|
|
|
|
|
|
by shalmanese
29 days ago
|
|
|
> Why can't my password be a 5KB long Because that opens you up to an entirely new class of attack. You have to set the limit somewhere and if you set it at INT_MAX, then a malicious user could find a O(n^2) path in your password validator and input a 4GB password that locks up the machine. Or they could create 1000 users in a row with 4GB passwords and fill up your storage. |
|
|
Not an issue if you’re storing passwords properly. You don’t store the actual password, you store a (hopefully) salted hash of it.