Re:Stop forcing arbitrary password rules
by jordanpg on Saturday October 24, 2015 @10:07AM
(#10443639)
Whenever I see this maximum password length nonsense, I realize that whoever is in charge of security at this company apparently doesn't know or care about password managers. And that speaks volumes to me.
[ Parent
| on HN ]
It is also a 'code smell' that suggests that the relevant company is storing passwords in plaintext.
Reason: If they were hashing the password, the hash output would be fixed length, independent of the input length, so there would be no need for an external, user visible, maximum length restrictions.
Re:Stop forcing arbitrary password rules
by mkobit on Saturday October 24, 2015 @11:30AM
(#10443865)
That's an interesting and plausible take on it. Why do you think new companies still go the route of not allowing special characters (like <>;"()' and the other SQL injection types)? I would think that new companies would know better by now, but I guess not?