3 ms·
Well a lack of rules (but a list of recommendations, perhaps) would be a solution there, not a maximum of 8 characters. Maximum password lengths just screams ou
by TallGuyShort 9y ago
Well a lack of rules (but a list of recommendations, perhaps) would be a solution there, not a maximum of 8 characters. Maximum password lengths just screams out to me that they're not hashing and just storing passwords directly in a database with a fixed-size column for passwords.
- Klathmon 9y agoOh I absolutely 100% agree, I just wanted to point out that sometimes a lot of these seemingly crazy reasons come from somewhere, and that as developers that might work with product managers like this, it's our job to help teach them. But maximum lengths (that aren't measured in kb) are a monumentally stupid thing, as are most other password "rules" (No, disallowing words in your password is not a good idea...) Provide a minimum length, and check passwords against common password lists, and use a damn good hashing algorithm with a process in place to easily allow upgrading that hash.