Personally, I'm worried about the CPU of my application servers if a cost-oriented hash function has to process your 4GB large password. Though imagine how much

Personally, I'm worried about the CPU of my application servers if a cost-oriented hash function has to process your 4GB large password. Though imagine how much clout we could get from all the bogus DoS CVEs this could find. But jest aside, imo there should be a maximum limit to avoid possible nonsense, but that limit should be at 1k - 2k characters or something outlandish.