• marcos@lemmy.world
    link
    fedilink
    arrow-up
    7
    ·
    1 day ago

    It’s somewhat common to limit password lengths to avoid DoS attacks that exploit a slow key generation function.

    But that limitation should on some hundreds or a few thousands characters. Sites that use limits like “16” are probably storing them as plain text.