3 ms·
Cost of calculating 10k character hash? IMO above 30 length serves no practical purpose.
by blackoil 7y ago
Cost of calculating 10k character hash? IMO above 30 length serves no practical purpose.
- pvorb 7y agoOther than not annoying users by not allowing their 31 character passphrase.
- OskarS 7y agoIf that were the case, would the limits be so small? I mean, it's usually like "less than 16 characters" or something. The extra CPU time to raise that limit to, like, 128 or something would be totally insignificant (especially if they're using a key-derivation function after the hash, as they should be).
- kortilla 7y ago>Cost of calculating 10k character hash? Irrelevant compared to the rest of the operations done on the server.
- meuk 7y agoTo put this in perspective: The cost of calculating a 10k character hash is negligible compared to serving a modestly sized image. Still, you have a point that allowing arbitrary sized passwords to denial-of-service attacks. Still, a more reasonable limit would be 100 or 256, for example.
- thiagomgd 7y agoand no way is 12 a good limit