4 ms·
You would truncate to 72 bytes, not 20 characters (which might be more than 72 bytes anyway).
by monadic2 6y ago
You would truncate to 72 bytes, not 20 characters (which might be more than 72 bytes anyway).
- zrm 6y agoSo potentially even worse. Somebody decides they don't like variable-width encodings and uses UTF-32 and now 72 bytes doesn't even get you 20 code points, only 18. But it's the same principle no matter where you cut. User thinks they can use an arbitrarily long password, puts a long but low entropy or easily guessable string at the front and makes up for it by having some good entropy at the end, and then you chop off the end.