Re:Why your password can’t have symbols—or be longer than 16...
by shawabawa3 on Monday April 29, 2013 @03:18PM
(#5628077)
But that isn't the real "Support" cost it is DDOS attacks.
Computing a hash of a 128 character password is more expensive than doing a 16 character password.
I'm sorry but this is bullshit for so many reasons.
1. There is no way hashing 128 characters instead of 16 is so much more expensive that it enables an otherwise infeasible DDOS
2. Passwords should be salted before hashing, so you're adding (hopefully) at least 30 characters of salt to the password anyway.
3. Hashing should be expensive. You should be using bcrypt or some other algorithm with a work factor to protect against brute forcing if your database is compromised.
The real reason is likely a mix of legacy code and extra support from people forgetting passwords, and just plain ignorance from the developers
1. There is no way hashing 128 characters instead of 16 is so much more expensive that it enables an otherwise infeasible DDOS
2. Passwords should be salted before hashing, so you're adding (hopefully) at least 30 characters of salt to the password anyway.
3. Hashing should be expensive. You should be using bcrypt or some other algorithm with a work factor to protect against brute forcing if your database is compromised.
The real reason is likely a mix of legacy code and extra support from people forgetting passwords, and just plain ignorance from the developers