Just take the string as bytes and hash it ffs

  • Saik0@lemmy.saik0.com
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    2 months ago

    Sensible upper bounds are a must to provide a reliable service not open to DDOS exploits.

    If I choose to make you hash it in browser first… Then I simply don’t care do I? I can hash/salt again when I get your hash. Edit: There are other answers to the “DDOS problem” that don’t require upper bounds.

    • blackstrat@lemmy.fwgx.uk
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      edit-2
      2 months ago

      You can make a client hash it, but if you don’t reject large inputs to your API a client can send enough data to DOS you anyway.

      • Saik0@lemmy.saik0.com
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        And a meteor can hit my server the exact time you send your hash which will DOS you/others as well. What’s your point.

        The thread is talking about what it takes to store passwords. There is not DOS potential in a well designed system. Just because you want to arbitrarily conjure up bullshit doesn’t make that any less true.

        Rejecting large inputs != disallowing users to have large passwords. Why are you attempting to straw-man me here?

        • blackstrat@lemmy.fwgx.uk
          link
          fedilink
          English
          arrow-up
          1
          ·
          2 months ago

          You were saying the input size doesn’t matter because you only store the hash which is always the same size. What I’m saying is that the input size really does matter.

          You absolutely should set upper limits on all input fields because it will be abused if you don’t. Systems should validate their inputs, passwords included

          • Saik0@lemmy.saik0.com
            link
            fedilink
            English
            arrow-up
            1
            ·
            2 months ago

            And I showed you a way that we can make it so it doesn’t matter.

            Force local hash -> Hash/salt what you get. Password can be a million characters long. You’ll only ever get like 128 characters.

            Nothing I talked about said to not validate inputs. Just that we don’t have to limit a persons password selection.