control panel (Plesk) is limited to a maximum of 14 characters. This article on Parallels explaining backs him up. However, he claims that this restriction applies to any password set through Plesk, including DB passwords. Is this correct?

In a world of ever increasing online threads, I tend to simply back away, not trusting the system that doesn't allow or enforce strong passwords. I find it very odd that a reputable company like Parallels limit security this way.

Should I change my vision? More importantly, what control panels, if any (cpanel?) allow arbitrary length passwords without restrictions on the characters?

(Note: this is a bit of a follow up to this more general question)

Answer 1

Plesk has taken the wrong path by limiting the length of the passwords and not making this either configurable or substantially longer. It's odd that even the system user or administrator cannot have a stronger or longer password.

While it can be argued that 14 characters is long enough, it doesn't allow for (semi) arbitrary length passwords, or easy to remember but lengthy and strong passwords.

A control panel system that takes this to another extreme, cPanel, aids the user in choosing a strong-enough password and makes its presets configurable on a scale from 0 - 100 (100 being extremely strong). This helps both the user (who gets information about strength) and the administrator (who can limit access to users that have sufficiently strong passwords, or allow very weak passwords, depending on application domain). More info here.

Other control panels have either other restrictions, or no restrictions at all, or make it configurable just like cPanel.

Answer 2

This likely comes down to the usefulness of said longer passwords. It may be that the password hashing algorithm is only based on the first 14 digits of the string entered, or that it can cause hash collisions if more than 14 characters are present.

It is a current well-known standard that passwords 12 characters in length are essentially unable to be brute forced, especially if they use a mixture of numbers, letters and symbols. Anything beyond that length and you're just making your life more difficult.