4 ms·
What? This doesn't make any sense at all. They just check the length restriction server-side before hashing it.
by cypherpunks01 14y ago
What? This doesn't make any sense at all. They just check the length restriction server-side before hashing it.
- wlll 14y agoWhy do they need to check the length of a password before hashing when the resulting password hash will be a fixed length regardless of the length of the original password?
- frou_dh 14y agoI can imagine a thought process along the lines of: "Most people don't use password managers, so it's asking for trouble to allow extremely long passwords. 32 should be plenty, even for the security conscious minority."
- sjtgraham 14y agoIt actually does make sense. If passwords were not hashed they would check the length before inserting in to the database because strings longer than the column size will be silently truncated. There is nothing to suggest passwords ARE hashed.