this post was submitted on 26 Aug 2024
464 points (95.5% liked)

Mildly Infuriating

35736 readers
1939 users here now

Home to all things "Mildly Infuriating" Not infuriating, not enraging. Mildly Infuriating. All posts should reflect that.

I want my day mildly ruined, not completely ruined. Please remember to refrain from reposting old content. If you post a post from reddit it is good practice to include a link and credit the OP. I'm not about stealing content!

It's just good to get something in this website for casual viewing whilst refreshing original content is added overtime.


Rules:

1. Be Respectful


Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.

Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.

...


2. No Illegal Content


Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.

That means: -No promoting violence/threats against any individuals

-No CSA content or Revenge Porn

-No sharing private/personal information (Doxxing)

...


3. No Spam


Posting the same post, no matter the intent is against the rules.

-If you have posted content, please refrain from re-posting said content within this community.

-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.

-No posting Scams/Advertisements/Phishing Links/IP Grabbers

-No Bots, Bots will be banned from the community.

...


4. No Porn/ExplicitContent


-Do not post explicit content. Lemmy.World is not the instance for NSFW content.

-Do not post Gore or Shock Content.

...


5. No Enciting Harassment,Brigading, Doxxing or Witch Hunts


-Do not Brigade other Communities

-No calls to action against other communities/users within Lemmy or outside of Lemmy.

-No Witch Hunts against users/communities.

-No content that harasses members within or outside of the community.

...


6. NSFW should be behind NSFW tags.


-Content that is NSFW should be behind NSFW tags.

-Content that might be distressing should be kept behind NSFW tags.

...


7. Content should match the theme of this community.


-Content should be Mildly infuriating.

-At this time we permit content that is infuriating until an infuriating community is made available.

...


8. Reposting of Reddit content is permitted, try to credit the OC.


-Please consider crediting the OC when reposting content. A name of the user or a link to the original post is sufficient.

...

...


Also check out:

Partnered Communities:

1.Lemmy Review

2.Lemmy Be Wholesome

3.Lemmy Shitpost

4.No Stupid Questions

5.You Should Know

6.Credible Defense


Reach out to LillianVS for inclusion on the sidebar.

All communities included on the sidebar are to be made in compliance with the instance rules.

founded 2 years ago
MODERATORS
 

Just take the string as bytes and hash it ffs

you are viewing a single comment's thread
view the rest of the comments
[–] magic_lobster_party@fedia.io 197 points 3 months ago (7 children)

There’s a special place in hell for those who set an upper limit in password lengths.

[–] CosmicTurtle0@lemmy.dbzer0.com 61 points 3 months ago (4 children)

I sort of get it. You don't want to allow the entire work of Shakespeare in the text field, even if your database can handle it.

16 characters is too low. I'd say a good upper limit would be 100, maybe 255 if you're feeling generous.

[–] owsei@programming.dev 89 points 3 months ago (21 children)

The problem is that you (hopefully) hash the passwords, so they all end up with the same length.

[–] expr@programming.dev 57 points 3 months ago (2 children)

At minimum you need to limit the request size to avoid DOS attacks and such. But obviously that would be a much larger limit than anyone would use for a password.

[–] owsei@programming.dev 27 points 3 months ago

Also rate of the requests. A normal user isn't sending a 1 MiB password every second

[–] JackbyDev@programming.dev 4 points 3 months ago (1 children)

What's a sensible limit. 128 bytes? Maybe 64?

[–] owsei@programming.dev 8 points 3 months ago

I'd say 128 is understandable, but something like 256 or higher should be the limit. 64, however, is already bellow my default in bitwarden

load more comments (20 replies)
[–] i_am_not_a_robot@feddit.uk 24 points 3 months ago (3 children)

The eBay password limit is 256 characters.

They made the mistake of mentioning this when I went to change my password.

Guess how many characters my eBay password has?

[–] abfarid@startrek.website 28 points 3 months ago (5 children)
[–] JackbyDev@programming.dev 6 points 3 months ago

Damn signed bytes!

load more comments (4 replies)
[–] n3cr0@lemmy.world 11 points 3 months ago

Just paste it in here and I count the characters for you.

[–] Saik0Shinigami@lemmy.saik0.com 17 points 3 months ago (5 children)

I sort of get it. You don’t want to allow the entire work of Shakespeare in the text field, even if your database can handle it.

You don't store the original text. You store the hash of it. If you SHA512 it, anything that's ever given in the password field will always be 64Bytes.

The only "legit" reason to restrict input to 16 character is if you're using an encryption mechanism that just doesn't support more characters as an input. However, if that's the case, that's a site I wouldn't want to use to begin with if at all possible.

[–] blackstrat@lemmy.fwgx.uk 3 points 3 months ago (6 children)

The resulting hash will always be the same size, but you don't want to have an unlimited upper bound otherwise I'm using a 25GB blueray rip as my password and your service is going to have to calculate the hash of that whenever I login.

