User-password and shared secret limits too low, should be 128. about freeradius-client HOT 2 CLOSED

I've bumped the limits for password to 128, and secrets to 256.

The RFCs are vague and confused about the secret. The reference you quoted could mean almost anything.

Realistically, a secret of more than about 32 bytes is useless. You could use base32 encoding and a 32-character secret to get 2^160 possible secrets. That's something nobody can crack.

The only reason to have a longer secret is to have a worse one. i.e. one which is easier to remember, and is therefore easier to guess.

from freeradius-client.

Thank you. Yes, I see no point in having such a long one either, which is the reason we didn't discover it ourselves in testing.

But customers do weird things, and I think it's an automated system, no human interaction, so remembering it isn't an issue for them.

from freeradius-client.