Sometimes we do releases that fix things that are kinda hard to exploit, or mostly are just hardening existing stuff to make it even better.<p>Sometimes we do releases because there's a serious exploitable thing in the wild.<p>This is the latter: it's a DoS vector, and it got out via a posting to a public mailing list. Please do not hold off on upgrading.
FYI,<p>- bcrypt can have passwords up to 72 bytes (depending on implementation) due to its nature of feeding password into a block cipher, and Blowfish having max 448 bit keys but some implementations allowing 576 bits (see <a href="https://en.wikipedia.org/wiki/Blowfish_(cipher)#The_algorithm" rel="nofollow">https://en.wikipedia.org/wiki/Blowfish_(cipher)#The_algorith...</a>)<p>- scrypt accepts passwords of unlimited length, however the computational/memory cost doesn't depend on password length, as the first step in scrypt is expanding (or compressing) password and salt with 1-round PBKDF2, which is basically HMAC in counter mode.
Some people deride it as "C programmer mentality" when fields have a fixed maximum size. I too used to think having no limits at all was the best approach in most scenarios. But for many user input data, there is a point at which a longer value is complete nonsense. The 4096-character password length limit Django will now employ seems quite a bit longer than absolutely necessary; hopefully it sufficiently addresses the bug. As for the choice of 4096, well, I would have chosen 4000 (or 1000) simply because it's more comprehensible from an end-user perspective.<p>When designing such systems, also consider that users sometimes accidentally copy-paste entire documents into text fields--given the number of users Django has, if a site has no input-field length limit, it's downright likely that someone will eventually paste a megabyte "password" in there with no ill intention.
Just for kicks, I timed how long it took to hash a 1Mb password on an EC2 small instance:<p>>>> timeit.timeit('make_password(a, "asdfasdfasd")', setup="a = 'a' * 1024 * 1024; from django.contrib.auth.hashers import make_password;", number=1)
206.77019500732422
What I believe to be the relevant post that prompted these releases: <a href="http://www.mail-archive.com/django-developers@googlegroups.com/msg38236.html" rel="nofollow">http://www.mail-archive.com/django-developers@googlegroups.c...</a>