News for hackers. Stuff that matters.
Re:Run your own OAuth2 server by hxtk on Monday September 04, 2017 @08:10PM (#15171627)
It seems like the simplest thing, then, would be to use a secret that is too short in your documentation and make note of both the fact that it's too short and what the requirements are for a good secret.

Of course, this runs the risk that a user will simply "salt" the sample you provide up to the necessary length, which makes the length of their secret effectively the difference between the minimum length and the sample length.

There are no comments on this comment yet.