Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why do websites disallow spaces in passwords?

news.ycombinator.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Ask HN: Why do websites disallow spaces in passwords?

#21

Post by kunley »

rlpb wrote: post #19

White space in passwords might be confusing if the system offers to email a user his own password. (Whether this should be done or not is another argument and is heavily dependent on the nature of the application.) How much entropy does white space add to a password? Where are most people putting spaces in passwords? Are they using passphrases (in which case the position of spaces can be guessed and thus have low ent…

Btw I always thought emailing a password back is just a habit from the past emerged with thousands of quick-n-dirty php apps in late 90s and this meme is copied till today "because others do it", and surely it's not any thoughtful application workflow.

What exactly do you have in mind telling this is dependent on the nature of the application? What type of applications should encourage it? Just curious.

Re: Ask HN: Why do websites disallow spaces in passwords?

#23

Post by ultrasaurus »

mbenjaminsmith wrote: post #4

I think it's good practice to trim leading/trailing whitespace from all inbound data. Google docs for one usually appends a newline to data kept in cells. Not so good if you're keeping passwords in a spreadsheet. That doesn't address spaces IN passwords, but I know I've never written a script to block them. If I had to guess I would say it depends on individual frameworks or the behavior of individual languages. E.g.…

I've done it for a similar reason: it cuts down on support requests (ever so slightly).

No matter what you tell them, users will store passwords in text files and email them around in spreadsheets, and spaces interfere with cutting and pasting in a way that other characters don't.

It's not a strong reason, but no-one's ever complained about not being allowed to use spaces either.

Re: Ask HN: Why do websites disallow spaces in passwords?

#24

Post by napierzaza »

ericd wrote: post #16
fleitz wrote: post #6

Probably because of this. A bunch of coders get into a meeting with a bunch of managers, passwords and security come up, it's a bike shed issue, so everyone throws their two cents in. Some guy saw something break once because a password with a space was passed on exec(). Some guy knows that crypt() only uses the first 13 characters. Some guy knows that passwords with less than 5 characters are extremely weak. Some gu…

I love your story on this. Someone should write/compile a book of stories like this for every stupid "Best Practice" in programming and web design.

It's not so stupid but pragmatic. It sounds like those errors are the types of which are whispy and hard to track down. Thankfully at this point we're all pretty familiar with that type of standard and abide almost automatically.

But I hate you if you force me to have capitals or numbers or symbols!

Re: Ask HN: Why do websites disallow spaces in passwords?

#25

Post by rlpb »

kunley wrote: post #21
rlpb wrote: post #19

White space in passwords might be confusing if the system offers to email a user his own password. (Whether this should be done or not is another argument and is heavily dependent on the nature of the application.) How much entropy does white space add to a password? Where are most people putting spaces in passwords? Are they using passphrases (in which case the position of spaces can be guessed and thus have low ent…

Btw I always thought emailing a password back is just a habit from the past emerged with thousands of quick-n-dirty php apps in late 90s and this meme is copied till today "because others do it", and surely it's not any thoughtful application workflow. What exactly do you have in mind telling this is dependent on the nature of the application? What type of applications should encourage it? Just curious.

What about in the case of a password reset request?

Ultimately there has to be some mechanism for a password reset, and there must be some level authentication during this reset.

How about a non-security-sensitive website which has a registration function and the only form of contact is via the registered email address? Users are likely to forget their passwords. The only way to verify a user in order to reset his password is with his email address. If you reset the password on request and then email it, then there is effectively a DoS there, and you are requiring the user to take extra effort (going back in and changing it again). If you email the existing plaintext password to him on request, then there is no DoS issue and minimal hassle for the user - provided that the security requirements make it acceptable for 1) a plaintext password to be emailed (but otherwise what else are you going to do?) and 2) the old password to be continued to be used even after it has been emailed in plaintext.

I'm not sure which of the two options I would implement myself. I'm not even aware of what existing webapps do since I use a password safe and so have never had to go through the process.

I'm just saying that for a non-security-sensitive situation, I have no major objection to the second option being used, and in this case it makes sense for white space to be not permitted in passwords. Since I'm not convinced that there is an entropy advantage in allowing spaces, I don't see why banning whitespace is a problem.

Re: Ask HN: Why do websites disallow spaces in passwords?

#26

Post by ericd »

ultrasaurus wrote: post #23
mbenjaminsmith wrote: post #4

I think it's good practice to trim leading/trailing whitespace from all inbound data. Google docs for one usually appends a newline to data kept in cells. Not so good if you're keeping passwords in a spreadsheet. That doesn't address spaces IN passwords, but I know I've never written a script to block them. If I had to guess I would say it depends on individual frameworks or the behavior of individual languages. E.g.…

I've done it for a similar reason: it cuts down on support requests (ever so slightly). No matter what you tell them, users will store passwords in text files and email them around in spreadsheets, and spaces interfere with cutting and pasting in a way that other characters don't. It's not a strong reason, but no-one's ever complained about not being allowed to use spaces either.

The advanced ones just silently hate you. It's not an annoyance worth emailing about, but it is an annoyance.

Re: Ask HN: Why do websites disallow spaces in passwords?

#27

Post by ericd »

rlpb wrote: post #25
kunley wrote: post #21

Earlier quoted context omitted.

Btw I always thought emailing a password back is just a habit from the past emerged with thousands of quick-n-dirty php apps in late 90s and this meme is copied till today "because others do it", and surely it's not any thoughtful application workflow. What exactly do you have in mind telling this is dependent on the nature of the application? What type of applications should encourage it? Just curious.

What about in the case of a password reset request? Ultimately there has to be some mechanism for a password reset, and there must be some level authentication during this reset. How about a non-security-sensitive website which has a registration function and the only form of contact is via the registered email address? Users are likely to forget their passwords. The only way to verify a user in order to reset his pa…

It's much better just to email them a password reset link. It's a little more complicated, but passwords should never be emailed plaintext, because a huge percentage of people use the same one across multiple sites.

I live like a tech luddite except when developing, so I don't use a password store for low security sites. One of my low security/throwaway passwords includes a space.

Post reply on HN