Re:Okta Bcrypt incident lessons for designing better APIs
by unethical_ban on Wednesday February 05, 2025 @07:47PM
(#42957553)
On one hand, I have never heard of a password hashing algorithm that truncated to 72 characters. I assumed all one-way hashing functions were arbitrary length input. "arbitrary input -> fixed output" has always been part of the definition of hash, to me.
On the other hand, I'm not a security developer at Okta.
On the other hand, I'm not a security developer at Okta.