Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The point of the upstream post was that bcrypt implementations often already truncate your passwords to 72 characters.

If you switch to a different bcrypt implementation that does/does not truncate at 72 characters, the server-side truncation keeps all those 73 character passwords working.

If the server-side truncation were not in place, you'd get angry users.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: