Hacker News Reader

No, that has nothing to do with password length.

You're right, I checked old emails.

The 1000 character password issue was something different: we check new passwords against most common passwords (a long list) in the browser before submitting and checking long passwords frooze the browser. The algorihm tries too many substring matches.

Nice. There are lots of ways to speed that up, though. Use tries, or hash both your user's passwords and the list. (So that they're all the same length, and you never care about substring matches.)

I've had sites tell me when resetting a password that my new password is too similar to one of my old passwords (not even the previous one.) Far too many sites do something similar to substring searches.

That is an entirely different can of worms :)

Reply on news.ycombinator.com