If the character can not be hashed - outside of that, no reason at all.
Although you should probably not allow "1234" as passwords or anything on the top 100 list for that matter.
Ask HN: Is there a good reason for disallowing some characters from a password?
61–70 of 79 posts
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#62Earlier quoted context omitted.
Ironically, that xkcd strip is crap advice. A dictionary attack breaks a mere four English words in half a jiffy. This approach should be enforced to a 9-10 word minimum.
> A dictionary attack breaks a mere four English words in half a jiffy. What system allows you to try 2⁴³ passwords in half a jiffy?
I don't know what 2^43 would equate (four of the 1500 most common English words?), but an A100 GPU cluster at AWS would be a good starting point. I know, it's beyond the scope of you, me, and the neighbor kid. What I'm trying to get across is that short dictionary passwords have several innate vulnerabilities. They shouldn't be considered "long complicated passwords" until they're actually long.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#63You might want to run the password through Unicode-normalizing functions first (NFD or NFKD) but otherwise no. Some sign-up forms don't even give you feedback on which characters are problematic. The Oracle Cloud one kept erroring with "you need one uppercase, one lowercase, and one number" when what it meant to say is "remove that tilde", that took a while to figure out.
> You might want to run the password through Unicode-normalizing functions first (NFD or NFKD) but otherwise no.
If you do this, you should really save the version of the normalizing table you used, since they change over time.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#64Allowing linefeeds/carriage returns/ASCII nulls seems like a bad idea. I have wanted to include backspace in a password though!
Unless you're manually injecting 0x08 into a database record, isn't it your keyboard that interprets your backspace into the UI layer. There's no way to type a backspace without literally pressing backspace :) Regarding the null, if it's C based, theoretically your password just stops there. All other chars after that would be ignored. Now I wonder, what would other non-C languages do if they see 0x00 in a string?
> There's no way to type a backspace without literally pressing backspace :)
ctrl-H usually works.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#65Try to type a password with accents on an english keyboard
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#66Earlier quoted context omitted.
Ironically, that xkcd strip is crap advice. A dictionary attack breaks a mere four English words in half a jiffy. This approach should be enforced to a 9-10 word minimum.
Maybe you can correct my math. English has something like 500,000 words, but adults who speak it natively know 20,000 - 35,000[1]. If we cut that down to 10,000 to be conservative, that's still 10,000,000,000,000,000 (10 quadrillion) combinations at four words in a password. That's not including any capitalization, special characters between words, etc., just the stock XKCD "four random English words". No provider is…
> Am I missing something?
Sincere efforts in breaking password hashes is something else than a single individual with one GPU at their disposal - it's not the angry neighbor capturing your Wi-Fi traffic or some "randoms" on the dark web who got their hands on a leaked database.
Realistically you will never need to exhaust the full key space (vocabulary), even if the commonly used set would be as high as 10 000. If you refuse to use a password manager and random character strings for passwords then at least don't settle for just four words, because you'll be going for common and memorable words, not something from the fringes of the dictionary. Unlike the case of a bunch of random characters, when picking a couple of words that you can remember easily there's a psychological factor involved which can be attacked, so make it count.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#67Typically, they're using legacy software to store the password itself (e.g. database, mainframe, etc). For a specific example Oracle Database has a very restrictive list of characters allowed in a user password. If you're using Database Users behind the scenes (even if not directly, but via an Oracle integration) you're subject to those same restrictions. Up until Oracle 11g passwords were also limited to 30 characte…
> Typically, they're using legacy software to store the password itself (e.g. database, mainframe, etc) I've heard banks and other financial institutions use the "our ancient mainframe only allows 8 characters in account passwords" excuse or "our ancient mainframe database can only handle 8 characters in the password column", and find it extremely hard to believe. First of all, I find it hard to believe that each cus…
> I find it hard to believe that each customer has a user account on the mainframe
Why? Do you actually have any experience in this area? I do, and I can tell you, they do exactly that. Then multiple systems integrate with that mainframe, often using the user account as the unique identifier for the entire organization. Migrations are an absolute nightmare.
> Users have to go through that to do online banking, and the account system on that can be totally separate from whatever account system is running on the backend banking system.
It can be, but it isn't. Thus, the problem.
Honestly this type of "hardly believe" take is what every new employee right out of college (or myself 15 years ago) when they come up with ten thousand "simple" ideas for improvement without any organization, political, or system understanding. Then they act confused when their ideas aren't instantly implemented, because they don't even understand what it is they're proposing or why it is complicated.
Banks have been trying to get off of mainframes for 30-years or more at this point, spent tens of millions of dollars, but had someone just told them to "run a web server in front of it" this could all have been avoided.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#68I don't remember exactly which sites, but I run into the problem every so often with a handful where I'm prompted to change my password according to vague guidelines that say I usually need special characters, without saying which ones it accepts.
I change my password with something randomly generated by my password manager, and the site accepts it, and as far as I know I'm good to go. Then next time I try to log into the website, it doesn't accept the password it previously (falsely) accepted before, and I have to reset it again and play the guessing game of what special character it didn't like. Madness.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#69Earlier quoted context omitted.
> Typically, they're using legacy software to store the password itself (e.g. database, mainframe, etc) I've heard banks and other financial institutions use the "our ancient mainframe only allows 8 characters in account passwords" excuse or "our ancient mainframe database can only handle 8 characters in the password column", and find it extremely hard to believe. First of all, I find it hard to believe that each cus…
> I find it hard to believe that each customer has a user account on the mainframe Why? Do you actually have any experience in this area? I do, and I can tell you, they do exactly that. Then multiple systems integrate with that mainframe, often using the user account as the unique identifier for the entire organization. Migrations are an absolute nightmare. > Users have to go through that to do online banking, and th…
> Then multiple systems integrate with that mainframe, often using the user account as the unique identifier for the entire organization.
How do the multiple systems communicate with each other and with the mainframe?
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#70A relevant anecdote. During my younger more adventurous years. We used to try to peek over admins shoulders to figure out passwords for root. Not to do anything malicious but just as a act of geeky bravado. Naturally, they got savvy and prevented us from doing this. The keyboards in the lab were heavily used and was noisy. The space bar, because of its shape, sounded distinctly different from the other keys. I stayed…
There’s a paper about this and a demo site that can accurately derive your password based on a short training period and audio recording. They used distance between key presses and sounds of each key for their specialized acoustical analysis.
Reminds me of Van Eck phreaking and the description of that in Neal Stephenson's Cryptonomicon.