Guys I might be stuck in a time loop. There’s a Log4j2 remote execution exploit. Toy Story is one of the highest grossing films of the year. Foldable phones are in the headlines. Serena and Venus are playing doubles in the US Open.

Don’t most of those systems turn the user pw into a salted hash? I suppose that would limit the effective pw length, given random pw’s. Like if the hash was 128 bits or w/e, lots of 256 bit pw’s would hash to the same value.

But IDK how big those hashes are. Maybe they’re huge?

Your password is all asterisks?

Even NIST stopped recommending pw rotations.

To their credit, none of the businesses I have a pw for require changes anymore. Also, to their credit, I can use long pw’s now. Some used to restrict to 8 chars max (!?) But against their credit, many still restrict the pw content, like you can’t use non-letter symbols or w/e.