Security issue in secrets longer than 72 characters about bcrypt-ruby HOT 2 CLOSED

Adding a salt, constant or otherwise, to a password before hashing it with bcrypt doesn't make any sense.

from bcrypt-ruby.

Even without custom salting, this is still a security concern.

For a simplified proof of concept, consider someone using the password
000000000000000000000000000000000000000000000000000000000000000000000000kEGF8vY6rR78kOb65WCbRw.
According to zxcvbn this is a really good password that's practically impossible to crack.
However, an attacker would only need to crack 000000000000000000000000000000000000000000000000000000000000000000000000,
which could be cracked in seconds.

The culprit is that bcrypt (eksblowfish) has an upper limit of 72 characters (56b) for passwords, anything else is cut off.

This has also been discussed in rails/rails#14591, which led to setting a limit of 72 characters when using has_secure_password.

I think it would be best if BCrypt would raise an error if the password is longer than 72 characters. Can this be re-opened?

from bcrypt-ruby.