3 ms·
> Set no maximum password length (250+ characters) It's important to note that if you take the classical advice to "use bcrypt" (http://codahale.com/how-to-saf
by spb 12y ago
> Set no maximum password length (250+ characters)
It's important to note that if you take the classical advice to "use bcrypt" (http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/), your password will be effectively truncated at 72 characters.
- Someone1234 12y agoFair point. I'd still happily take 72 characters compared to what many sites currently offer. Anything over 30 is the exception not the rule.
- sscotth 12y agoIf someone can guess the first 72 characters of your password, they probably know the rest. e.g. They have access to your password manager or you are using a common phrase. I still wouldn't limit a user from entering in a longer password. I'd display a warning if they attempt to enter in a 73+ character password to inform them that passwords longer than 72 characters offer no additional protection.
- mike-cardwell 12y agoIs there a similar affect for scrypt?
- Dylan16807 12y agoThat's a bug. Bcrypt doesn't truncate, it simply doesn't handle longer passwords. And you can pretty safely use another hash before feeding it into bcrypt.