Then you can generate a password so big and complex, the site or app starts begging you to stop. At that moment, you can say “ur password system is weak.”
Careful with that. Sometimes a site will allow you to use some stupid long password when you sign up, but then it turns out that some other version of the site or an app for it on other platforms won’t accept a password that long!
It just says “wrong password” and you’ll be guessing at which random character did it cut the password. Luckily sometimes it’s just a stupid html verification form that can be disabled in the console and be submitted anyway.
My e-mail provider does this. I wanted to change my password to some 64 character long generated string. It accepted, but I could not log in after that. After a few tries, I found the reason and, after another few tries, also the limit at which it gets truncated: 16 characters! God, how I hate them for this…
Perhaps even worse than this is when the hash allows you to enter what you think is your full password, but as long as the first characters are a match then it will succeed.
16 characters is probably fine as far as passwords go, but if the site is secretly truncating from 16 down to, say, 7 and still allows you to sign in, you don’t even realize that your password isn’t nearly as secure as you thought it was.
Then you can generate a password so big and complex, the site or app starts begging you to stop. At that moment, you can say “ur password system is weak.”
Careful with that. Sometimes a site will allow you to use some stupid long password when you sign up, but then it turns out that some other version of the site or an app for it on other platforms won’t accept a password that long!
That’s okay, I just want to hear “it’s too big”
It just says “wrong password” and you’ll be guessing at which random character did it cut the password. Luckily sometimes it’s just a stupid html verification form that can be disabled in the console and be submitted anyway.
In my experience it always cuts off the characters at the end.
I mentioned lemmy passwords in the other reply. Guess how I found out
Or alternatively, it allows you to enter a password as long as you like, but on their end it gets truncated.
My e-mail provider does this. I wanted to change my password to some 64 character long generated string. It accepted, but I could not log in after that. After a few tries, I found the reason and, after another few tries, also the limit at which it gets truncated: 16 characters! God, how I hate them for this…
Perhaps even worse than this is when the hash allows you to enter what you think is your full password, but as long as the first characters are a match then it will succeed.
16 characters is probably fine as far as passwords go, but if the site is secretly truncating from 16 down to, say, 7 and still allows you to sign in, you don’t even realize that your password isn’t nearly as secure as you thought it was.
In lemmy, password length is capped to 60. Weak.