3 ms·
If a person ever even considers writing code which could generate either of these error messages: "Your password is too long!" "Your password uses special cha
by msla 6y ago
If a person ever even considers writing code which could generate either of these error messages:
"Your password is too long!"
"Your password uses special characters!"
... they are not only incompetent to write code which handles passwords, they have been so misinformed that they are an outright liability. They need to relearn everything they currently know on the subject and start over. Few things in the technical world instantly convey such utter anti-knowledge as the presence of either or both of those error messages in a codebase.
- IggleSniggle 6y agoIf that’s true, can you please share a link to your website so that I can stop using Dropbox and migrate my encoded data to be stored in your password field?
- Zecc 6y agoThey don't encrypt your password, they hash it.
- IggleSniggle 6y agoHrm, yes, good point. So my snarky comment loses its charm, if it ever had any. Still, though, I think it’s reasonable to alert the user if your password exceeds its allocated storage rather than silently truncate.
- gbear605 6y agoSome passwords are too long - I wouldn’t expect any website to accept a gigabyte long password - and I wouldn’t judge a site that doesn’t accepts \0 either.
- tdrp 6y agoI don't remember the math on hashing/bcrypt but isn't this the case that all passwords sort of hash to a fixed length string? Like why even have something like "your bank password must be 8-12 characters" long. Obviously for a gigabyte long it's a bandwidth and hash-computing issue :p
- couchand 6y agobcrypt's input is limited to 72 characters in most implementations. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#maximum-password-lengths https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...
- masklinn 6y ago> Obviously for a gigabyte long it's a bandwidth and hash-computing issue :p Yes, that’s why you put in limits which are way beyond reasonable passwords but way below that. Say a few hundred or thousand bytes. Also worth consideration: most of these work on bytes, probably utf8. A user wants to be cute and put emoji in there, that’s 4 bytes a pop. So depending how the system counts them, “hospital plane” might be considered 2, 4 or 8 characters. But wait! Group emoji are concatenation combinations thereof, you can have a single multi-character emoji which is composed of half a dozen codepoints, and two dozen bytes once encoded.
- c3534l 6y agobcrypt has a maximum length of 72 characters and its what Mozilla recommends for encryption. Do you think Mozilla is too "incompetent to write code which handles passwords" and "an outright liability"?