>Therefore, if your password policy as any more restrictive than [\x20-\xFE]... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

blablabla123 on Feb 1, 2013 | parent | context | favorite | on: Limiting passwords to 12 characters is "secure eno...

>Therefore, if your password policy as any more restrictive than [\x20-\xFE]{8,64}, I'm going to assume that you store my passwords in a plain-text VARCHAR field without proper escaping.

Alternative interpretation: the Website is neither UTF8-safe (or whatever charset you prefer) nor are prepared statements used. Otherwise VARCHAR is fine even without any escaping.

kijin on Feb 1, 2013 [–]

Sorry, that was supposed to be \x7E but I can't edit anymore. Now you only need to deal with printable ASCII characters.

blablabla123 on Feb 1, 2013 | [–]

No problem, I was assuming printable anyway... ;)

I just wanted to point out that it's possible to use VARCHAR even with weird characters.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact