Stop restricting my password - Help these sites get better security.

Re:Stop restricting my password - Help these sites get bette... by derwiki on Friday January 22, 2010 @03:19AM (#1069333)

The argument I once heard for restricting length of a password (and possibly special characters) is that it would be harder to craft a buffer overflow (or SQL injection attack) with those limitations. I don't agree that this is a good solution, but it's not always good programmers/managers who are making these decisions. It at least sounds plausible.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by tptacek on Friday January 22, 2010 @01:03PM (#1070228)

That's a really bad argument. If password length is threatening to you, you have no business accepting passwords.

(Length also has almost nothing to do with SQL Injection, and you're plugging a raw password into an SQL query you're doing something very wrong anyways).

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by jfarmer on Friday January 22, 2010 @03:32AM (#1069343)

Hmm? The hash will be a fixed length, which is the only thing you'd be storing.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by branden on Friday January 22, 2010 @04:11AM (#1069371)

In order to get that hash you'd have to process the password in its entirety. But really, if they're that concerned about the buffer I see no reason to cap it at 8 or 10 rather than 1000.

[ Parent | on HN ]

Re:Stop restricting my password - Help these sites get bette... by jfarmer on Friday January 22, 2010 @06:17PM (#1070965)

Eh. That seems unlikely, assuming you're not writing your own routines. At most you'd get an out of memory error. I can calculate the SHA1 digest of a 1Bn character string without running into that problem.

So let's cap the length at 100k characters and call it a day.

[ Parent | on HN ]