5 ms·
I'm always scared when I see the maximum length limit in password. I expect they just put clear text in their DB. Otherwise why would they limit it? Any key dev
by prohor 12y ago
I'm always scared when I see the maximum length limit in password. I expect they just put clear text in their DB. Otherwise why would they limit it? Any key deviation or hash function will give the same length, regardless of the password length. Scary ...
- harshreality 12y agoThe most frightening I've seen is interactive brokers. Passwords must be 6 to 8 characters, and symbols are forbidden. Strangely, usernames must be 8 or 9 characters (with additional restrictions: >2 letters, >2 digits, and must start with a letter).
- smnrchrds 12y agoMaybe they're just trying to protect against denial-of-service attack through very long passwords[1]. Although 16 or 20 characters seem too short. [1] https://www.djangoproject.com/weblog/2013/sep/15/security/ https://www.djangoproject.com/weblog/2013/sep/15/security/
- twelve40 12y agoYes, it's probably actually necessary to introduce some kind of limit to protect the server against hashdos-type attacks. Sadly though, Occam's razor suggests that the "20 char" limits and ridiculous "alphanumeric only" restrictions are caused not by some advanced considerations but by something much more stupid and incompetent.