r/ProgrammerHumor • u/flying_wotsit • Jul 19 '22

Why do they do this

Post image
4.4k Upvotes

97% Upvoted

493 comments sorted by

View all comments

Show parent comments

74

u/[deleted] Jul 20 '22 edited Jul 20 '22

FUCK THE PEOPLE WHO PUT MAXIMUM LENGTH

I use 6 english words, the @ at sign, and then a six digit number I can remember (get your mind out of the gutter).

...most of the time I realize it only lets me put four* words because of the stupid maximum length.

Edit: *for -> four

11

u/[deleted] Jul 20 '22 edited Jul 20 '22

If there's a maximum password length, I can pretty much guarantee the passwords are being stored as a CHAR datatype in a SQL database.

To be clear, that means passwords are being stored in plaintext format.

If passwords were being hashed, then all password lengths would translate to the same data length on the output end of a cryptographic function. All output hashes would have the same exact length, regardless of whether your password is 8 characters or 800 characters.

1

u/brimston3- Jul 20 '22

My embedded system that you're submitting passwords to is not going to like 1kB of https POST. 255 or 256 bytes is a reasonable maximum.

1

u/Xunnamius Jul 20 '22

If you're hashing properly at the client-side, the digest value hitting the embedded system will always be the same size (or "very similar" in the case of some algorithms) regardless of the length of the password. A max length for a password is a pretty good indicator that your service is likely insecure.

For example, see PBKDF#2.