For some reason I read that as Fortran 77.
Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
111–120 of 145 posts
Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#112Earlier quoted context omitted.
You should be doing some fairly expensive hashing if you're storing the password correctly. Maybe not an issue for a 50k char password, but how about a 50 billion char password?
> You should be doing some fairly expensive hashing if you're storing the password correctly Exactly. You aren't storing those bytes. > Maybe not an issue for a 50k char password, but how about a 50 billion char password? We're back to a place where the response to the question is another question, but it just ends up failing to give an answer, opting to just keep throwing out larger and larger numbers. My response:…
[deleted]
Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#113Why would you have a maxlength on password in the first place?!
Many sites have had unreasonable max length limits on passwords, such as 4, 6, 8, or 12 characters. These unreasonably short limits are bad. However, some seem to take this logic to an extreme, suggesting that even much larger limits are detrimental. Once you get up to say 14-16 random characters or 4-5 random words, with proper hashing, there's just no realistic risk of your password being brute forced. Beyond that…
Most password managers don't even let you generate passwords longer than 50-100 characters anyway.
So long as you're using a password manager that generates unique passwords for every site you visit, there's no real reason to have those generated passwords be particularly long. Ten random characters (with enforced complexity rules) is more than ample for any normal, plausible scenario. If you're a high value individual, you might want to eliminate any doubt and use 12–15 characters. Exceeding that is security masturbation—but also lacks any downside so long as you never have to transcribe it.
Or if you fear worldwide retribution, 20 characters is enough to withstand all compute power on earth suddenly dedicated to the task of cracking your Spotify password.
The only scenario I can imagine where the length of random+unique passwords matters AT ALL is if (1) the website uses a very weak/naive password hash implementation (2) a hacker manages to acquire a copy of your hashed password and (3) the account is of sufficiently high value to justify a large investment in computing resources to brute force the hash. Hitting that trifecta is very unlikely indeed.
Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#114Earlier quoted context omitted.
That's a horrible thing to do. If you're really paranoid about cryptography then reject it. If you're slightly less paranoid then pass it through SHA512 before bcrypting it. Never silently truncate a password.
Why not?
A year after you leave the job, your team is told to build a new auth backend against the database, using a different bcrypt implementation. They just know to use bcrypt, but not about your truncation hack. The deployment is a success.
Two weeks later, an angry user (the only one with a 100-digit password) complains that they can't log in anymore. The guy is the company's best-paying customer; the boss is furious. The whole team goes on a wild goose chase for two days and nights just to find out what happened, as clearly there's nothing wrong with their code.
A few years later, a former colleague shares the episode on HN. As you read the comments, it dawns on you that the idiot antagonist of the story is you. In this moment, you are enlightened.
Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#115This breaks my use case function shorten(text, length) const t = document.createElement('input') t.maxlength = length t.value = text return t.value }
Maybe you should submit a pull request to the npm package where that code lives.
come to think about it.. You don't even need to!
If you dockerize a chrome instance to start an electron app, you can then use it as a miroservice to truncate!
I even has the possibility to inspect the element and actually see what's going on.
Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#116Earlier quoted context omitted.
you can replace with this: function shorten(text, length) { return new Promise((a, r) => fetch(`http://leftpad.io/shorten?l=${length}&v=${encodeURIComponent(text)}`).then(rx=>rx.text().then(a, r), r)); }
$ host leftpad.io Host leftpad.io not found: 3(NXDOMAIN) i_do_not_know_what_i_expected.png
haha, too bad those .io domains are so expensive, would make a hilarious joke
Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#117Earlier quoted context omitted.
Maybe you should submit a pull request to the npm package where that code lives.
come to think about it.. You don't even need to! If you dockerize a chrome instance to start an electron app, you can then use it as a miroservice to truncate! I even has the possibility to inspect the element and actually see what's going on.
> If you dockerize a chrome instance to start an electron app, you can then use it as a miroservice to truncate!
Needs more Kubernetes and a service mesh.
Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#118Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#119Earlier quoted context omitted.
You should be doing some fairly expensive hashing if you're storing the password correctly. Maybe not an issue for a 50k char password, but how about a 50 billion char password?
Hash the password on the client side before submitting to the server.
This still requires you to hash the hash on the server, otherwise the hash becomes the password and learning the hash allows you to login. But hashing the hash is actually better anyway because it makes it so that the server never even has the plaintext of the password, which can be dangerous in itself when users use the same password on multiple sites.
Re: Text exceeding maxlength will no longer be truncated when pasted in Firefox 77
#120Earlier quoted context omitted.
That's a horrible thing to do. If you're really paranoid about cryptography then reject it. If you're slightly less paranoid then pass it through SHA512 before bcrypting it. Never silently truncate a password.
Why not?
Suppose a user whose first name is Jonathan and whose wife's name is Katherine uses the password "JonathanAndKatherineLU8zWNmkimQanaSdPdqatWJEWR8goyyhdtQeqZOp2+0" and you truncate it to 20 characters.