Post #4370926
2026-08-04 02:59 UTC
MyGov email me to let me know I'll need to change my password next time I log in.
“That's not how security works but sure.”
Your password can not exceed 64 characters
“You're storing passwords in plain text, aren't you?”
Your password can only contain a subset of special characters
“You're not confident you are escaping SQL queries correctly, are you?”
Replies (1)
-
@firstyear@infosec.exchange 2026-08-04 04:40
@peterwilsoncc@aus.social The 64 char limit is to prevent a KDF DOS attack during authentication. Bcrypt limits input to 72 bytes for a similar reason.