News for hackers. Stuff that matters.

A comment on Tell HN: Zoom truncates passwords to 32 chars. Parent comment

Re:Tell HN: Zoom truncates passwords to 32 chars by wishinghand on Wednesday April 01, 2020 @11:54AM (#22750005)
It’s not so much why the OP thinks they’re entitled to arbitrary password length, it’s that the UI/UX does nothing to inform the user of this. And also the bytes they save restricting password length to 32 instead of 128 or 256 would be a few dollars rounding error in the end of the Year budget.
[ Parent | on HN ]
Re:Tell HN: Zoom truncates passwords to 32 chars by masklinn on Wednesday April 01, 2020 @11:59AM (#22750076)
I fucking hope they don’t save any bytes doing that given that’d mean the passwords are stored in clear text.

Though given what we’ve seen so far once people started taking a look that’s not out of the realm of possibility.

[ Parent | on HN ]
Re:Tell HN: Zoom truncates passwords to 32 chars by DangerousPie on Wednesday April 01, 2020 @12:03PM (#22750143)
I am really struggling to come up with a situation where this would actually matter. I guess if for some reason the first 32 characters of my password got leaked but not the next 32? But why would that ever happen, and who wouldn't change their password in that situation anyway?
[ Parent | on HN ]
Re:Tell HN: Zoom truncates passwords to 32 chars by Dylan16807 on Wednesday April 01, 2020 @12:30PM (#22750527)
32 characters might be safe, but we could make the same argument for 16 characters, yet there is a huge vulnerability there: Someone might have a perfectly secure series of words as a password, but only the first three words survive truncation. Now they can be brute-forced easily.

It's bad form in general to truncate a password.

[ Parent | on HN ]
Re:Tell HN: Zoom truncates passwords to 32 chars by abfan1127 on Wednesday April 01, 2020 @11:55AM (#22750027)
proper hashing yields no saving of bytes.
[ Parent | on HN ]
Re:Tell HN: Zoom truncates passwords to 32 chars by wishinghand on Thursday April 02, 2020 @03:24PM (#22762655)
You're right, I forget about that. Which is why I'm not a backend programmer.
[ Parent | on HN ]