• marcos
    link
    fedilink
    arrow-up
    6
    ·
    18 hours ago

    It’s somewhat common to limit password lengths to avoid DoS attacks that exploit a slow key generation function.

    But that limitation should on some hundreds or a few thousands characters. Sites that use limits like “16” are probably storing them as plain text.