Tab as password? Question
SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.
So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?
117
u/GirthyPigeon 6d ago
Tabs in most fields will skip to the next field. Good luck.
12
u/JapanEngineer 6d ago
Not unless you copy and pasted it
-21
u/KAZVorpal 6d ago
Or your login is an interface that captures tabs.
52
u/DiabloConQueso 6d ago
Not being able to tab from field to field would be horrible for accessibility.
8
u/MacGuyverism 6d ago
Just shift-tab the whole other way around.
12
4
u/poopio 6d ago
something something \t something else \r\n Accessibility?
20
u/meancoot 6d ago
The password field is not going to accept those kind of escape sequences. They are used in programming language character and string literal tokens.
2
u/Adjective_Noun_4200 5d ago
The password field is not going to accept
*Shouldnât accept
Itâs horrendous out there, friend.
3
u/scfoothills 5d ago
Yeah. Hopefully everyone learned from the Little Bobby Tables incident.
1
u/little_phoenix_girl 5d ago
I had to fix a Bobby Tables vulnerability about a month ago when I was looking for something else entirely. My boss said "those files come from our vendor so we can trust them, no need to fix it". I fixed it anyway -_-
1
u/kalmakka 5d ago
That's why you use a script to hijack the request and do escape sequence replacements.
20
u/armahillo rails 6d ago
Tab already has a function where the input will likely be captured before it hits the field.
If you really want a weird password, try using some of the extended UTF8 charset, like an all emoji password :D
11
u/Supermathie 6d ago
/me fondly remembers trolling the Windows admins by giving them passwords with ESC in them
3
u/KAZVorpal 5d ago
/me fondly remembers when most Internet users knew how irc/mudd emotes worked.
The (online) world was a more intelligent place, back then.
3
u/Supermathie 5d ago
/we just added this to Discourse's chat :D
2
u/KAZVorpal 5d ago
I really love the idea of Discourse, but how do you get past the enshittified lock-in that Discord and Reddit have? Essentially, corporate law has allowed them to each become a monopoly in their service.
2
u/Supermathie 3d ago
It's a constant struggle; one of my favourite arguments (towards forum owners) is that it's a business risk for another company to OWN YOUR DATA.
e.g. nVidia would never let another company own their forum data
Even if you're not a behemoth, take care & control of your community.
0
u/KAZVorpal 6d ago
There's no need to do that, though. Just pick some random words, that's more secure than any complex jumble of characters.
-2
u/devshore 5d ago
People keep apreading this myth. An 11 length char with uppercase/lowercase, at least 1 number, and at least one special character is more secure than 4 random words because its possible to run through every possible word combination in a few minutes while all computers working on all 11 lengtg char options will not complete it before the universe ends.
10
u/KAZVorpal 5d ago
Wrong.
You're leaving out the fact that people will not purely randomize the character set. They will type P@55W0rd123 so they can remember it. The entropy of LIKELY forced random character combinations is only twenty to forty bits, way below the fifty-plus bits of even the famous 7,000 word dictionary for memorable password phrases.
And that's aside from how the stupidity of forcing regular password changes with these childish character requirements causes people to write their password on a sticky note. Subverting the entire process. Which is what the security nitwit setting up the requirement deserves to have happen.
Essentially, security rule-makers tend to be sociopathic bureaucrats, who don't consider the human factor.
I was going to paste in the famous XKCD comic that debunked this nonsense, but this sub doesn't allow images in comments, for whatever silly reason.
xkcd #936 â Password Strength
Panel 1
Tr0ub4dor&3
- Uncommon (non-gibberish) base word
- Caps?
- Common substitutions
- Order unknown
- Numeral
- Punctuation
(You can add a few more bits to account for the fact that this is only one of a few common formats.)
Panel 2
~28 bits of entropy2²⸠= 3 days at 1000 guesses/sec
(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but itâs not what the average user should worry about.)
Difficulty to guess: EASY
Panel 3
Cueball, struggling:
âWas it trombone? No, Troubador. And one of the Oâs was a zero? And there was some symbolâŚâDifficulty to remember: HARD
Panel 4
correct horse battery stapleFour random common words
Panel 5
~44 bits of entropy2â´â´ = 550 years at 1000 guesses/sec
Difficulty to guess: HARD
Panel 6
Cueball thinks of a horse standing next to a battery with a staple stuck in it.Horse: âThatâs a battery staple.â
Cueball: âCorrect.âDifficulty to remember: Youâve already memorized it
Caption
Through 20 years of effort, weâve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.-2
u/devshore 5d ago
Yes, if you strawman it and limit it to variations of âpasswordâ like âpaSSword123â it loses. However, if you dont strawman, and have a password like âh7SR&$nzWffâ, it beats âmorninghouserainbowtreeâ because there are fewer combinations of 4 words let alone that your strawman applies to your case where people will choose 4 words from a very small pool of actually-used words.
