3 ms·
Well, to be fair, short length limitations are odd in that if the password is put through a KDF, the output is always the same length, so it shouldn’t really ma
by iancarroll 9y ago
Well, to be fair, short length limitations are odd in that if the password is put through a KDF, the output is always the same length, so it shouldn’t really matter how long the user’s password is.
- onion2k 9y agoit shouldn’t really matter how long the user’s password is It doesn't, which is by password rules are usually driven by two factors. The first is an attempt to increase entropy (eg must have a number and a capital letter), and the second is trying to ensure memorability (eg a length limit). Neither of these have anything to do with the database schema. Password rules don't tell you anything about how the password is stored.
- daveFNbuck 9y agoIf the password length limit is about memorability, it's pretty weird that their password guidelines suggest starting with a 57-character passphrase and then doing a bunch of difficult to remember obfuscations.