It's really more of a bug an a libc variant. Multiple softwares decided to adopt the same convention for "not a password". The libc library chosen by Alpine and other slim docker images didn't have code that could handle a password over 255, so they gave up and returned "not a password". Both lined up.
Seems it could have been smarter instead of choosing a value to represent null, they should have chosen to get as null as possible. Leave the password hash on disk as empty. Have the libc return a string pointer of NULL. Have a streql function that returns false if any input is a null pointer. Even more ideal if what reads from disk knows that an empty string should convert to a null pointer. Now it really can't match anything.
Log in
So, 255 or longer passwords work because OpenSSH breaks code because it doesn't plan on 255 characters or more passwords?
It's really more of a bug an a libc variant. Multiple softwares decided to adopt the same convention for "not a password". The libc library chosen by Alpine and other slim docker images didn't have code that could handle a password over 255, so they gave up and returned "not a password". Both lined up.
Seems it could have been smarter instead of choosing a value to represent null, they should have chosen to get as null as possible. Leave the password hash on disk as empty. Have the libc return a string pointer of NULL. Have a streql function that returns false if any input is a null pointer. Even more ideal if what reads from disk knows that an empty string should convert to a null pointer. Now it really can't match anything.
The perks of gapes.
Desires a good plug.