heiglandreas, 4 months ago

@jclermont https://pages.nist.gov/800-63-3/sp800-63b.html#-5112-memorized-secret-verifiers

"Verifiers SHOULD permit subscriber-chosen memorized secrets at least 64 characters in length"

To increase security it should not be possible to set the maximum length of that validator to a value below 64.

Otherwise it is not improving security.

jclermont, 4 months ago

@heiglandreas That's a fair point, and the default max being discussed is 72 (due to bcrypt internals), so it would not violate the NIST recommendation.

heiglandreas, 4 months ago

@jclermont That's absolutely right!

Sadly advertising a tool to set a max password length (to avoid the password being truncated at 72 chars) will cause people to abuse it to set the max length to whatever some projectmanager thinks is enough (12 chars).

BTW: Is that truncating at 72 chars or bytes... 🙈