5 ms·
It’s not so much why the OP thinks they’re entitled to arbitrary password length, it’s that the UI/UX does nothing to inform the user of this. And also the byte
by wishinghand 7y ago
It’s not so much why the OP thinks they’re entitled to arbitrary password length, it’s that the UI/UX does nothing to inform the user of this. And also the bytes they save restricting password length to 32 instead of 128 or 256 would be a few dollars rounding error in the end of the Year budget.
- abfan1127 7y agoproper hashing yields no saving of bytes.
- wishinghand 7y agoYou're right, I forget about that. Which is why I'm not a backend programmer.
- masklinn 7y agoI fucking hope they don’t save any bytes doing that given that’d mean the passwords are stored in clear text. Though given what we’ve seen so far once people started taking a look that’s not out of the realm of possibility.
- deleted 7y ago[deleted]
- DangerousPie 7y agoI am really struggling to come up with a situation where this would actually matter. I guess if for some reason the first 32 characters of my password got leaked but not the next 32? But why would that ever happen, and who wouldn't change their password in that situation anyway?
- Dylan16807 7y ago32 characters might be safe, but we could make the same argument for 16 characters, yet there is a huge vulnerability there: Someone might have a perfectly secure series of words as a password, but only the first three words survive truncation. Now they can be brute-forced easily. It's bad form in general to truncate a password.