4 ms·
Yep, people who've run marginally popular sites have dealt with this before. Give someone a text box and watch them try to stuff 4GB of content in it. There has
by cookiecaper 10y ago
Yep, people who've run marginally popular sites have dealt with this before. Give someone a text box and watch them try to stuff 4GB of content in it. There has to be a cutoff somewhere, but as you note, it should be well outside of the realm of reasonable password lengths (hundreds of characters).
- jsjohnst 10y agoGitHub is the only website I can think of off the top of my head that doesn't limit to an arbitrarily small number (aka <100). Do you name any other "major" websites that allow 100 character passwords?
- snowpanda 10y agoAmazon.com allows 128 characters: https://www.amazon.com/gp/help/customer/display.html?nodeId=10412241 https://www.amazon.com/gp/help/customer/display.html?nodeId=...
- amichal 10y agoAnything built with the popular rails gem devise allows 128 by default [1] https://github.com/plataformatec/devise/blob/88724e10adaf9ffd1d8dbfbaadda2b9d40de756a/lib/generators/templates/devise.rb#L157 https://github.com/plataformatec/devise/blob/88724e10adaf9ff...
- XorNot 10y agoHash the password locally (you are serving JavaScript over SSL right?) and only send the SHA256.
- jensvdh 10y agoNever trust the client.
- XorNot 10y agoThis isn't about trusting the client: it's about your endpoint being able to only accept a SHA256 hash sum from the client (thus: length limited) while allowing the user to input arbitrarily long passwords. They hash in the browser: the only way they can mess with it by producing silly outputs, but that only hurts them.
- libeclipse 10y agoI can't think of any security implications of hashing on the client-side. What's your thinking?
- fnordsensei 10y agoDoes salting work if you hash in the browser?
- libeclipse 10y agoWell in this case the hash would be passed to Bcrypt or Scrypt, which have built in salt support, so client side salting wouldn't matter.
- shawnz 10y agoIf the hashes are leaked, you could log in with them.
- XorNot 10y agoWell serverside you store them as plaintext equivalents - i.e. salt+hash the hash. So a leak doesn't leak the user-side.
- zeveb 10y agoThat would lock out anyone who chooses not to execute your JavaScript. Requiring me to trust your code in order for you to decide whether or not to trust me is asking too much.
- 0xfeba 10y agoHow would you know that the hash is of a password of sufficient entropy?