@phire oh, god, they concatenated things and then truncated before hashing

[recursive@hachyderm.io]

@phire oh, god, they concatenated things and then truncated before hashing

[mawhrin@circumstances.run]

@recursive @phire it's even worse. bcrypt has a plaintext length limit of 72 bytes.

[danderson@hachyderm.io]

@mawhrin @recursive @phire wikipedia says in some impls that's 56 bytes even, due to weird old bad advice. So... 4 byte ID, 52 byte user, profit?

[recursive@hachyderm.io]

@danderson @mawhrin @phire lol, oof