Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is there a good reason for disallowing some characters from a password?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 79 posts

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#31

Post by phlo »

Let's start at the edgest of cases.

Some emoji, for example, are combinations of multiple other emoji, and a given combined emoji may not be uniquely represented by a sequence of codepoints. In the pathological case, this could mean that an OS update on the user's system changes the composition of the same emoji, which might make it impossible for them to input their password. It is probably prudent for a system to disallow emoji passwords.

One step away from Emoji, Unicode also allows for other m̸̱̜̅ͅȋ̴̩̠̀s̸̺͐c̶͈͇͉̐͛̚h̸̤̣̆i̴͍͍͒͌e̴̲̽̓f̸̞̽̊. Chances are, full-on Zalgo passwords can lead to problems. Again, there are probably prudent reasons to restrict some characters. On the other hand, those modifiers exist for a reason, and disallowing phrases in the user's native language doesn't make for great UX.

Towards the more common use of Unicode, there is a pretty good _practical_ reason to restrict the use of some non-ASCII characters: if your system accepts ç, ö and ø as characters in passwords, and non-technical users venture into a part of the world where the keyboard layout doesn't, your helpdesk is going to have to deal with the occasional annoyed customer. From a systems design perspective, those characters seem fine -- operationally, they may cause headaches.

Finally, we've arrived at printable ASCII characters. Restrictions on maximum length (usually 6 or 8 characters), and on certain characters (%, & or :) tend to be based on interactions with legacy systems (e.g. DES crypt() used to have an 8-character minimum), or on bad input handling. Either way, it's probably a bad sign.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#32

Post by vidanay »

Someone1234 wrote: post #11

Typically, they're using legacy software to store the password itself (e.g. database, mainframe, etc). For a specific example Oracle Database has a very restrictive list of characters allowed in a user password. If you're using Database Users behind the scenes (even if not directly, but via an Oracle integration) you're subject to those same restrictions. Up until Oracle 11g passwords were also limited to 30 characte…

If you're storing a raw password in a database, limiting specific characters is waaaay down on the list of things you're doing wrong.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#33

Post by joshenders »

noufalibrahim wrote: post #21

A relevant anecdote. During my younger more adventurous years. We used to try to peek over admins shoulders to figure out passwords for root. Not to do anything malicious but just as a act of geeky bravado. Naturally, they got savvy and prevented us from doing this. The keyboards in the lab were heavily used and was noisy. The space bar, because of its shape, sounded distinctly different from the other keys. I stayed…

There’s a paper about this and a demo site that can accurately derive your password based on a short training period and audio recording. They used distance between key presses and sounds of each key for their specialized acoustical analysis.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#34

Post by daneel_w »

can16358p wrote: post #23

Mandatory plug: https://xkcd.com/936/

Ironically, that xkcd strip is crap advice. A dictionary attack breaks a mere four English words in half a jiffy. This approach should be enforced to a 9-10 word minimum.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#37

Post by josephcsible »

For characters between U+0020 and U+007E inclusive, there's no good reason at all, and it probably means that they're storing passwords in plaintext instead of hashing them, and that they aren't using parameterized queries to protect against SQL injection.

For characters outside that range, there is a good reason: it's hard to type those characters consistently across different platforms/systems, and they don't want you to lock yourself out over that.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#38

Post by Someone »

As others said, it’s important that your users can enter their password on all devices they would want to use.

Because of that, outlawing the likes of line feed, carriage return and backspace (raw input on a tty will store those in passwords, but good luck entering them in a web form) makes sense, as does normalizing Unicode input (typing ‘é’ on their phone may produce a byte sequence that’s different from typing ‘é’ on their PC)

Apart from that, it should not be necessary. If, however, you don’t trust your programmers to do the right thing, you may want to rule out characters that are related to security incidents such as single quotes, and also may want to prevent users from entering strings that might get decoded to such strings such as ‘"’.

That path can be endless, though. If you forbid ‘&’, because your programmers might accidentally html-decode it, should you guard against double html-decoding? URI-decoding and then uudecoding? Getting programmers you can trust to do the right thing and giving them the time to do so is the better option.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#39

Post by SAI_Peregrinus »

benj111 wrote: post #28
remram wrote: post #4

You might want to run the password through Unicode-normalizing functions first (NFD or NFKD) but otherwise no. Some sign-up forms don't even give you feedback on which characters are problematic. The Oracle Cloud one kept erroring with "you need one uppercase, one lowercase, and one number" when what it meant to say is "remove that tilde", that took a while to figure out.

(One of) my pet peeves is requiring a certain format for passwords but then not telling you at the password prompt. I mean, you're not supposed to write down passwords, but with all the various restrictions you can't even use a consistent convention so you can actually remember them all.

> I mean, you're not supposed to write down passwords, but with all the various restrictions you can't even use a consistent convention so you can actually remember them all.

You're supposed to use a password manager. Preferably with a passphrase and a second factor like a keyfile or hardware token.

Re: Ask HN: Is there a good reason for disallowing some characters from a password?

#40

Post by chrismorgan »

noufalibrahim wrote: post #21

A relevant anecdote. During my younger more adventurous years. We used to try to peek over admins shoulders to figure out passwords for root. Not to do anything malicious but just as a act of geeky bravado. Naturally, they got savvy and prevented us from doing this. The keyboards in the lab were heavily used and was noisy. The space bar, because of its shape, sounded distinctly different from the other keys. I stayed…

The space bar is just a big obvious form of audio attack that even humans can do with no tools or training, but really, if an attacker can hear you typing the password, it’s very heavily at risk. You can infer much more purely from the sound about the positioning of the hand and likely finger movements: in timing, most simply, but also in how sound bounces differently from different parts of the keyboard depending on what else is around (including the hands), and more. Practical attacks of this kind have been demonstrated.

It is thus a security Best Practice for streamers and the likes to mute their microphones while typing passwords.

Really, all senses leak information like this. Wifi signals are enough to see round corners and steal passwords. Even wearing a sleeveless shirt and having your upper arms visible to a camera leaks a little information from the small arm and theoretically even muscle movements.

Post reply on HN