3 ms·
I would consider setting a (high) limit for a password a good practice. No one wants an attacker to run a megabyte of password data through your slow password h
by Xylakant 4y ago
I would consider setting a (high) limit for a password a good practice. No one wants an attacker to run a megabyte of password data through your slow password hash. It should be a limit that normal users never reach, but something like 100 chars seems entirely reasonable.
- BrandoElFollito 4y agoThe typical password managers allow you to generate up to ~120 characters, I would go for 500 just to be on the safe side.
- intuxikated 4y agoSome web frameworks have such limits built-in. Django for example has a limit of 4096 characters for password input, which should be more than enough for anyone, including people using long random-generated passwords from password managers
- afiori 4y agoThe reasonable thing to do is to prehash the user password on the client with a Unicode normalization and a SHA-512 pass. This way you can have strong input validation server side but also allow almost arbitrary inputs client side. PS: you likely could also salt the client side hashing and use bcrypt, but bcrypt has a quite short maximum length and I am not sure if it would provide significantly better security here.