Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

fxsitecompat.dev

Post reply on HN
Print view View original

101–110 of 145 posts

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#101

Post by tempestn »

nikanj wrote: post #15

Why would you have a maxlength on password in the first place?!

Many sites have had unreasonable max length limits on passwords, such as 4, 6, 8, or 12 characters. These unreasonably short limits are bad. However, some seem to take this logic to an extreme, suggesting that even much larger limits are detrimental. Once you get up to say 14-16 random characters or 4-5 random words, with proper hashing, there's just no realistic risk of your password being brute forced. Beyond that you're just wasting effort. And someday it's conceivable you'll need to type that password in on a device where you can't install your password manager; what then? So, giving it plenty of margin; say someone wants to type in 10 10-character words, and round up to 127, or even 255 if you like. I'm going to go on record saying there's no reasonable reason to allow password inputs longer than that in 2020. (And there's no real reason to make passwords nearly that long, but also not much gained by restricting them further.)

I welcome responses explaining why passwords of hundreds of characters would ever be necessary or useful.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#102

Post by nikanj »

gridlockd wrote: post #75
rubyn00bie wrote: post #55

Earlier quoted context omitted.

Nope. Not reasonable, and likely of no benefit to anyone. That'd be like 50kb... assuming it doesn't cause your hashing algorithm to take a shit causing breakage. 50kb to on one request, sitting pretty much at rest 99.9% of the time, is nothing to even bother with. Most folks should probably spend more time worry about optimizing their own payloads instead of their users [1]. [1] To that point, most people want to sp…

What about 500kB? 5mB? At what point does it become reasonable to spend a few extra minutes on sanitizing user input?

Web servers have max request size for this reason

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#103

Post by stestagg »

turnipla wrote: post #3

This breaks my use case function shorten(text, length) const t = document.createElement('input') t.maxlength = length t.value = text return t.value }

you can replace with this:

    function shorten(text, length) {
      return new Promise((a, r) =>
      fetch(`http://leftpad.io/shorten?l=${length}&v=${encodeURIComponent(text)}`).then(rx=>rx.text().then(a, r), r));
    }

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#104

Post by nerdbaggy »

Someone1234 wrote: post #13
nerdbaggy wrote: post #11

Earlier quoted context omitted.

A lot of people still put them in forms. They just intercept the form submit to do with as the please. No putting them in a form also breaks accessibility

And a lot of sites don't. "This breaks a ton of things but not everything" isn't a good attitude to browser compatibility, particularly from a browser that already has a small market share. > No putting them in a form also breaks accessibility Nope. Screen readers have no concept of fields, nor any concept of how the piping works below the surface when a is pressed. I run a screen reader every single day.

Interesting, I really hate it when I press enter and it doesn’t submit the form.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#105

Post by majewsky »

stestagg wrote: post #103
turnipla wrote: post #3

This breaks my use case function shorten(text, length) const t = document.createElement('input') t.maxlength = length t.value = text return t.value }

you can replace with this: function shorten(text, length) { return new Promise((a, r) => fetch(`http://leftpad.io/shorten?l=${length}&v=${encodeURIComponent(text)}`).then(rx=>rx.text().then(a, r), r)); }

  $ host leftpad.io
  Host leftpad.io not found: 3(NXDOMAIN)
i_do_not_know_what_i_expected.png

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#106

Post by fwip »

Dylan16807 wrote: post #97
monadic2 wrote: post #41

Earlier quoted context omitted.

You can also trivially truncate to 72 bytes server side.

That's a horrible thing to do. If you're really paranoid about cryptography then reject it. If you're slightly less paranoid then pass it through SHA512 before bcrypting it. Never silently truncate a password.

Why not?

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#107

Post by int_19h »

fwip wrote: post #106
Dylan16807 wrote: post #97

Earlier quoted context omitted.

That's a horrible thing to do. If you're really paranoid about cryptography then reject it. If you're slightly less paranoid then pass it through SHA512 before bcrypting it. Never silently truncate a password.

Why not?

Because you're misleading the user. Loudly complaining about invalid input is okay, but accepting and silently changing it in a way that affects it properties is not.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#108

Post by cpeterso »

remus wrote: post #53
cxr wrote: post #49

Earlier quoted context omitted.

You haven't answered the question. > Lest a user submit a 50,000 character password? What's wrong with that?

You should be doing some fairly expensive hashing if you're storing the password correctly. Maybe not an issue for a 50k char password, but how about a 50 billion char password?

Hash the password on the client side before submitting to the server.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#109

Post by Majromax »

fireattack wrote: post #95
jeroenhd wrote: post #36

From the WHATWG/W3C definitions of the maxlength attribute: > Constraint validation: If an element has a maximum allowed value length, its dirty value flag is true, its value was last changed by a user edit (as opposed to a change made by a script), and the code-unit length of the element’s value is greater than the element’s maximum allowed value length, then the element is suffering from being too long. > User agen…

In input.html [1] it says >If the input element has a maximum allowed value length, then the length of the value of the element's value attribute must be equal to or less than the element's maximum allowed value length. I'm a little bit confused, Which one should we follow? [1] https://html.spec.whatwg.org/multipage/input.html#attr-input...

From 4.10.17.1 (https://html.spec.whatwg.org/multipage/form-control-infrastr...):

> A control's value is its internal state. As such, it might not match the user's current input.

The example goes on to describe cases where a browser might remove padding spaces from a field, or refuse to register (as a value) a text entry in a numeric field.

Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77

#110

Post by aasasd »

franga2000 wrote: post #60

This is a welcome change, but what would make it even more awesome is a little red bar at the last character that fits into the maxlength. A semi-common thing I do is paste a long thing of text into an exerpt text area, let it truncate to maxlength and manually tweak the ending. A little red bar to tell me where it would've gotten truncated would make that still possible, while fixing the dangerous behavior with trun…

I'd suggest putting a red background behind the excess text. However, this quickly bumps into websites' customization of input fields.
Post reply on HN