4 ms·
You are missing the same point they are. A hash doesn't care about the input length and produces a fixed size output. Consequently if Stardock are claiming th
by rogerbinns 14y ago
You are missing the same point they are. A hash doesn't care about the input length and produces a fixed size output. Consequently if Stardock are claiming there is a need for a limited input length then it is a very good "smell" they are not using hashing at all. The lack of hashing is the problem and debating acceptable length limits is avoiding the topic.
- Natsu 14y agoI've long used this smell to identify companies not to trust with security. It's rare that I would be willing to create an account somewhere just to buy something, but a policy like this is always a deal-breaker for me, because I would expect them to get hacked.
- rogerbinns 14y agoAnother smell is bizarre rules. Rank amateurs are quickly spotted by requirements not to use various characters related to SQL injection and XSS. The other week I encountered a site that whined about consecutive letters, case and numbers. (My password was randomly generated by a password manager.)