Comments (4)
Because a.) in reality, nobody would use such long passwords and b.) to prevent database field flooding. People could turn off max POST size in their browsers (or send a naked POST request) and provide a password with 10000000000 chars, what would kill the database. To keep it clean, the db field and the password are limited to 64 chars.
from huge.
But the password is hashed at a fixed length, so the database won’t be killed. And — 100% truthfully here — my Gmail password is a 97-character phrase. =) There is the possibility of DoS with the hash, but the length of the password is not that important under PHP’s server-enforced POST limit. And even then, you can cut it to something that just avoids crazy people like me; say, 1024.
from huge.
Boom, good point! The char limit was intented to be used only for the username, but somehow i started to use it on passwords too. I'll fix that! Merci...
from huge.
New limit is now 1024. Just to be sure, maybe some people use this without proper apache/php settings, so doing a crypt calculation with thousands of chars might slow down the system.
from huge.
Related Issues (20)
- [QUESTION] PostgreSQL HOT 4
- MySQL connection error HOT 3
- [NOTE] bootstrap.sh HOT 1
- ❤ ! HOT 1
- Changes for Postgres
- Calling model on view?
- Session validation improvement
- Q
- Configuration files
- Configuration files HOT 5
- New user registration issue
- A question about data sent to the view from the controllers HOT 1
- in the encryption.php file HOT 1
- Pagination Class
- Agregar AJAX al proyecto
- Trying to get in touch regarding a security issue HOT 4
- ErrorController redeclaration HOT 2
- PHP code analizing does not work. HOT 3
- Connection problems with MySql (MariaDb)
- Contact details
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from huge.