<p>But it was the second part of the error message that got him thinking. "If you've been using a password that has more than 16 characters, enter the first 16." For Riau, that meant that the last 20 characters of the strong password he used to set up and successfully use the account in the past was no longer, or had never been, used. For the first option, it would mean that Microsoft has been storing the passwords in plaintext. Only then could it discard the latter part and still function with the original first 16. But, "Storing plaintext passwords for online services is a definite no-no in security," he said.</p><p>For the second option, it would mean that Microsoft had always truncated passwords of whatever additional length to the first 16, and had generated and stored a hash of the first 16 characters only. "To be honest," said Raiu, "I'm not sure which one is worse." Well, the first the is worse; but the reality that Hotmail uses passwords of a maximum 16 characters surprises and dismays many security experts.</p><p>Graham Cluley of Sophos has compared the three primary webmail providers: Microsoft, Yahoo and Google. Hotmail allows 16 characters; Yahoo allows 32 characters; Gmail allows 200 characters. Generally, said Cluley, "longer is better."</p><p>Microsoft has now provided two comments on the issue. The first is online in its 'Microsoft account Help &amp; How-to': "Actually, Windows Live ID passwords were always limited to 16 charactersany additional password characters were ignored by the sign-in process. When we changed "Windows Live ID" to "Microsoft account," we also updated the sign-in page to let you know that only the first 16 characters of your password are necessary."</p><p><a href="http://www.infosecurity-magazine.com/view/28394/what-is-microsoft-doing-with-hotmail-passwords">Keep reading...</a></p>