Re:Ubisoft hacked, account data compromised
by Pxtl on Tuesday July 02, 2013 @01:21PM
(#5979316)
None that wouldn't be better handled with a warning of "excessive password complexity, we're not sure you'll remember this". Even truncating all password entries (create/change and auth) and simply taking the used subset would be better than blocking me from using my intended password.
[ Parent
| on HN ]
Re:Ubisoft hacked, account data compromised
by trothoun on Tuesday July 02, 2013 @03:15PM
(#5980112)
Hmmm... if your password was
password30jf0sd09jga09ja0i9sdfasi09djf0-sdj9faspiodjf
and they only used the first 8 characters, you'd think you had a strong password, but would really have a very weak password. Hashing then truncating as discussed above would be much safer.
Really no reason to truncate after hashing. The output size of any cryptographic hash function should be more than small enough to send down the wire and hash again properly.
Really though, just reject passwords over a few KB. Nobody will ever notice that limit except for people trying to fuck with you.