Hacker News Reader

I'm always scared when I see the maximum length limit in password. I expect they just put clear text in their DB. Otherwise why would they limit it? Any key deviation or hash function will give the same length, regardless of the password length. Scary ...

View on HN

Maybe they're just trying to protect against denial-of-service attack through very long passwords[1]. Although 16 or 20 characters seem too short.

[1] https://www.djangoproject.com/weblog/2013/sep/15/security/

Yes, it's probably actually necessary to introduce some kind of limit to protect the server against hashdos-type attacks. Sadly though, Occam's razor suggests that the "20 char" limits and ridiculous "alphanumeric only" restrictions are caused not by some advanced considerations but by something much more stupid and incompetent.

The most frightening I've seen is interactive brokers. Passwords must be 6 to 8 characters, and symbols are forbidden. Strangely, usernames must be 8 or 9 characters (with additional restrictions: >2 letters, >2 digits, and must start with a letter).

Reply on news.ycombinator.com