3 ms·
I don't get the max length restrictions some sites have. Why?
by beej71 2y ago
I don't get the max length restrictions some sites have. Why?
- BenjiWiebe 2y agoYou could have a reasonable length limit (1kb maybe?) so you don't spend too much CPU time hashing the password.
- kouteiheika 2y agoThat's what you gotta do when you store your passwords in plaintext and the password column in your DB is capped at a certain length.
- tetha 2y agoPersonally, I'm worried about the CPU of my application servers if a cost-oriented hash function has to process your 4GB large password. Though imagine how much clout we could get from all the bogus DoS CVEs this could find. But jest aside, imo there should be a maximum limit to avoid possible nonsense, but that limit should be at 1k - 2k characters or something outlandish.
- mnw21cam 2y agoI don't think the compute time varies that much with the length of the password being hashed for these cost-oriented hash functions.
- JimDabell 2y agoSome password hashing algorithms have a hard limit, for instance bcrypt has a maximum of 72 bytes. Beyond that, not having a maximum opens you up to DoS attacks because attackers can tie up your servers by asking them to hash a few hundred 20MB passwords at a time.
- briandear 2y agoOne mainframe system I need to access has an exactly 8 character password requirement. (Consulting work for an insurance company.)
- tsimionescu 2y agoAt some point you do need a limit: you don't want a 1GB password being transferred, of course. But the low limits you often see is somewhat lazy use of fixed-length hashing algorithms (shorter than the algorithm length: just pad; longer than the algorithm length: refuse, instead of using a different hash or figuring out how to combine multiple hashes).