News for hackers. Stuff that matters.

A comment on Stop forcing arbitrary password rules. Parent comment

Re:Stop forcing arbitrary password rules by pwg on Saturday October 24, 2015 @11:01AM (#10443789)
It is also a 'code smell' that suggests that the relevant company is storing passwords in plaintext.

Reason: If they were hashing the password, the hash output would be fixed length, independent of the input length, so there would be no need for an external, user visible, maximum length restrictions.

[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by mkobit on Saturday October 24, 2015 @11:30AM (#10443865)
That's an interesting and plausible take on it. Why do you think new companies still go the route of not allowing special characters (like <>;"()' and the other SQL injection types)? I would think that new companies would know better by now, but I guess not?
[ Parent | on HN ]