News for hackers. Stuff that matters.

A comment on We'd lose our security certificate if we allowed pasting. Parent comment

Re:We'd lose our security certificate if we allowed pasting by lmm on Tuesday May 06, 2014 @08:10AM (#7703922)
If you're hashing it who cares if someone wants to submit a 250MB password? They'll only be slowing their own session down - what I store in the database is always 256 bits either way.
[ Parent | on HN ]
Re:We'd lose our security certificate if we allowed pasting by calpaterson on Tuesday May 06, 2014 @09:16AM (#7704209)
Because your app has to load it all into memory. Submitting many, very large payloads is a well known denial-of-service attack
[ Parent | on HN ]
Re:We'd lose our security certificate if we allowed pasting by michaelt on Tuesday May 06, 2014 @09:37AM (#7704326)
Like a good developer, you run passwords through a slow hash function. This leaves you vulnerable to denial of service by wasting CPU hashing huge passwords: http://arstechnica.com/security/2013/09/long-passwords-are-g...
[ Parent | on HN ]
Re:We'd lose our security certificate if we allowed pasting by frou_dh on Tuesday May 06, 2014 @08:57AM (#7704111)
Predictably this just regresses to what constitutes a big number. Take your pick for one that would cause noteworthy resource consumption in a given system.
[ Parent | on HN ]