Hacker News Reader

Comment by msla | Hacker News Reader

If a person ever even considers writing code which could generate either of these error messages:

"Your password is too long!"

"Your password uses special characters!"

... they are not only incompetent to write code which handles passwords, they have been so misinformed that they are an outright liability. They need to relearn everything they currently know on the subject and start over. Few things in the technical world instantly convey such utter anti-knowledge as the presence of either or both of those error messages in a codebase.

View on HN

Some passwords are too long - I wouldn’t expect any website to accept a gigabyte long password - and I wouldn’t judge a site that doesn’t accepts \0 either.

I don't remember the math on hashing/bcrypt but isn't this the case that all passwords sort of hash to a fixed length string? Like why even have something like "your bank password must be 8-12 characters" long.

Obviously for a gigabyte long it's a bandwidth and hash-computing issue :p

bcrypt's input is limited to 72 characters in most implementations.

https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...

> Obviously for a gigabyte long it's a bandwidth and hash-computing issue :p

Yes, that’s why you put in limits which are way beyond reasonable passwords but way below that. Say a few hundred or thousand bytes.

Also worth consideration: most of these work on bytes, probably utf8. A user wants to be cute and put emoji in there, that’s 4 bytes a pop. So depending how the system counts them, “hospital plane” might be considered 2, 4 or 8 characters.

But wait! Group emoji are concatenation combinations thereof, you can have a single multi-character emoji which is composed of half a dozen codepoints, and two dozen bytes once encoded.

If that’s true, can you please share a link to your website so that I can stop using Dropbox and migrate my encoded data to be stored in your password field?

They don't encrypt your password, they hash it.

Hrm, yes, good point. So my snarky comment loses its charm, if it ever had any. Still, though, I think it’s reasonable to alert the user if your password exceeds its allocated storage rather than silently truncate.

bcrypt has a maximum length of 72 characters and its what Mozilla recommends for encryption. Do you think Mozilla is too "incompetent to write code which handles passwords" and "an outright liability"?

Reply on news.ycombinator.com