I signed up and used a 30-character secure (alpha+symbols) password. The signup accepted the password, but now I'm unable to sign in, and the password reset isn't working. Help? My tagmask account name is dhess, and my contact info is in my profile.
I've encountered it elsewhere, and it's amazingly annoying. Nothing says fun like having to reset your password 4 times in a row because the website is silently modifying it.
If you use long passwords try removing the last character and seeing if you can still log in to your favorite website - on many you probably can.
In practice, what sort of process do you think would cause someone to implement this mistake? It seems obviously dumb to truncate something that you're hashing anyway. (To truncate it to something human relevant anyway, rather than like 512 characters).
That's why I asked if it was in some bugged library, it seems bizarre that the same totally boneheaded design would be recreated independently. It's not just that it truncates it, it's that it does it differently.
There's a disconnect afterward based on the string they store vs the string that's generated when you re-enter the too-long password. Maybe they do a server-side encryption on initial creation, but subsequent logins use a client-side encryption? I'm not sure.
EDIT: I'm trying to sign up with a 20-character password consisting of uppercase and lowercase letters, and numbers, but I keep getting this error (which has a typo):
"Username can contains only letters, numbers and underscores."