News for hackers. Stuff that matters.

A comment on We didn't encrypt your password, we hashed it. Parent comment

Re:We didn't encrypt your password, we hashed it by charrondev on Friday September 04, 2020 @09:23PM (#24380638)
My understanding is bcrypt truncates at 72 bytes by default, which could be 18 emojis I guess?

It should still be consistent with registration/login with things getting truncated, but I think this is also the default in PHP if you are using password_hash() today. Is that a security issue?

[ Parent | on HN ]
Re:We didn't encrypt your password, we hashed it by couchand on Friday September 04, 2020 @11:13PM (#24381131)
> Although implementing a maximum password length does reduce the possible keyspace for passwords, a limit of 64 characters still leaves a key space of at least 2^420, which is completely infeasible for an attacker to break. As such, it does not represent a meaningful reduction in security.

https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...

[ Parent | on HN ]
Re:We didn't encrypt your password, we hashed it by masklinn on Saturday September 05, 2020 @02:37AM (#24381775)
> My understanding is bcrypt truncates at 72 bytes by default

I don’t think it’s “a default”, it’s a fundamental limitation of the algorithm.

Specific bcrypt libraries could implement length-reduction by default though.

[ Parent | on HN ]