I will never be able to log in to Flickr again

You can apply a hashing algorithm to a string that contains spaces. The spaces are very much relevant.

In MD5 "String with spaces" yields eab431cd212fb8b5ae223acbcfe58cca

"Stringwithspaces" gives 3cd297b2d7e48709d92890f88abdde0a

I meant the hashes themselves wouldn't have spaces, therefore any odd database storage requirement wouldn't matter.

Actually, they are (or could be, given that I don't know for sure because I don't work there).

It merely means that they are most likely looking for spaces with client-side JavaScript, and rejecting any string that contains spaces.

Or, they're checking the string server-side, before hashing and storing the hash to their persistent data store.

Either way, as long as the connection is secure, it's reasonable to inspect the string in plain-text, both client-side and server-side, before creating the hash, as long as they actually create the hash when they do actually decide to save a representation of the password, rather than saving the plain-text password itself.

Part of me would like to guess that the reason spaces might be forbidden in passwords (and pass phrases) would be to prevent frequency analysis. But that doesn't really make much sense, when it comes to hashes, does it? So then, might the case be that they are storing the passwords with reversible encryption, and decrypting the token for a match? In my mind of minds, I doubt it, but you never know. What I really think is that the password policy is simply contrived and idiotic, and whatever rationale they've used to forbid spaces is silly and ill-conceived.

Either way, I agree with the author, whole-heartedly. That is a damned frustrating sign-up process. Two-factor account creation AND a CAPTCHA check? Holy moly!

The worse, I guess, is the password constraint. I really fail to understand why should any application (except banking, may be) force its users to go for difficult passwords. I agree, it weakens the security - but warn them, don't force them. It should be a guideline; not a rule. Whether I want to follow it not is my decision; my risk.

There isn't one.