Sjoerd Langkemper

Bcrypt’s 72 byte limit is a problem even though users don’t typically use passwords that long. Prehashing can solve that, but it not trivial to get right.

Popular posts: 1
Total points: 696
HN comments: 419
Rank: #3,489 personal

Visit sjoerdlangkemper.nl → On Hacker News Aug 2023 – Aug 2023

Web & Frontend 1 Security & Privacy 1

Most points Most discussed Most cited Newest

Short session expiration does not help security

2023696 points419 comments Security & Privacy details

When logged into a web application, the session does not remain valid forever. Typically, the session expires after a fixed time after login, or after the user has been idle for some time. How long should these times be?