To avoid hashing of huge passwords limit them to 100 chars for now

[rullzer]

Signed-off-by: Roeland Jago Douma roeland@famdouma.nl

[MorrisJobke]

Suggested change

	'errors' => array(array('error' => $this->l10n->t('Password to long')))
	'errors' => [['error' => $this->l10n->t('Password to long')]]

[nickvergessen]

#PHPCS

[MorrisJobke]

Beside the nitpick 👍

[MorrisJobke]

@skjnldsv Mind to do a new release and push it to the appstore?

[spaze]

Hi, can you please point me to where hashing long passwords causes issues? There's no difference in hashing 10 characters long password and 10M characters long password. PHP's bcrypt implementation (like many others ) even truncates passwords at 72 chars, so there's there's no difference beyond 72 chars. Also see this benchmark:

>>> $o = ['cost' => 12]
=> [
     "cost" => 12,
   ]
>>> timeit password_hash(str_repeat('A', 10), PASSWORD_BCRYPT, $o)
=> "$2y$12$VORcqUusFzA0uKwidZyEG.rba8.svSJiBqrKwHiRbke8zHf4LijKm"
Command took 0.291033 seconds to complete.
>>> timeit password_hash(str_repeat('A', 10_000_000), PASSWORD_BCRYPT, $o)
=> "$2y$12$qpzFTZeb72nrCo/U2oswZujt1BUCMUuT4O4JvW3GNPzOR8dy7eM.O"
Command took 0.283745 seconds to complete.
>>>

>>> $o = ['memory_cost' => 65536 * 2, 'time_cost' => 8, 'threads' => 2]
=> [
     "memory_cost" => 131072,
     "time_cost" => 8,
     "threads" => 2,
   ]
>>> timeit password_hash(str_repeat('A', 10), PASSWORD_ARGON2ID, $o)
=> "$argon2id$v=19$m=131072,t=8,p=2$NjBEaUthbG1rNE9GSmRUMQ$DTDldfjp/CH9ZpqIInkdRhvCnqY+jHRTLl79kR0d+b0"
Command took 2.581087 seconds to complete.
>>> timeit password_hash(str_repeat('A', 10_000_000), PASSWORD_ARGON2ID, $o)
=> "$argon2id$v=19$m=131072,t=8,p=2$N2thZC5LbzFaaDFpZjRFaQ$7DRvhkyXNsLSjqcyyktc7thnsX9sx4zoABQu893WF8s"
Command took 2.577008 seconds to complete.

[nickvergessen]

Well this was an issue reported on our hackerone project and I was able to reproduce it back then:
https://hackerone.com/reports/840598

But now I see the same things you observe.

[spaze]

The HackerOne report, recently disclosed, is how this caught my attention and how I got here initially :-)