Thread

<input type="password" maxlength="20"> prevents me from logging into Vanguard

66 points · 99 comments · tanin

bootlooped · 1790984162 · focus · HN ↗
My biggest question here is are they not just feeding the input into a hash function, why can't it be longer than 20 characters?
1. hombre_fatal · 1790985006 · focus · HN ↗
  It's a good habit to always create an upper bound on things (input max length, queue size, etc).
  The person who wrote it just came up with 20 in the moment and forgot to go check, something everyone has done a hundred times.
  I've probably never worked on a single system where the html validation, http server validation, and database constraint were synchronized on username max length. You choose a placeholder, an even number between 10 and 16, then forget to ever check.

Unofficial Hacker News client; not affiliated with Y Combinator.