3 ms·
The argument I once heard for restricting length of a password (and possibly special characters) is that it would be harder to craft a buffer overflow (or SQL i
by derwiki 17y ago
The argument I once heard for restricting length of a password (and possibly special characters) is that it would be harder to craft a buffer overflow (or SQL injection attack) with those limitations. I don't agree that this is a good solution, but it's not always good programmers/managers who are making these decisions. It at least sounds plausible.
- tptacek 17y agoThat's a really bad argument. If password length is threatening to you, you have no business accepting passwords. (Length also has almost nothing to do with SQL Injection, and you're plugging a raw password into an SQL query you're doing something very wrong anyways).
- jfarmer 17y agoHmm? The hash will be a fixed length, which is the only thing you'd be storing.
- branden 17y agoIn order to get that hash you'd have to process the password in its entirety. But really, if they're that concerned about the buffer I see no reason to cap it at 8 or 10 rather than 1000.
- jfarmer 17y agoEh. That seems unlikely, assuming you're not writing your own routines. At most you'd get an out of memory error. I can calculate the SHA1 digest of a 1Bn character string without running into that problem. So let's cap the length at 100k characters and call it a day.