4 ms·
I'd love to try this out as I've been looking for something like for a long time. But I can't use it because I can't sign up with a password longer than 16 char
by wyuenho 13y ago
I'd love to try this out as I've been looking for something like for a long time. But I can't use it because I can't sign up with a password longer than 16 characters. This is a rookie security mistake that I see over and over again and makes me worry. As a rule of thumb, you should NOT limit the length of a password. Salting will take care of the weak password problem and a long password is, well, the securer the better.
Edit: use a secure hash on the password before storing into the database
- protonfish 13y agoCorrect assessment - wrong solution. If you hash your passwords the stored result will always be the same fixed length. Do that (which you should anyhow for security reasons) and you don't need to mess with changing your database.
- wyuenho 13y agoYep you are right, it's late here on a Friday night and my brain flashed bcrypt and scrypt's differing lengths for a second. Now that I looked back I was like, the hell? LOL oh man thanks for the correction.
- skavish 13y agowe do use PostgreSQL and there are no any restrictions on the length in the database. it seems the limitation only in the UI, will be fixed asap.