the vast majority of mine are +50 characters - you are just wrong. the services which strictly limit the length are rare and their security is suspect since they should be hashing your input anyway
I mean it’s probably a good idea to have some kind of limit in place, because you really don’t want to deal with attackers trying to transfer megabytes worth of text in the password field and triggering an OOM on your end. But this limit should still be pretty high ofc.
the vast majority of mine are +50 characters - you are just wrong. the services which strictly limit the length are rare and their security is suspect since they should be hashing your input anyway
I mean it’s probably a good idea to have some kind of limit in place, because you really don’t want to deal with attackers trying to transfer megabytes worth of text in the password field and triggering an OOM on your end. But this limit should still be pretty high ofc.
for sure, but limiting it under 64 (the length of a sha256 hash) isn’t ideal at all
Didn’t know that. I stand corrected