3 ms·

Is it a downside if the password is a 100 characters-long string?

• doodlesdev 4y ago
  A fellow cryptographer in the security board on stack exchange has shared their opinion on this: https://security.stackexchange.com/questions/3959/recommended-of-iterations-when-using-pbkdf2-sha256/3963#3963 https://security.stackexchange.com/questions/3959/recommende... TLDR: No. In fact, theoretically stretching the password is more effective than increasing iterations. However, I don't see him citing the fact some password hashing functions have limited input size, which means at some point having a larger password doesn't really change anything.
• bawolff 4y ago
  Depends which characters they are. But in practise nobody uses 100 character long strings. Security is the intersection of real users with systems, not imaginary ones.
  • jsjohnst 4y ago
    > But in practise nobody uses 100 character long strings. Multiple websites I use daily have that length of password or longer.
• pmontra 4y ago
  I was thinking that I keep my secrets at hand in my password manager of the Keepass family. I sync the db from my laptop to my mobile devices. The 100 characters password would be in the password manager but the secrets I would work with fit into the password manager, so I have no need to use a separate channel. I could upload the db, download it and just remember the master password. The only use case for this technology is when the secret is the file itself and it can't fit in the password manager. An image, a file, etc.