Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'd love to try this out as I've been looking for something like for a long time. But I can't use it because I can't sign up with a password longer than 16 characters. This is a rookie security mistake that I see over and over again and makes me worry. As a rule of thumb, you should NOT limit the length of a password. Salting will take care of the weak password problem and a long password is, well, the securer the better.

Edit: use a secure hash on the password before storing into the database



Correct assessment - wrong solution. If you hash your passwords the stored result will always be the same fixed length. Do that (which you should anyhow for security reasons) and you don't need to mess with changing your database.


Yep you are right, it's late here on a Friday night and my brain flashed bcrypt and scrypt's differing lengths for a second. Now that I looked back I was like, the hell? LOL oh man thanks for the correction.


we do use PostgreSQL and there are no any restrictions on the length in the database. it seems the limitation only in the UI, will be fixed asap.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: