What Okta Bcrypt incident can teach us about designing better APIs

length )] } return result } function runTest () { // 18 + 55 + 1 = 74, so above 72 characters' limit of BCrypt const userId = randomString ( 18 ) const username = randomString ( 55 ) const password = 'super-duper-secure-password' const combinedString = ` ${ userId } : ${ username } : ${ password } ` const combinedHash = bcrypt . [ 0 u8 ; length]; rand::thread_rng().fill_bytes( & mut bytes); URL_SAFE .encode( & bytes)[ .. length].to_string() } fn main () -> Result < (), Box < dyn Error >> { // 18 + 55 + 1 = 74, so above 72 characters' limit of BCrypt let user_id = random_string( 18 ); let username = random_string( 55 ); let password = "super-duper-secure-password" ; let combined_string = format!