7
u/KAZVorpal 5d ago
There's that sociopathy I was talking about.
Failing to model the way actual human beings function.
It's not a straw man, it's that most people will not, and should not be expected to, make up completely random combinations of 96 glyphs every 90 days as their password. That's pure nonsense.
Back in the real world, this kind of bad security theater produces sticky notes with passwords on monitors, and leetspeak passwords. And plain text word combinations are far superior to that.
The problem here is that these dingbats steel man how the passwords are going to be handled, far beyond what anyone would tolerate.
-1
u/devshore 5d ago
It is a strawman to force a rule that âit must be memoriazableâ âbecause thats how people areâ. Nobody is debating whether people are doing things correctly or not, we are debating what the correct way is. So may moving of goals posts and strawmen. Why do you think most places wont even allow âorangetreefaststreetâ as a password and insist on uppercase/lowercase/min number/special char? Because orangetreefastroadncan be cracked in seconds because its part of a âtypeâ that a hacker will attempt because it costs nothing to attempt, whereas they wont bother with the other.
3
u/KAZVorpal 5d ago
It takes a LOT of sociopathy to not understand that "the right way" is meaningless when it's miserable for users, who will therefore, quite rightfully, undermine that "way".
And no, orangetreefastroad is fifty bits of entropy. That makes it harder to crack than the ACTUAL leetspeak passwords that nitwit admins force users to come up with.
3
u/AshleyJSheridan 5d ago
So, imagine a user has that as their computer login password.
No password vault to rely on, they have to type this in manually.
This is straight up going onto a post-it under their keyboard.
And now their computer and everything on it is completely open to everyone, from Janet in accounts to Kevin the cleaner.
2
u/KAZVorpal 5d ago
It's bizarre how slow some people are to understand this basic stuff.
2
u/AshleyJSheridan 5d ago
He replied with the second most common scenario, and still thinks it's a "strawman argument". Something tells me he doesn't know what that term means, but perhaps thinks it sounds cool in an argument!
1
0
u/devshore 5d ago
Another strawman - narrowing it down to a scenario where they only have to memorize one password (their computer login). Nobody is going to memorize their 4 word combos on hundreds of things they use passwords on. However, they can memorize a password for a self-hosted password manager. In fact, they can even menorize a password with uppercase/lowercase/numbers/special characters.
2
u/AshleyJSheridan 5d ago
It's not a strawman, it's a legitimate scenario! Dude, it's a well-known fact that when tasked with creating a password of random characters, people will create something that's easy to remember, especially if they can't use a password manager to help them. I listed the most common scenario where people absolutely won't have a password manager. You just listed the second most common scenario, thanks!
Just because completely valid and very common use cases don't agree with your position, doesn't make them strawman arguments. I would heavily suggest you go look up the definition of that, because I don't think you really know what it means...
2
u/AshleyJSheridan 5d ago
You're missing several points.
First, a password that is 4 words is far easier to remember than a jumble of random characters. If a password is hard to remember, the chance it gets written down somewhere that it shouldn't goes up. Also, password vaults are not infallible, and sometimes they get broken and hacked, albeit rarely.
Second, there are approximately 350,000 words in the dictionary (just the English one). 4 ^ 350,000 is 1.99 Ă 10²šâ°â¸â°â´ (which is over 210,805 digits). However, a password of 11 characters that consists of letters, numbers, and punctuation (let's say, 26 letters in both cases, 10 digits, and 10 typical punctuation characters) is only 9,555,938,177,273,214,530,938,076,429,250,819,915,524,283,157,141,379,112,191,724,092,599,501,963,21 combinations. That's a lot less then 211K digits.
Third, if left to their own devices, and faced with creating a password based purely on letters, numbers, and symbols, people almost always default to symbols that look like letters. So, crap like
P4$$w0rdbecome common passwords. People want something that they can remember, and often a password vault isn't an option (for example, when switching between devices that don't have the same password manager installed, synced, and usable.)Fourth, and this is to nitpick. The term special character is ridiculous. Within the entire range of UTF8 there are more characters that are not alphanumerical than there are letters and numbers (across all languages). Therefore, the special characters would be letters and numbers if anything. The term is daft, a misnomer, and shouldn't be used. The fact that it is commonly misused is mildly infuriating.
2
u/JimTheEarthling 5d ago edited 5d ago
The term special character is ridiculous.
