• Lionir [he/him]
    link
    fedilink
    English
    11
    edit-2
    1 year ago

    I notice a few UI-related things:

    • Keep getting “Deleted by creator” in the bottom left which I assume an unregistered user shouldn’t see
    • Community names in the Communities list or on any page it seems are not center aligned like you might notice here (https://beehaw.org/communities)
    • Modlog only appears after a refresh on the page
    • Modlog filters are no longer side-by-side
    • It finally says that the Username is taken
    • It still lets you make a password longer than 60 characters (bad)
    • Posts no longer seem to be switched

    (Still need to test pinned messages being moved when sorted by new) (I should post this in there, actually, I guess)

    • dudeami0
      link
      fedilink
      English
      91 year ago

      Is there a reason you consider passwords longer than 60 characters an issue, or does the backend reject such passwords? In my experience, there should be no upper bound on password length except maybe in the order of request size being too large (say a password that is a several kilobytes).

      • Lionir [he/him]
        link
        fedilink
        English
        251 year ago

        The 60 character limit is not a problem imo, the problem is that they are truncated at 60 but the UI doesn’t tell you, this results in some problems.

      • @Xanvial@lemmy.one
        link
        fedilink
        English
        6
        edit-2
        1 year ago

        Some password encryption methods has max characters length. For example Bcrypt has 72 max length. This is mostly to avoid taking too much time encrypting user input.

        If there’s no limit someone can technically froze the server by inputting large password (not because the request is big, but encryption process is exponentially takes more CPU process the longer it is)

        • dudeami0
          link
          fedilink
          English
          21 year ago

          Having only ever implemented PBKDF2 this is a good insight as well. This limitation does not seem to be an issue with more modern hashing algorithms, but I can see where limiting the size to a reasonable amount for purposes of having an upper bound on performance would be needed.

      • Passwords “should” be hashed anyway, so I don’t understand why there’s a limit. Are they actually being stored as plaintext in a VARCHAR(60) column in the database? Please tell me that’s not happening.

        • rs5th
          link
          fedilink
          English
          61 year ago

          Just checked my own Lemmy postgres database, it’s a 12 round Bcrypt 2b hash.