Thread

1. bootlooped · 1790984162 · focus · HN ↗

   My biggest question here is are they not just feeding the input into a hash function, why can't it be longer than 20 characters?

   1. margalabargala · 1790984220 · focus · HN ↗

      Are you looking for the technical reason or the political one?
   2. zetanor · 1790984250 · focus · HN ↗

      It had to be restricted after someone started using a complete Wikipedia database dump as a password.

      1. Sohcahtoa82 · 1790984494 · focus · HN ↗

         If your web server isn't throwing a 413 Content Too Large immediately after seeing a "Content-length: 20000000000" header, or bailing out after enough chunks from a "Transfer-Encoding: chunked" header, you configured it wrong.

         1. jagged-chisel · 1790991874 · focus · HN ↗

            But that upper limit has to indicated somewhere
   3. frenchtoast8 · 1790984309 · focus · HN ↗

      TFA says the mobile app works (so presumably the backend accepts long passwords fine). Looks like it's just a frontend issue. I wonder if deleting the maxlength attribute before submitting the form works fine?
   4. coaksford · 1790984381 · focus · HN ↗

      At some point you don't want people to enter the bee movie script, but where the word "bee" was replaced with the entire bee movie script again, recursively three times, all into the password field and tie up servers with extremely long requests.

      But 20 characters is simply ridiculous.

      1. shermantanktop · 1790984565 · focus · HN ↗

         <input type="password" maxbeemovierecursions="2">
   5. arkadiyt · 1790984385 · focus · HN ↗

      bcrypt famously only looks at the first 72 bytes of the input. There are ways around that - don't use bcrypt, or do bcrypt(sha256(password)), or whatever, but it is not the case that "just feed the input to the hash" removes all length restrictions
   6. hombre_fatal · 1790985006 · focus · HN ↗

      It's a good habit to always create an upper bound on things (input max length, queue size, etc).

      The person who wrote it just came up with 20 in the moment and forgot to go check, something everyone has done a hundred times.

      I've probably never worked on a single system where the html validation, http server validation, and database constraint were synchronized on username max length. You choose a placeholder, an even number between 10 and 16, then forget to ever check.

   7. matja · 1790985056 · focus · HN ↗

          CREATE TABLE passwords (
            email VARCHAR(MAX),
            password VARCHAR(20) UNIQUE -- unique passwords are more secure.
              -- NOTE: "20" here because we used to use SHA1 hashes
              -- but there was an issue with storing binary in CP437
              -- so we just renamed the field.
          )

      1. kstrauser · 1790986059 · focus · HN ↗

         That just made me twitch so hard that I have a crick in my neck.

Unofficial Hacker News client; not affiliated with Y Combinator.