4 ms·

Can anyone explain to me why even new products have a maximum character limit? I frequently see 16 or 20 maximum characters. If you're hashing the password, w

Can anyone explain to me why even new products have a maximum character limit? I frequently see 16 or 20 maximum characters. If you're hashing the password, why does it matter?

perryizgr8 5y ago
Although 16 or 20 characters is too less, I can't think of an efficient and user-friendly way to allow arbitrary lengths. What if a user inputs a password with 604462909807314587353087 characters? If your client is doing the hashing, it will get stuck or seem to take too much time to submit. If your backend is doing the hashing then you would need to send too much data over the internet, again killing the user experience. I think 256 or 512 characters should be a sensible limit. PS: 604462909807314587353087 is a Mersenne prime ;)
amelius 5y ago
Perhaps to prevent buffer overflow problems. Simplifies development and testing.
- wruza 5y ago
  Wait, what? Even if they write their auth backends in C or assembly, nothing stops them from “#define MAXPWLEN 100”.
  - amelius 5y ago
    That's still a limit.
throwaway984393 5y ago
If it's a bank, it's because the 40 year old database they first used to first digitize their 150-year-old accounts had a maximum character limit (which is why you sometimes see 8 character maximum passwords). Old accounts that generate money just by sitting around are also the reason they never need to upgrade anything and can make changes at a snail's pace.