4 ms·Wait wait. Why would you truncate it after input unless... you're storing it in plaintext?by davedx 2y agoWait wait. Why would you truncate it after input unless... you're storing it in plaintext?zja 2y agoYou truncate passwords to prevent DOSlesuorac 2y agoWhy not either show an error or do a client-side hash so there's a fixed length?orblivion 2y agoShowing an error is probably the right thing. Client-side mitigations wouldn't prevent a DOS.orblivion 2y agoMaybe the KDF gets really slow with a super long input.