3 ms·
Without a limit on password length, an attacker can DOS you by forcing you to run your KDF on gigabyte-sized strings.
by desdiv 10y ago
Without a limit on password length, an attacker can DOS you by forcing you to run your KDF on gigabyte-sized strings.
- geocar 10y agoThey're only denying service to themselves if you run the KDF locally.
- paulddraper 10y agoGiga byte sized strings? Oh, no. That doesn't make sense. You need to limit by Giga grapheme strings.