This next version is quite important as it brings important fixes.
Bugs: https://enterprise.lemmy.ml/c/actualbugs018
cross-posted from: https://sh.itjust.works/post/300197
Enterprise: enterprise.lemmy.ml - Thank you!
This next version is quite important as it brings important fixes.
Bugs: https://enterprise.lemmy.ml/c/actualbugs018
cross-posted from: https://sh.itjust.works/post/300197
Enterprise: enterprise.lemmy.ml - Thank you!
Some password hashing methods has max characters length. For example Bcrypt has 72 max length. This is mostly to avoid taking too much time encrypting user input.
If there’s no limit someone can technically froze the server by inputting large password (not because the request is big, but the process is exponentially takes more CPU process the longer characters it needs to compute)
Having only ever implemented PBKDF2 this is a good insight as well. This limitation does not seem to be an issue with more modern hashing algorithms, but I can see where limiting the size to a reasonable amount for purposes of having an upper bound on performance would be needed.
That’s an interesting attack vector. Thanks for the insight.