3 ms·
The requirements could be even more clearer * max 64 chars “should” requirement? vs. no truncation? * what about pin-codes? * the password process is still v
by makach 2y ago
The requirements could be even more clearer
* max 64 chars “should” requirement? vs. no truncation?
* what about pin-codes?
* the password process is still very much a hot mess, standardize registration, IIA, updating, cancellation
* protection of passwords at-rest, salt your passwords
- phire 2y ago> max 64 chars “should” requirement? vs. no truncation?* There kind of needs to be a truncation at some point. Otherwise there is a risk of an attacker triggering a denial-of-service attack by sending multi-gigabyte passwords.
- tsimionescu 2y agoTruncation means accepting the long password, but only looking at the first N chars. It is never acceptable. Max length requirements are absolutely required, but they must be enforced by refusing the password, not by truncating.
- matrss 2y agoThere definitely doesn't need to be truncation. A upper limit yes, to avoid the potential for DoS, but no truncation. That limit should be reasonably large, 1000 characters or something maybe. I've seen a service whose registration form accepted my 64 characters long randomly generated password, but then the login form apparently truncated the password to something smaller, silently, and just said my password was incorrect. I then had to guess what was happening and reset my password to something shorter, which worked. If you must have a stupid password policy at least make it explicit (well, and consistent).