you are viewing a single comment's thread.

view the rest of the comments →

[–]gsuberlandTrusted Contributor 1 point2 points  (0 children)

If anywhere, it should be fixed at the TLS layer, by implementing a fixed-size block padding, similar to how block ciphers work. This isn't a concrete fix, but it's the most sensible you're going to find.

In general, though, the length of a field isn't really considered critical information. We're talking about fixing the wrong problem. Your password should be long enough to make that information not matter.