this post was submitted on 30 May 2025
115 points (99.1% liked)
privacy
4296 readers
72 users here now
Big tech and governments are monitoring and recording your eating activities. c/Privacy provides tips and tricks to protect your privacy against global surveillance.
Partners:
- community.nicfab.it/c/privacy
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Hashing takes up cpu time
Oh my goodness.
I am very skeptical of this reasoning. If hashing of 256-character passphrases, or even 2560-character passphrases, consumes enough CPU time to risk overloading your system, then I think your are in an infinitesimal niche worthy of a detailed write-up.
If you're worried about that load, just wait until you learn about key derivation functions.
So you were questioning a password limit of 256 chars.
Let's say we do not impose a limit because we're not worried about anything. We now get hit by a botnet trying to create accounts or login in thousands at the same time.
Say we're using Argon2id. This is obviously subjective to hw and parameters, but let's say 8k characters take 5 seconds of (1) cpu time on your server.
Now multiply this by 1000 attempts a second, and all your hardware does is calculate hashes.
The input limit of Argon2 specifically is much, much higher than that at 2^32-1 bytes, at which point you might as well just take it offline yourself.
If we impose no limit, why would the attacker limit themselves to 2560 chars?