Password Length Limit #2

New Issue

2021-01-11T18:19:55-06:00

glm94 commented

2021-01-11 18:19:55 -06:00

According to OWASP, the recommended max password length should be between 64 and 128 characters. But considering character encoding, should the limit be the size of the string and not just a character limit? Character versus code points is maybe something to consider since adding entropy beyond the key's size is pointless from a security perspective.

According to OWASP, the recommended max password length should be [between 64 and 128 characters](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#maximum-password-lengths). But considering character encoding, should the limit be the size of the string and not just a character limit? Character versus code points is maybe something to consider since adding entropy beyond the key's size is pointless from a security perspective.

glm94 added the question label 2021-01-11 18:19:55 -06:00

glm94 commented

2021-06-30 16:12:17 -05:00

Something of note is in .NET Core 3, the Rune type was introduced. This represents a Unicode scalar value which is different from a Char that represents Unicode codepoints. As for the question on hand, this could be the answer Introduction to character encoding in .NET.

Something of note is in .NET Core 3, the [Rune](https://docs.microsoft.com/en-us/dotnet/api/system.text.rune?view=net-5.0) type was introduced. This represents a Unicode scalar value which is different from a [Char](https://docs.microsoft.com/en-us/dotnet/api/system.char?view=net-5.0) that represents Unicode codepoints. As for the question on hand, this could be the answer [Introduction to character encoding in .NET](https://docs.microsoft.com/en-us/dotnet/standard/base-types/character-encoding-introduction).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: glm94/secure-core#2