News for hackers. Stuff that matters.

A comment on Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames. Parent comment

Re:Opensubtitles.org breached – Email addresses, IP addresse... by 8organicbits on Wednesday January 19, 2022 @07:53AM (#29992960)
> Many implementations of bcrypt truncate the password to the first 72 bytes, following the OpenBSD implementation.

https://en.m.wikipedia.org/wiki/Bcrypt

This sounds undesirable to me, so I'd support sha256 and an alternative.

I'd also recommend adding a max password length to any API. No point in allowing million character passwords.

[ Parent | on HN ]
Re:Opensubtitles.org breached – Email addresses, IP addresse... by 8organicbits on Wednesday January 19, 2022 @03:37PM (#29999717)
I'm guessing folks are reading that as endorsement or sha256 over bcrypt. In context with the above post, this is sha256 over truncation.
[ Parent | on HN ]