• marcos@lemmy.world
    link
    fedilink
    arrow-up
    8
    ·
    3 days ago

    It’s somewhat common to limit password lengths to avoid DoS attacks that exploit a slow key generation function.

    But that limitation should on some hundreds or a few thousands characters. Sites that use limits like “16” are probably storing them as plain text.