4 ms·
33 characters (and I often see less) is a far cry from a gigabyte. I think it's clear I was talking about unreasonably low limits.
by justinlardinois 10y ago
33 characters (and I often see less) is a far cry from a gigabyte. I think it's clear I was talking about unreasonably low limits.
- Freak_NL 10y agoExactly, such anti-abuse limits would start at, say, 256 characters. The amount of banks and services that limit their passwords to 20 characters or fewer is startling.
- mrec 10y agoI've seen even worse than that - for low-importance passwords I normally record them in a mail-to-self memo then paste them into the signup form. I recently encountered one site that silently truncated the pasted password.
- justinlardinois 10y agoWhile silent truncation is of course bad because it limits the potential entropy of a password, if implemented consistently it's technically not any worse than a limit that's presented to the user. But just wait until the new hire doesn't know about it and implements a form without it, and then all of the sudden users are entering the same "long" passwords they always have and scratching their heads when it fails.