I see this restriction quite often, and it makes no sense to me whatsoever. Am I missing a compelling reason for this practise, or is it an example of bad design?
Ask HN: Is there a good reason for disallowing some characters from a password?
1–10 of 79 posts
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#2Bad design, this seems to be part of many legacy systems.
People tended to make bespoke textual formats, instead of, how we do now, using properly escaped serialization like JSON.
And because they couldn't bother making a robust parser with escaping, they went the lazy route of just disallowing characters with special meaning.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#3My credit card company does this, and it's infuriating
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#4You might want to run the password through Unicode-normalizing functions first (NFD or NFKD) but otherwise no.
Some sign-up forms don't even give you feedback on which characters are problematic. The Oracle Cloud one kept erroring with "you need one uppercase, one lowercase, and one number" when what it meant to say is "remove that tilde", that took a while to figure out.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#5It forces the use of a new password specific to that site. Reusing passwords is considered bad for security.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#6Bad design, this seems to be part of many legacy systems. People tended to make bespoke textual formats, instead of, how we do now, using properly escaped serialization like JSON. And because they couldn't bother making a robust parser with escaping, they went the lazy route of just disallowing characters with special meaning.
This is exactly it. Something somewhere broke on someone's password (think Bobby Tables) and so they forbid the character that done caused it.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#7it's very important when you're storing passwords in plain text, so typically it's a sign the website is dangerously insecure, though sometimes it's also just some product manager going "well everyone else does it, so it must be important".
That said, I did actually run into an instance where having ";-- in your password would trigger the WAF during login and because we needed to ship ASAP the easiest way to get around that was to ban ; in passwords. I don't think we ever went back to fix that one...
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#8I once used a special character in my login password (on Ubuntu I think) but the keyboard settings at the passwd prompt happened to be set differently from the ones at the (graphical) login manager at boot. So in the one case, something like 'e was interpreted as é and in the other case it wasn't.
I think it took me about five reboots in single-user mode and password resets before something clicked. I wish Ubuntu would not have allowed special characters. :)
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#9On mobile, keyboards typically auto capitalize the first letter of the first word.
So if your password is "password", it will get entered in as "Password" - and the user will get confused why their username/password aren't logging them in.
So a UX pattern is to actually lowercase the first letter on the backend.
Re: Ask HN: Is there a good reason for disallowing some characters from a password?
#10It forces the use of a new password specific to that site. Reusing passwords is considered bad for security.
Can you elaborate? It seems like it just enforces a specific type of password which is entirely reusable.