4 ms·
There is no sound technical or security justification for having a maximum character limit, up to some obscenely long limit to prevent the user wasting server r
by wyager 5y ago
There is no sound technical or security justification for having a maximum character limit, up to some obscenely long limit to prevent the user wasting server resources by submitting giant forms.
Also, no one should be using raw HMAC to do password checking. At the very least use something like PBKDF2.
- trinovantes 5y agoAt this point, I just automatically assume any website that has a maximum character limit and weird character restrictions is storing the password in plaintext
- jaywalk 5y agoSometimes the character restrictions are due to overly aggressive web application firewalls.
- tdumitrescu 5y agoSetting a reasonable limit closes off a potential DoS vector. That's why our security team had us add a limit. (Sure, in practice rate limiting should also be in place, defense in depth.)