5 ms·

What's with the asshole response? Why so condescending? Did you have a bad day? I'm sorry about that. Yes, SHA512's output is 512 bits (the clue is in the name)

What's with the asshole response? Why so condescending? Did you have a bad day? I'm sorry about that. Yes, SHA512's output is 512 bits (the clue is in the name), but paste this into your shell `ruby -rdigest/sha2 -e "puts Digest::SHA512.hexdigest('foo').length"`. You'll see 128. I'm talking about the length of the string in characters and that's quite obvious. Feel free to bog yourself in semantics and pedantry. Also none of your comment proves anything, and you make more assumptions than I do. Is anything you said a sane reason to go to the trouble of precluding a user from choosing a password > 32 chars?

booi 14y ago
not to say you should preclude a user from choosing long passwords but hex != string... ruby -rdigest/sha2 -e "puts Digest::SHA512.digest('foo').length" = 64
zaroth 14y ago
I'm sorry, what? saurik's response was concise, to the point, technically sound, and backed up with relevant details. Why in the world would you attack someone taking the time to answer your question? Maybe you didn't quite understand saurik's response. There was nothing asshole about it. S/He conveyed three basic points: 1) There are well-regarded hashing algorithm that impose a limit on the input (bcrypt) 2) In any case, the length-limit does not imply that passwords are stored in clear text 3) An argument for why the length-limit might actually be a good thing (protecting the user from a false sense of security) Now, I happen to absolutely agree on points #1 and #2, but disagree with #3. It is not true that passwords longer than the hash output are 'totally useless'. To find an arbitrary input which produces a specific hash requires 2^(bit-1) guesses on average. 'Attacking the hash' is simply not possible for a 256-bit hash. The only possible attack vector is to 'attack the password'. Therefore passwords longer than 32 chars are still useful. A 12-character truly random password taken from the full character set would take the #2 super-computer on the planet approximately 8000 days to crack in 2011. http://www.youtube.com/watch?v=CKNW5AUo-dM&t=43m50s http://www.youtube.com/watch?v=CKNW5AUo-dM&t=43m50s Add a couple more characters and you're into 'galactic years' to measure how long it would take. So clearly we don't need anywhere near 32 chars if the alphabet is large and symbols are picked at RANDOM. But if you want any hope of being able to REMEMBER the password, then a better option may be trying to get equivalent entropy using a long pass-phrase; it could possibly require more than 32 characters to make it long and fun enough to be memorable.

booi 14y ago

not to say you should preclude a user from choosing long passwords but hex != string... ruby -rdigest/sha2 -e "puts Digest::SHA512.digest('foo').length" = 64

zaroth 14y ago

I'm sorry, what? saurik's response was concise, to the point, technically sound, and backed up with relevant details. Why in the world would you attack someone taking the time to answer your question? Maybe you didn't quite understand saurik's response. There was nothing asshole about it. S/He conveyed three basic points: 1) There are well-regarded hashing algorithm that impose a limit on the input (bcrypt) 2) In any case, the length-limit does not imply that passwords are stored in clear text 3) An argument for why the length-limit might actually be a good thing (protecting the user from a false sense of security) Now, I happen to absolutely agree on points #1 and #2, but disagree with #3. It is not true that passwords longer than the hash output are 'totally useless'. To find an arbitrary input which produces a specific hash requires 2^(bit-1) guesses on average. 'Attacking the hash' is simply not possible for a 256-bit hash. The only possible attack vector is to 'attack the password'. Therefore passwords longer than 32 chars are still useful. A 12-character truly random password taken from the full character set would take the #2 super-computer on the planet approximately 8000 days to crack in 2011. http://www.youtube.com/watch?v=CKNW5AUo-dM&t=43m50s http://www.youtube.com/watch?v=CKNW5AUo-dM&t=43m50s Add a couple more characters and you're into 'galactic years' to measure how long it would take. So clearly we don't need anywhere near 32 chars if the alphabet is large and symbols are picked at RANDOM. But if you want any hope of being able to REMEMBER the password, then a better option may be trying to get equivalent entropy using a long pass-phrase; it could possibly require more than 32 characters to make it long and fun enough to be memorable.