On: Critical PayPal Security Hack: Multiple Thefts Now Reported–Check Your Settings

[inetknght]

In the same way that the best one-way hash algorithms can accept arbitrarily large inputs and produce a constant-sized digest.

[SilasX → inetknght]

True but I thought you’d want to have some size limit regardless, if for no other reason than choking up the connection with a huge one.

[inetknght → SilasX]

Sure, but "some size limit" can be as big as 500 or 1000 bytes. "Choking up the connection" won't be for very long at all. Even on a 2400 baud modem, you're talking only a few seconds to transmit a kilobyte of password. On modern cell networks or especially broadband connections, you pretty much won't choke the connection at all with a 1000-character password.

[johndough → inetknght]

To add to that, the login page (which contains nothing but two fields for email and password) weighs in at 1.5 MB, so bandwidth clearly is not an issue for PayPal.

[SilasX → johndough]

Which still doesn't refute the need for a limit, and a large part of why I didn't defend a 24-character limit.

[SilasX → inetknght]

I agree, which was I was only criticizing the point against "there should not be a limit at all" -- I don't know what you're disagreeing with that I said.