Just take the string as bytes and hash it ffs
this post was submitted on 26 Aug 2024
464 points (95.5% liked)
Mildly Infuriating
35488 readers
480 users here now
Home to all things "Mildly Infuriating" Not infuriating, not enraging. Mildly Infuriating. All posts should reflect that.
I want my day mildly ruined, not completely ruined. Please remember to refrain from reposting old content. If you post a post from reddit it is good practice to include a link and credit the OP. I'm not about stealing content!
It's just good to get something in this website for casual viewing whilst refreshing original content is added overtime.
Rules:
1. Be Respectful
Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.
Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.
...
2. No Illegal Content
Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.
That means: -No promoting violence/threats against any individuals
-No CSA content or Revenge Porn
-No sharing private/personal information (Doxxing)
...
3. No Spam
Posting the same post, no matter the intent is against the rules.
-If you have posted content, please refrain from re-posting said content within this community.
-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.
-No posting Scams/Advertisements/Phishing Links/IP Grabbers
-No Bots, Bots will be banned from the community.
...
4. No Porn/Explicit
Content
-Do not post explicit content. Lemmy.World is not the instance for NSFW content.
-Do not post Gore or Shock Content.
...
5. No Enciting Harassment,
Brigading, Doxxing or Witch Hunts
-Do not Brigade other Communities
-No calls to action against other communities/users within Lemmy or outside of Lemmy.
-No Witch Hunts against users/communities.
-No content that harasses members within or outside of the community.
...
6. NSFW should be behind NSFW tags.
-Content that is NSFW should be behind NSFW tags.
-Content that might be distressing should be kept behind NSFW tags.
...
7. Content should match the theme of this community.
-Content should be Mildly infuriating.
-At this time we permit content that is infuriating until an infuriating community is made available.
...
8. Reposting of Reddit content is permitted, try to credit the OC.
-Please consider crediting the OC when reposting content. A name of the user or a link to the original post is sufficient.
...
...
Also check out:
Partnered Communities:
Reach out to LillianVS for inclusion on the sidebar.
All communities included on the sidebar are to be made in compliance with the instance rules.
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
There’s a special place in hell for those who set an upper limit in password lengths.
I sort of get it. You don't want to allow the entire work of Shakespeare in the text field, even if your database can handle it.
16 characters is too low. I'd say a good upper limit would be 100, maybe 255 if you're feeling generous.
The problem is that you (hopefully) hash the passwords, so they all end up with the same length.
At minimum you need to limit the request size to avoid DOS attacks and such. But obviously that would be a much larger limit than anyone would use for a password.
Also rate of the requests. A normal user isn't sending a 1 MiB password every second
What's a sensible limit. 128 bytes? Maybe 64?
I'd say 128 is understandable, but something like 256 or higher should be the limit. 64, however, is already bellow my default in bitwarden
The eBay password limit is 256 characters.
They made the mistake of mentioning this when I went to change my password.
Guess how many characters my eBay password has?
-1?
Damn signed bytes!
0*
I'm not sure what you're implying with this. But how did you dig this up anyway?
255=-1, 256=0
btw, the internet never forgets
Oh you mean that the number 256 overflows into 0 in 8-bit range. My joke was leaning more into the idea that when you use all 256 possible bit combinations (
1111 1111), it can represent -1 in signed integer formats. Even though 255 is the highest number you can directly represent, there are still 256 total combinations, including zero, so IMO, the joke works.Just paste it in here and I count the characters for you.
69
oh yeah
You don't store the original text. You store the hash of it. If you SHA512 it, anything that's ever given in the password field will always be 64Bytes.
The only "legit" reason to restrict input to 16 character is if you're using an encryption mechanism that just doesn't support more characters as an input. However, if that's the case, that's a site I wouldn't want to use to begin with if at all possible.
The resulting hash will always be the same size, but you don't want to have an unlimited upper bound otherwise I'm using a 25GB blueray rip as my password and your service is going to have to calculate the hash of that whenever I login.
Sensible upper bounds are a must to provide a reliable service not open to DDOS exploits.
If I choose to make you hash it in browser first... Then I simply don't care do I? I can hash/salt again when I get your hash. Edit: There are other answers to the "DDOS problem" that don't require upper bounds.
You can make a client hash it, but if you don't reject large inputs to your API a client can send enough data to DOS you anyway.
And a meteor can hit my server the exact time you send your hash which will DOS you/others as well. What's your point.
The thread is talking about what it takes to store passwords. There is not DOS potential in a well designed system. Just because you want to arbitrarily conjure up bullshit doesn't make that any less true.
Rejecting large inputs != disallowing users to have large passwords. Why are you attempting to straw-man me here?
You were saying the input size doesn't matter because you only store the hash which is always the same size. What I'm saying is that the input size really does matter.
You absolutely should set upper limits on all input fields because it will be abused if you don't. Systems should validate their inputs, passwords included
And I showed you a way that we can make it so it doesn't matter.
Force local hash -> Hash/salt what you get. Password can be a million characters long. You'll only ever get like 128 characters.
Nothing I talked about said to not validate inputs. Just that we don't have to limit a persons password selection.
I'll admit I kind of typed this without thinking it through. In a secured site, the password would be hashed and salted before storing in the database.
Depending on where you're doing the hashing, long strings might still slow you down. That being said, from a security standpoint, any gain in entropy by adding characters would be negligible past a certain point. I don't remember what that number is but it certainly isn't in the thousands.
That would be completely based on the hash being used. In the example above I showed SHA512 which is 64Bytes. If we're using ASCII (7 bit per character) as our input then 64 Bytes is just over 73(73.1428...) characters. After that you're losing data in the hashing process and by that effect it would be negligible... (There's some wiggle room here in that we can't type hidden ASCII characters so some passwords over 73 characters would fill those spaces... but detecting collisions is silly and non-trivial... better to just not worry about those at all.)
Extended ASCII would be same premise, just 64 characters instead of 73.
The reality is that nobody is using much more than 64 Bytes for their hashing algorithm for passwords... 64 characters is a good number to max out most of them. Databases don't need to store much at all regardless of the length of your actual password. If you're developing an app you can set the database to limit based on the algorithms you're using. If you have no idea what the web-dev will actually use... then 128 characters on the database field is probably pretty safe (88 I think if storing as Base64, 128 if storing in Hex. Could be off by one here.) and literally trivial to store. The point being that even if every one of your users submitted 10000 character long passwords... that's irrelevant and trivial for storage as hashes.
There's a more practical limit. Using US standard keyboard symbols, a 40 char password is about as secure as a 256-bit block cipher key. That's impossible to break due to thermodynamic limits on computing.
The reason to put a high char limit is to mitigate DoS attacks. It can still be a few hundred chars.
you might compare 1,000 to 10,000, but more like 0.1% to 0.01%
meaning of this? no. bad grammar.
Even 255 bytes with 10 million entries is only ~2.6GB of data you need to store, and if you have 10 million users the probably $1 a month extra that would cost is perfectly fine.
I suppose there may be a performance impact too since you have to read more data to check the hash, but servers are so fast now it doesn't seem like that would be significant unless your backend was poorly made.
Yeah but what if I have one user with 9.9 million accounts? That bastard
Account georg