> [...] an AT&T spokesperson [...] told Ars that the company decided not to allow symbols because customers did not like typing them when using mobile phones.
That argument does not compute.
Why your password can’t have symbols—or be longer than 16 characters
11–20 of 75 posts
Re: Why your password can’t have symbols—or be longer than 16 characters
#12It's not that they don't care, they are managing support headaches, and balancing risk to reward.
6 Character AlphaNumeric for Schwab is because they use the same password for phone, and this is a throwback to a "Pin". They could at least be honest that this is why it is what it is. The Fobs they send that generate a random number to go with your login make this not a deal breaker for me.
Microsoft is balancing support with security. If you can have a 32 character password it is more likely to be forgotten. But that isn't the real "Support" cost it is DDOS attacks. Computing a hash of a 128 character password is more expensive than doing a 16 character password. This makes it possible to bombard their servers with a Hotmail address you know to be real, and an imaginary password which they have to compute and check the hash for.
Re: Why your password can’t have symbols—or be longer than 16 characters
#13I found this very strange The permitted characters and length for passwords are defined as a regular expression in Evernote’s API, but spaces are left out, Evernote says, because leading and trailing spaces presents a problem. “Software needs to precisely determine how to treat leading and trailing spaces,” Dave Engberg, Evernote’s CTO, told Ars. “Some UI frameworks and third-party applications would unreliably trim…
Additionally. "Adding support for spaces only in the middle of the password would make the regular expression defining them three times longer, Engberg said." So they admit they already have the regex definition that would allow this, but for some reason don't want to put it in production? How strange.
but it's 3 times longer! Think of all the ram that would use!
They can't even cite performance reasons as hashing passwords should be very cpu intensive anyway
Re: Why your password can’t have symbols—or be longer than 16 characters
#14The only line of reasoning in the article that seems somewhat convincing to me is Microsoft's point that stronger passwords don't prevent phishing, malware, or compromise via another site (and I'm not sure about the third one -- I guess it's true if the other site is storing passwords in the clear, but if they're hashed, I'd think stronger passwords would be harder to get using rainbow tables). But even if it's true…
"Evernote's reason seems more like an admission of a technical debt than any kind of defense."
Our eyebrows are only raising because an article with a strong focus on passwords was written and they saw fit to include this tidbit. In isolation I doubt any of us, including the developers of this particular little thing, sees it as something worth caring about. The point about leading or trailing spaces is definitely true, and who cares if you can have spaces in the middle? If your password policies are so awesome that that is your biggest problem, I'm ready to declare victory and move on.
Re: Why your password can’t have symbols—or be longer than 16 characters
#15It's not that they don't care, they are managing support headaches, and balancing risk to reward. 6 Character AlphaNumeric for Schwab is because they use the same password for phone, and this is a throwback to a "Pin". They could at least be honest that this is why it is what it is. The Fobs they send that generate a random number to go with your login make this not a deal breaker for me. Microsoft is balancing suppo…
But that isn't the real "Support" cost it is DDOS attacks.
Computing a hash of a 128 character password is more expensive than doing a 16 character password.
1. There is no way hashing 128 characters instead of 16 is so much more expensive that it enables an otherwise infeasible DDOS
2. Passwords should be salted before hashing, so you're adding (hopefully) at least 30 characters of salt to the password anyway.
3. Hashing should be expensive. You should be using bcrypt or some other algorithm with a work factor to protect against brute forcing if your database is compromised.
The real reason is likely a mix of legacy code and extra support from people forgetting passwords, and just plain ignorance from the developers
Re: Why your password can’t have symbols—or be longer than 16 characters
#16It's not that they don't care, they are managing support headaches, and balancing risk to reward. 6 Character AlphaNumeric for Schwab is because they use the same password for phone, and this is a throwback to a "Pin". They could at least be honest that this is why it is what it is. The Fobs they send that generate a random number to go with your login make this not a deal breaker for me. Microsoft is balancing suppo…
Hashing passwords intentionally slow for security.
The solution to a DOS like this is to ignored all password attempts after N per M time.
Re: Why your password can’t have symbols—or be longer than 16 characters
#17American Express has (had?) terrible password requirements. I think it has changed but not sure.
Who is giving these banks all this terrible advice?
Re: Why your password can’t have symbols—or be longer than 16 characters
#18I remember once reading a bank's FAQ trying to explain why passwords couldn't contain SELECT, UPDATE, DROP, or DELETE. I can't find it now so hopefully that little problem has been fixed...
My ex was a member of a teacher's credit union. To log in you had to give the account number, the password and the user's last name.
One day she told me she always had trouble remembering which way to log in... which seemed strange to me. Anyway, her surname is Irish, one of your typical O'Somethings. When she tried without the apostrophe she was fine but when she used the apostrophe it failed with a SQL error message.
When I finally was able to breathe again she asked me what it meant. I just told her that it meant that she should never leave any money in that account...
Re: Why your password can’t have symbols—or be longer than 16 characters
#19I remember once reading a bank's FAQ trying to explain why passwords couldn't contain SELECT, UPDATE, DROP, or DELETE. I can't find it now so hopefully that little problem has been fixed...
No offensive words either! We don't want our engineers looking through our big plaintext files to get offended.
Re: Why your password can’t have symbols—or be longer than 16 characters
#20The only line of reasoning in the article that seems somewhat convincing to me is Microsoft's point that stronger passwords don't prevent phishing, malware, or compromise via another site (and I'm not sure about the third one -- I guess it's true if the other site is storing passwords in the clear, but if they're hashed, I'd think stronger passwords would be harder to get using rainbow tables). But even if it's true…
"Evernote's reason seems more like an admission of a technical debt than any kind of defense." Our eyebrows are only raising because an article with a strong focus on passwords was written and they saw fit to include this tidbit. In isolation I doubt any of us, including the developers of this particular little thing, sees it as something worth caring about. The point about leading or trailing spaces is definitely tr…
Eh, spaces are nice if you want to have an actual passphrase.