Hacker News Reader

> I guess I don’t really understand the reasons any engineering team would limit password length

The bcrypt hashing algorithm doesn't work on inputs above ~60* characters or so. It will just silently trim your input. Better to do it yourself

*72 bytes

View on HN

In case any programmers read this, the better procedure, if you want to use bcrypt, is to hash the password with something else first, like SHA512, then feed the output into bcrypt.

what's the point in using bcrypt then? I researched this years ago and nothing ever convinced me it's not redundant

to slow down attackers who want to brute force your password hash. At least that was the idea. I guess it also includes the salt stuff built in so that it's harder for implementers to screw up.

Is a 9-order-of-magnitude slow down worth the trouble? I dunno. Maybe.

Interesting, I didn’t know that. My knowledge of cryptography is admittedly not great. 20 characters limit is pretty aggressive though.

Reply on news.ycombinator.com