Sensible upper bounds are a must to provide a reliable service not open to DDOS exploits.

load more comments (6 replies)
load more comments (4 replies)
[–] MangoPenguin@lemmy.blahaj.zone 5 points 3 months ago* (last edited 3 months ago) (1 children)

Even 255 bytes with 10 million entries is only ~2.6GB of data you need to store, and if you have 10 million users the probably $1 a month extra that would cost is perfectly fine.

I suppose there may be a performance impact too since you have to read more data to check the hash, but servers are so fast now it doesn't seem like that would be significant unless your backend was poorly made.

[–] intensely_human@lemm.ee 3 points 3 months ago (1 children)

Yeah but what if I have one user with 9.9 million accounts? That bastard

[–] Olmai@lemmy.world 3 points 3 months ago
[–] CeruleanRuin@lemmings.world 53 points 3 months ago (3 children)

Oh and also, "change this every four weeks please."

Okay then. NEW PASSWORD: pa$$word_Aug24

[–] fritolay@lemmy.one 20 points 3 months ago (1 children)

Invalid password, maximum 13 characters.

[–] JustARegularNerd@lemmy.world 6 points 3 months ago (1 children)
[–] dch82@lemmy.zip 7 points 3 months ago (1 children)

Only a maximum of 3 digits allowed

load more comments (1 replies)
[–] CaptPretentious@lemmy.world 4 points 3 months ago (1 children)

Yep. Having to have requirements that doesn't flow with people very well and requiring constant updates, people WILL find shortcuts. In the office, I've seen sheets of paper with the password written down, I've seen sticky notes, I've seen people put them in notepad/word so they could just copy paste.

This is made worse, because you have to go out of your way for a password manager, which means you need to know what that is. And you need a good one because there has been (and I'm going to generalize here) problems with some password managers in the past. And for work, they have to allow a password manager for that to even be an option. Which you then end up with this security theater.

[–] rekabis@lemmy.ca 3 points 3 months ago

And you need a good one because there has been problems with some password managers in the past.

coughLastPasscough

“Problems”. What an delightfully understated term to use.

[–] Discover5164@lemm.ee 3 points 3 months ago (2 children)

the password cannot contains the same sequences of characters as the old password.

and i have seen this requirement in a service that requires changing it every month for some reasons.

and this is to manage a government digital identity that allows to log it in all governments websites.

load more comments (2 replies)
[–] Showroom7561@lemmy.ca 18 points 3 months ago (1 children)

Reasonable upper limits are OK. But FFS, the limit should be enough to have a passphrase with 4 or 5 words in it.

[–] lauha@lemmy.one 6 points 3 months ago (2 children)

Usually 256 bit hash is used. 256 bits is 32 bytes or 32 characters. Of course you are losing some entropy because character set is limited, but 32 characters is beyond reasonable anyway.

[–] Lojcs@lemm.ee 5 points 3 months ago* (last edited 3 months ago) (1 children)

The eff passphrase generator has about 2.5 bits of entropy per character (without word separators). Eff recommends 6 word passphrases, and with an avg word length of 7, that's (only) 79.45 bits of entropy that won't even fit in the 32 characters. If there wasn't a password length limit it would be possible to saturate the hash entropy with a 20+ word & 102+ char passphrase.

load more comments (1 replies)
load more comments (1 replies)
[–] needanke@feddit.org 7 points 3 months ago (3 children)

Just opened a PayPal account and their limit is 20. Plus the only 2fa option is sms 🙃.

[–] JustARegularNerd@lemmy.world 10 points 3 months ago (1 children)

I just double checked and I have TOTP enabled for my PayPal account so it should be an option.

I just found this support article of theirs and it says it can only be enabled through their website and not through the app (why?!) so you might be running into that?

https://www.paypal.com/uk/cshelp/article/what-is-2-step-verification-and-how-do-i-turn-it-on-or-off-help167

[–] ZeldaFreak@lemmy.world 5 points 3 months ago

Probably people would struggle to scan the QR Code with their smartphone. I think most apps can scan it from a image but obviously this would be unsafe, especially when people sync their screenshot to the cloud.

I can 100% confirm totp exist for PayPal, because I'm using it.

[–] Summzashi@lemmy.one 4 points 3 months ago

That last part definitely isn't true.

load more comments (1 replies)
[–] Tamkish@programming.dev 6 points 3 months ago* (last edited 3 months ago) (1 children)

"Your password needs to be less than 65k characters long" >:(

[–] HK65@sopuli.xyz 5 points 3 months ago (1 children)

Darn, can't use the entire Bee Movie on Blu-Ray as my password then.

load more comments (1 replies)
[–] GissaMittJobb@lemmy.ml 5 points 3 months ago

Basically guaranteed to be a clear text offender

[–] rekabis@lemmy.ca 2 points 3 months ago

Especially since it takes more effort to limit it than leave it wide open for whatever length of password a user wants to use.

nvarchar(max) is perfect to store the hashed copy.