Hacker News Reader

Just hash raw bytes. Treat it as data and set a maximum byte limit.

Indeed, this is the correct solution.

Even if you assume that a user has a broken setup that somehow submits weird characters, you're still better off accepting it so that at least they can continue to log in using that weird setup, as opposed to trying to "correct" it and potentially locking the user out.

Just be sure there is some mechanism in place to reset the password. As they might then have issue with different platforms. And also ensure if you support multiple platforms there isn't clear operating difference in between.

Why a "maximum limit"?

You don't want someone to use password that is millions or billions code-points in length. Technically in spec, but utterly stupid and useless. Just don't go too low.

DOS/resource exhaustion. It doesn't need to be something dumb like 24 characters.

Reply on news.ycombinator.com