Re:Ask HN: Why Limit Password Length?
by cratermoon on Thursday February 25, 2021 @07:05PM
(#26270020)
That's not really a good reason, though. If you're running a high-traffic website you should already have a way to shed load and terminate long-running requests and threads. But "long-running" is subjective and depends on the environment.
The recommended work factor for bcrypt is based on a lot of assumptions, and again, for a high-traffic high-value website you should be setting your bcrypt work factor to something that arrives at a target time for verifying a password is short enough to not annoy users but long enough to deter offline cracking. But how long is "long enough"? It depends on the value of your data. If you're storing Top Secret data, you should assume attackers have nation-state level resources and patience and your users are willing, or required, to accept response times that wouldn't be acceptable to consumers.
So the short answer to "why limit password length?" is that there's no good reason if you actually care about the tradeoffs between security and user experience.
The recommended work factor for bcrypt is based on a lot of assumptions, and again, for a high-traffic high-value website you should be setting your bcrypt work factor to something that arrives at a target time for verifying a password is short enough to not annoy users but long enough to deter offline cracking. But how long is "long enough"? It depends on the value of your data. If you're storing Top Secret data, you should assume attackers have nation-state level resources and patience and your users are willing, or required, to accept response times that wouldn't be acceptable to consumers.
So the short answer to "why limit password length?" is that there's no good reason if you actually care about the tradeoffs between security and user experience.