4 ms·

I must admit, as a software dev I'm quite distressed that this is what I was prompted with when I tried to login to my email today.

• 27182818284 13y ago
  From that warning message there, I don't know how you determined that they aren't hashing. You might have to spoon-feed it to me. I feel like they are just looking out for whatever legacy systems that will stroke if you pass more than 16 char to them?
  • legatou 13y ago
    In order to validate that my 16-char truncated password is correct, they would have to have my password stored somewhere. Standard security practice is to store ONLY the hash of a password, and never the password text.
    • heywire 13y ago
      What if they never stored more than 16 characters, and only recently added the message?
    • 27182818284 13y ago
      I don't get that from the message though. To me it seems like they do a len() on the input box before it would ever be hashed or stored or anything like that on the server.
  • nate 13y ago
    If you hash a password, when a user logging in enters their password you convert what they type into a hash and compare that hash to the hash you have stored. A partial password (like the first 16 characters) isn't going to equal the same hash that you have stored in your database.