News for hackers. Stuff that matters.

A comment on Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames. Parent comment

Re:Opensubtitles.org breached – Email addresses, IP addresse... by DrBoring on Wednesday January 19, 2022 @08:03AM (#29993050)
> to prevent super long passwords from eating up CPU time

Is that why websites sometimes have low maximum password length requirements ? Ex: must be less than 20 characters.

[ Parent | on HN ]
Re:Opensubtitles.org breached – Email addresses, IP addresse... by ThreeToZero on Wednesday January 19, 2022 @08:23AM (#29993280)
Super long is >100 character passwords. Not much point: either the hash function is broken or some other hack will happen before humanity develops enough compute power to crack 100 char bcrypt passwords.

Websites (like some banks used to) that have less-than 20 char limits for passwords are purely bad security strategy.

[ Parent | on HN ]
Re:Opensubtitles.org breached – Email addresses, IP addresse... by mooreds on Wednesday January 19, 2022 @09:43AM (#29994160)
You know what the worst is? When they limit you to, say, 20 or 32 characters, but accept a longer password and silently truncate it!

I've run across that at least once and it was a total pain to troubleshoot and figure out.

[ Parent | on HN ]
Re:Opensubtitles.org breached – Email addresses, IP addresse... by GordonS on Wednesday January 19, 2022 @08:40AM (#29993496)
The number of sites that restrict passwords to 20 characters drives me nuts!

There needs to be a limit, yes, but surely something like 100 characters, or even 50, would be more sensible.

[ Parent | on HN ]
Re:Opensubtitles.org breached – Email addresses, IP addresse... by BlueTemplar on Wednesday January 19, 2022 @09:14AM (#29993798)
And it's the same websites that tend to use the bad practice of forcing the use of 2-4 "types" of characters...
[ Parent | on HN ]
Re:Opensubtitles.org breached – Email addresses, IP addresse... by userbinator on Wednesday January 19, 2022 @09:19AM (#29993844)
like some banks used to

Banks all have systems that will stop you from attempting to bruteforce them.

[ Parent | on HN ]
Re:Opensubtitles.org breached – Email addresses, IP addresse... by colejohnson66 on Wednesday January 19, 2022 @09:18AM (#29993837)
The CPU usage difference between a hash on 20 bytes vs 100 (assuming ASCII) can't be that bad, can it?
[ Parent | on HN ]
Re:Opensubtitles.org breached – Email addresses, IP addresse... by patrakov on Thursday January 20, 2022 @05:46AM (#30007202)
We are not talking about 100 bytes of password here, but megabytes of garbage. See https://www.djangoproject.com/weblog/2013/sep/15/security/, also known as CVE-2013-1443.

"A password one megabyte in size, for example, will require roughly one minute of computation to check when using the PBKDF2 hasher."

[ Parent | on HN ]