Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is there a good reason for disallowing some characters from a password?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 79 posts

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#21

Post by noufalibrahim »

A relevant anecdote. During my younger more adventurous years. We used to try to peek over admins shoulders to figure out passwords for root. Not to do anything malicious but just as a act of geeky bravado. Naturally, they got savvy and prevented us from doing this.

The keyboards in the lab were heavily used and was noisy. The space bar, because of its shape, sounded distinctly different from the other keys. I stayed away from the admins when they entered the password like a decent citizen but listened in and found that the password was 7 characters long and also that the second and sixth characters were space (thanks to the different sound of the key). So .˽...˽.

I brute forced this using a shell script (since I has just learned how to write shell script), ran it overnight, and got in the next day.

So yes, I think there might, atleast in theory, be good reasons to avoid certain characters in a password.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#24

Post by daneel_w »

lexicality wrote: post #7

it's very important when you're storing passwords in plain text, so typically it's a sign the website is dangerously insecure, though sometimes it's also just some product manager going "well everyone else does it, so it must be important". That said, I did actually run into an instance where having ";-- in your password would trigger the WAF during login and because we needed to ship ASAP the easiest way to get arou…

> it's very important when you're storing passwords in plain text, so typically it's a sign the website is dangerously insecure ...

This is a misconception. Password length is far more important than allowing a few "tricky" non-alphanumerics. It aids entropy, but it's not some security silver bullet. Also, if the web service you're using is storing undigested passwords then all bets are off.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#26

Post by mstef »

let me quote NIST Special Publication 800-63B: https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret

> Verifiers SHALL require subscriber-chosen memorized secrets to be at least 8 characters in length. Verifiers SHOULD permit subscriber-chosen memorized secrets at least 64 characters in length. All printing ASCII [RFC 20] characters as well as the space character SHOULD be acceptable in memorized secrets. Unicode [ISO/ISC 10646] characters SHOULD be accepted as well.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#28

Post by benj111 »

remram wrote: post #4

You might want to run the password through Unicode-normalizing functions first (NFD or NFKD) but otherwise no. Some sign-up forms don't even give you feedback on which characters are problematic. The Oracle Cloud one kept erroring with "you need one uppercase, one lowercase, and one number" when what it meant to say is "remove that tilde", that took a while to figure out.

(One of) my pet peeves is requiring a certain format for passwords but then not telling you at the password prompt.

I mean, you're not supposed to write down passwords, but with all the various restrictions you can't even use a consistent convention so you can actually remember them all.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#29

Post by wizofaus »

pestatije wrote: post #5

It forces the use of a new password specific to that site. Reusing passwords is considered bad for security.

Yes but that's a terrible way to enforce it. I've said here before I'd actually like the browser to forbid users from reusing passwords when signing up to new sites. I'm guessing there is actually a plugin that does it.
Post reply on HN