Comment on My password is not accepted because it is too long

Crashumbc@lemmy.world ⁨5⁩ ⁨days⁩ ago

• Kissaki@feddit.org ⁨5⁩ ⁨days⁩ ago

  Do you check on login attempt protection behavior before creating accounts, and then choose your password length accordingly - longer or shorter?

  source
• JcbAzPx@lemmy.world ⁨5⁩ ⁨days⁩ ago

  That doesn’t help if someone got a list of their hashes somehow. Then an attacker can use their own system to crack them.

  And that’s if they aren’t just storing the passwords as clear text to begin with, which length limitations are often a sign of.

  source
• _skj@lemmy.world ⁨5⁩ ⁨days⁩ ago

  Such a small max length is a good indicator they aren’t handling passwords correctly. A modern website should be able to send and hash kilobytes of text without the user seeing a significant delay. Having a max size like this sounds like they are storing the password as text instead of a hash.

  Or some dumb project manager said passwords longer than 24 characters look bad in the UI and wanted the limit.

  source