8 ms·
> Why can't my password be a 5KB long Because that opens you up to an entirely new class of attack. You have to set the limit somewhere and if you set it at IN
by shalmanese 3mo ago
> Why can't my password be a 5KB long
Because that opens you up to an entirely new class of attack. You have to set the limit somewhere and if you set it at INT_MAX, then a malicious user could find a O(n^2) path in your password validator and input a 4GB password that locks up the machine. Or they could create 1000 users in a row with 4GB passwords and fill up your storage.
- Kirby64 2mo ago> Or they could create 1000 users in a row with 4GB passwords and fill up your storage. Not an issue if you’re storing passwords properly. You don’t store the actual password, you store a (hopefully) salted hash of it.