4 ms·
> You're hashing them anyway right? So the storage doesn't change No, but the time spent computing the hash does change and you open yourself to denial of serv
by tokenizerrr 10y ago
> You're hashing them anyway right? So the storage doesn't change
No, but the time spent computing the hash does change and you open yourself to denial of service attacks. Just pick a max password length of like 200, or whatever your hashing algorithm mandates (55 for bcrypt).