818
Password length requirement
(feddit.org)
Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?
What? The password should only receive the hashed password, and that's gonna have a fixed length. What's stored in the db should have the exact same length whether the password is 2 characters long or 300. If the length of the password is in any way a consideration for your database, you've royally fucked up long before you got to that point.
"Your password may not contain any quotes or backslashes"
The answer is always a poorly coded everything.
You are expecting a lot from someone who thinks a password needs a low maximum length. It makes sense to limit password length to avoid dos attacks, but certainly to something longer than 16.
There are going to be very few hashing algorithms that can take a certain byte value and hash it down into a unique smaller byte value. If you miscoded the database and stored the hashed passwords into a value of a fixed length, you have to abide by that length without some trickery or cleaveriness. Is that not the case? Every time I've seen this limitation in wild code that has been the case.
That's true. But fortunately even the most basic hashing algorithms are more than enough to make worrying about these things pointless when it comes to passwords. You have to poorly implement everything by hand and make a series of bad calls to run into any issues.