Hi.

Thanks for your package!

Context: we're implementing Bcrypt, but our password are prehashed, so longer than the default. I've found the usage of LongPasswordStrategy.none() in our code and would like to understand its implications.

I'm trying to understand the logic of LongPasswordStrategies.

What I've understood:

• Bcrypt doesn't handle > 71 bytes passwords
• This package raises an error if the password too long because LongPasswordStrategies.strict is in the defaults.
• The package provides a LongPasswordStrategy that avoids this issue by either truncating the password, or deriving the password via sha512.
• The package also provides a public LongPasswordStrategy.none() method which is just a pass-through, and returns the raw password, but stop raising an error.

We initially had the StrictMaxPasswordLengthStrategy error. By adding the PassThrough strategy, we don't have it any more (which is pretty normal seeing the code), and our users are logged successfully.

However, what are the implications of doing that? What is the real behaviour with long password in this case? Why is it working, even if due to ... Blowfish cipher, the maximum password length is ... 71 bytes? Could it be a security breach for us?

Thanks for all your answers, and again for your work!
(If you like, I could add some doc based on your responses to the readme, or the code 🙂 ).

Matt'