News for hackers. Stuff that matters.
Re:Getting to Two Million Users as a One Woman Dev Team by vwkd on Tuesday December 17, 2024 @02:38PM (#42444499)
Ah, that's one of those websites that accept a password of any length without error, truncate it, and show you a "wrong password" the next time you try to log in. Then you go through password reset roulette until you find a short enough password that works. Don't do this.
Re:Getting to Two Million Users as a One Woman Dev Team by davedx on Tuesday December 17, 2024 @02:55PM (#42444665)
Wait wait. Why would you truncate it after input unless... you're storing it in plaintext?
Re:Getting to Two Million Users as a One Woman Dev Team by orblivion on Tuesday December 17, 2024 @03:18PM (#42444866)
Maybe the KDF gets really slow with a super long input.
Re:Getting to Two Million Users as a One Woman Dev Team by zja on Tuesday December 17, 2024 @03:08PM (#42444790)
You truncate passwords to prevent DOS
Re:Getting to Two Million Users as a One Woman Dev Team by lesuorac on Tuesday December 17, 2024 @03:10PM (#42444801)
Why not either show an error or do a client-side hash so there's a fixed length?
Re:Getting to Two Million Users as a One Woman Dev Team by orblivion on Tuesday December 17, 2024 @03:13PM (#42444825)
Showing an error is probably the right thing. Client-side mitigations wouldn't prevent a DOS.