> to prevent super long passwords from eating up CPU time
Is that why websites sometimes have low maximum password length requirements ? Ex: must be less than 20 characters.
Is that why websites sometimes have low maximum password length requirements ? Ex: must be less than 20 characters.
Websites (like some banks used to) that have less-than 20 char limits for passwords are purely bad security strategy.
There needs to be a limit, yes, but surely something like 100 characters, or even 50, would be more sensible.
Banks all have systems that will stop you from attempting to bruteforce them.
I've run across that at least once and it was a total pain to troubleshoot and figure out.
"A password one megabyte in size, for example, will require roughly one minute of computation to check when using the PBKDF2 hasher."