Ask HN: Why is PayPal's password length limit still a thing?

Re:Ask HN: Why is PayPal's password length limit still a thing? by skookumchuck on Monday March 19, 2018 @02:26PM (#16621469)

I learned long ago in programming that setting arbitrary limits seems simpler to code, but in the end it is more work. You need to deal with error messages, error recovery, user instructions, and complaints from users. It's so much simpler to just allocate memory for whatever size the data happens to be.

Then, you just have to deal with one generic "out of memory" situation.

[ Parent | on HN ]

Re:Ask HN: Why is PayPal's password length limit still a thing? by cmccart on Monday March 19, 2018 @05:39PM (#16623477)

For inputs that are going to get hashed that seems reasonable, as well as for single-purpose systems. On the flipside, this seems like a great way to have unintended consequences downstream in more complex systems. That "out of memory" condition may appear as an ephemeral bug or slowdown that surfaces not at input time but at retrieval by another service.

[ Parent | on HN ]

Re:Ask HN: Why is PayPal's password length limit still a thing? by MichaelGG on Monday March 19, 2018 @05:20PM (#16623299)

So on a modern machine that might mean a user can submit a 1GB password?

[ Parent | on HN ]

Re:Ask HN: Why is PayPal's password length limit still a thing? by Klathmon on Monday March 19, 2018 @05:39PM (#16623476)

Your server should still have POST size limitations and other limits to prevent DoS.

[ Parent | on HN ]

Re:Ask HN: Why is PayPal's password length limit still a thing? by cdancette on Monday March 19, 2018 @06:16PM (#16623760)

I'm not sure relying on max POST size for password length is a good practice. It would be hell to debug without a good documentation.

[ Parent | on HN ]

Re:Ask HN: Why is PayPal's password length limit still a thing? by skookumchuck on Monday March 19, 2018 @06:30PM (#16623899)

> max POST size [...] hell to debug [...]

As I was saying :-)

[ Parent | on HN ]