this post was submitted on 17 Jul 2023
422 points (88.6% liked)
Programmer Humor
38314 readers
9 users here now
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
founded 6 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Infuriating fact: if a service has maximum password length limits (lower than 1000 characters), they're reversibly storing your password and if they're that lazy it's probably plain text
Not necessarily. There is another reason. Password hash functions like PBKDF2 are, by design, slow. Allowing extremely long passwords while using such a hash function creates a denial-of-service vulnerability.
Assuming the hash function takes proportionally more time to compute the hash of a longer password, of course. I believe they do, but I'm not certain.
This is why I believe something like a 1000 character limit is reasonable, but a 14 one is not.