2 ms·
It generally means they're not handling it in a secure way. Worst case scenario is that if the checks you see client side aren't also server side someone might
by mjevans 8y ago
It generally means they're not handling it in a secure way. Worst case scenario is that if the checks you see client side aren't also server side someone might be able to inject things that run as... whatever the server side processes are.
Usually anyplace that has a limit less than 512 characters (often 1024, but some string buffers are small) or on the characters you can use, at all, isn't doing it right.
- jiveturkey 8y agoIt generally means that yes. But sometimes it also has to do with CSR calls. eg, by not allowing spaces in passwords, you eliminate an entire class of PEBKAC errors. I don't for a second believe that's why my.equifax.com is doing it. It's certainly not why there's a 20 character limit. (I personally use 64 char passwords wherever such long ones are allowed.)