3 ms·
Whenever I see this maximum password length nonsense, I realize that whoever is in charge of security at this company apparently doesn't know or care about pass
by jordanpg 11y ago
Whenever I see this maximum password length nonsense, I realize that whoever is in charge of security at this company apparently doesn't know or care about password managers. And that speaks volumes to me.
- pwg 11y agoIt is also a 'code smell' that suggests that the relevant company is storing passwords in plaintext. Reason: If they were hashing the password, the hash output would be fixed length, independent of the input length, so there would be no need for an external, user visible, maximum length restrictions.
- mkobit 11y agoThat's an interesting and plausible take on it. Why do you think new companies still go the route of not allowing special characters (like <>;"()' and the other SQL injection types)? I would think that new companies would know better by now, but I guess not?