A third user thought the length limit suggested that the company may then be storing
the password themselves rather than hashing them
This was my first thought at well, and none of the examples in the article refute it satisfactorily.
Is there any point at all to capping the maximum length? Are sites worried that if the 64-character limit is lifted, 64+ character passwords will become common, leading to a bad user experience?
This was my first thought at well, and none of the examples in the article refute it satisfactorily.
Is there any point at all to capping the maximum length? Are sites worried that if the 64-character limit is lifted, 64+ character passwords will become common, leading to a bad user experience?