Hacker News Reader

Wait wait. Why would you truncate it after input unless... you're storing it in plaintext?

Maybe the KDF gets really slow with a super long input.

You truncate passwords to prevent DOS

Why not either show an error or do a client-side hash so there's a fixed length?

Showing an error is probably the right thing. Client-side mitigations wouldn't prevent a DOS.