Thread

1. 40four · 1790992736 · focus · HN ↗

   I’ve ran into this same issue numerous times on different platforms. They silently enforce a max length, unannounced to you, then you can’t log in later until you figure out the correct length.

   I guess I don’t really understand the reasons any engineering team would limit password length, but at least implement in a way that is apparent to the user. Successfully saving a password that is different than the user expects is wild.

   Moreover, in the case of a financial institution like Vanguard, limiting password length feels particularly offensive.

   1. efilife · 1791008080 · focus · HN ↗

      > I guess I don’t really understand the reasons any engineering team would limit password length

      The bcrypt hashing algorithm doesn't work on inputs above ~60* characters or so. It will just silently trim your input. Better to do it yourself

      *72 bytes

      1. Atheros · 1791009364 · focus · HN ↗

         In case any programmers read this, the better procedure, if you want to use bcrypt, is to hash the password with something else first, like SHA512, then feed the output into bcrypt.

         1. efilife · 1791010684 · focus · HN ↗

            what's the point in using bcrypt then? I researched this years ago and nothing ever convinced me it's not redundant

            1. Atheros · 1791011949 · focus · HN ↗

               to slow down attackers who want to brute force your password hash. At least that was the idea. I guess it also includes the salt stuff built in so that it's harder for implementers to screw up.

               Is a 9-order-of-magnitude slow down worth the trouble? I dunno. Maybe.

      2. 40four · 1791061501 · focus · HN ↗

         Interesting, I didn’t know that. My knowledge of cryptography is admittedly not great. 20 characters limit is pretty aggressive though.

Unofficial Hacker News client; not affiliated with Y Combinator.