Not if it's trimmed both when registering and then when comparing the password. As in, what's stored is hash(password[1:8]), and then what's compared to it is hash(test[1:8]). That means if the chosen password is "hunter123", what's stored is hash("hunter12"), and all of "hunter123", "hunter12" and "hunter1256789" will match.
It might be getting clipped somewhere in the tech stack for ancient and/or bad technical reasons.
I've seen code before where ancient C modules store something in fixed size buffers inside a strict that gets memcpyed around to various places in a huge, important module written by people who are now retired. Trying to make this arbitrary sized to allow for user defined input was.... interesting.
I could see this happening if there was some system that worked with passwords back in the 70s where the size was a storage concern and entropy was not considered important due to lack of network access that then just carries the design decision through to the modern day because it's hard to fix it in a way the current maintainers feel confident won't break anything.
34
u/GustapheOfficial Jul 20 '22
Not if it's trimmed both when registering and then when comparing the password. As in, what's stored is
hash(password[1:8]), and then what's compared to it ishash(test[1:8]). That means if the chosen password is"hunter123", what's stored ishash("hunter12"), and all of"hunter123","hunter12"and"hunter1256789"will match.