5 ms·
What should this limit be? Personally, I think the limit should be nothing smaller than a thousand characters. Or even allowing something like a hundred charac
by mcny 3y ago
What should this limit be?
Personally, I think the limit should be nothing smaller than a thousand characters. Or even allowing something like a hundred characters or more would be better.
I remember at some point Hotmail had a maximum length limit of sixteen characters.
https://arstechnica.com/information-technology/2012/09/secret-microsoft-policy-limited-hotmail-passwords-to-16-characters/ https://arstechnica.com/information-technology/2012/09/secre...
- falcolas 3y ago100Kb is a perfectly reasonable length IMO. Only takes seconds to send even over terrible links.
- iLoveOncall 3y agoIt becomes problematic when it needs to be hashed, you can essentially DDOS servers by sending extremely long passwords that need to be hashed.
- falcolas 3y agoRealistically speaking, the hash would be your smallest problem if you're being DDoSed. Bcrypt for example would require at most ~6.4Mb of memory to do the hash, and more realistically only the 100k plus some constant. And modern CPUs are pretty efficient at doing the encryption steps, meaning little additional load for encrypting a larger value.
- AtNightWeCode 3y ago[flagged]
- dang 3y agoAttacking another user like that will get you banned here. No more of that, please. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- tracker1 3y agoPart of why I prefer to have authentication on a separate server... if it gets ddos'd at least existing sessions can carry on.
- AtNightWeCode 3y ago256 is fine in most user scenarios. No one will type in more chars than that anyway. And if a pw manager is used the length is not really a problem. For services there are often better alternatives.