11–20 of 27 posts
Earlier quoted context omitted.
Surely there must be some motivation for disallowing special characters, though... it's certainly not for security purposes. Maybe it's a weird form of overzealous SQL injection protection?
I think it might be so that you can type in your password on any keyboard. Some special characters may be missing on some keyboards, or they may need to be typed in differently, depending on your locale.
Leading and trailing spaces because more than one username would look the same on the page eg. "user" and "user " which would confuse others when signing comments etc.
"It's actually harder to disallow spaces" Traditionally, when deciding what password characters to allow/disallow, everyone thinks in terms of what to allow, not what to disallow. For example, a system that only allows alphanumeric characters in passwords (i.e. no special characters) would use less code to specify with regex that only a-z,A-Z,0-9 should be allowed, rather than specifying the many characters to be blo…
Probably because of this. A bunch of coders get into a meeting with a bunch of managers, passwords and security come up, it's a bike shed issue, so everyone throws their two cents in. Some guy saw something break once because a password with a space was passed on exec(). Some guy knows that crypt() only uses the first 13 characters. Some guy knows that passwords with less than 5 characters are extremely weak. Some gu…
If there is a rationale I'll bet 99.9% of people don't know what it is. So, the answer is easy: because that's how everyone else does it.
Earlier quoted context omitted.
Surely there must be some motivation for disallowing special characters, though... it's certainly not for security purposes. Maybe it's a weird form of overzealous SQL injection protection?
For a company that really has no idea whatsoever about security: maybe they want to make sure they can read your password back to you over the phone in a way you'll understand?
How much entropy does white space add to a password? Where are most people putting spaces in passwords? Are they using passphrases (in which case the position of spaces can be guessed and thus have low entropy)?
Given that I can think of a potential downside and possibly no gain in security, I can understand why some may default to not allowing it.
Probably because of this. A bunch of coders get into a meeting with a bunch of managers, passwords and security come up, it's a bike shed issue, so everyone throws their two cents in. Some guy saw something break once because a password with a space was passed on exec(). Some guy knows that crypt() only uses the first 13 characters. Some guy knows that passwords with less than 5 characters are extremely weak. Some gu…
I love your story on this. Someone should write/compile a book of stories like this for every stupid "Best Practice" in programming and web design.