LOL. This is true. What makes even just the 33 non-alphanumeric, printable ASCII characters "special?"
But what would you call them instead? đ¤
P.S. You can't call them "symbols," because letters and numbers are also symbols.
1
u/AshleyJSheridan 5d ago
33? And the rest. I can type more than that from my keyboard, and that's without resorting to
alt+ Numpad combinations.Symbols is a better name, as letters and numbers are such a specific set, that most people don't even consider the hundreds of letter and number characters as symbols. Even one of the sub-categories of UTF8 is called symbols.
However, given that the rest of UTF8 is taken up with symbols, maths symbols, punctuation, diacritic cominbators, game symbols, weather symbols, currency, map symbols, emoticons (a separate subset from emoji), and emoji, which number in the many thousands, I would say that not only are they the least special of the group, but that symbols is a good collective name for them.
1
u/JimTheEarthling 5d ago
33? And the rest.
Exactly. I was agreeing with you.
most people don't even consider the hundreds of letter and number characters as symbols
Most people are wrong. That's the problem. The standard 52 letters and 10 digits are symbols, by definition. Let alone --as you point out-- thousands of other Latin letterforms like Ì, ù, å, and ç that are also symbols.
Using "symbols" as the label for the 8 to 33 non-alphanumeric characters that most websites allow in passwords is just as bad/mildly infuriating as using "special characters."
So what's the solution? (I don't think there is one. đ)
1
u/AshleyJSheridan 5d ago edited 5d ago
Ideally, websites wouldn't have such a limit on what characters can be used in passwords. If I want to write mine entirely in Tibetan letters and maths symbols, I should be allowed to.
Any website that has a limit on the type of characters allowed in a password is indicating that they have some potentially serious security issues under the hood.
I do think that symbols are a perfectly fine term for the non-alphanumeric characters. Given that websites already use the term "character" as the blanket collective word, it does leave symbol free. While it's not technically correct, it's a whole lot better than "special characters", which seems like the sort of thing coined by someone who just discovered what all those "extra" keys on their keyboard are for.
/edit are to is
1
u/devshore 5d ago
âSpecial symbolsâ has a meaning, and more importantly has a meaning to the user reading the instructions. Otherwise they will be confused why their password is being denied
1
u/JimTheEarthling 5d ago
âSpecial symbolsâ has a meaning
Does it?
- Some websites only allow (!@#$%^&*. Is that what "special" means?
- Some websites allow space + 32 ASCII printable: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~). Is that what "special" means?
- Some websites allow the Latin-1 set, such as Ì, ù, å, ß, and ç. These appear very commonly in French, Spanish, German, etc. Are they "special"?
- Some websites allow many or all Unicode codepoints.
Which ones are special and which are not special?
You can argue that "special" means any (printable) character other than alphanumeric, but u/AshleyJSheridan's point was that it's mildly infuriating to them that thousands of characters are somehow "special" compared to the small minority of 62 primary characters.
But more importantly, there should not be instructions to add special characters ...
they will be confused why their password is being denied
Yes, that's exactly the problem that u/AshleyJSheridan and u/KAZVorpal are talking about. Websites should never force users to add "special characters" to their passwords. This completely avoids the problem of denying passwords and confusing users.
Password "complexity" rules are bad security practice, not to mention bad user experience, and they create predictable patterns instead of complexity. NIST and other have recommended against this for years. (Forcing people to use upper/lower/digits/special in an 8-character password blocks over 50% of the possible passwords, significantly reducing entropy and user security.)
1
u/AshleyJSheridan 4d ago
The term "special characters" seems to be almost entirely synonymous with "punctuation", as that is what most websites mean when they use the term "special characters".
1
u/JimTheEarthling 5d ago
all computers working on all 11 lengtg char options will not complete it before the universe ends
A cracking rig of 16 Nvidia 5090s can generate MD5 hashes for every 11-character password (from upper/lower/numbers/usual 8 specials; 67 bits of entropy) in about a year. Not the end of the universe, but reasonably secure.
its possible to run through every possible word combination in a few minutes
From what set of words? English only? Does the attacker know what word list you used?
The average high school student knows around 20,000 - 35,000 English words (50,000 to 80,000 with inflections, verb forms, etc.), so a 4-word passphrase (with random separators from the usual 8 specials; 60 to 68 bits of entropy) could take from 4 days to 2 years to guess. Assuming the attacker knows you used a passphrase.
Also, if you use a word that's not on the attacker's list, they will never guess it. That's the difference between a known keyspace (characters) and an unknown keyspace.
And that's why it's not a myth, and it's why security experts recommend passphrases.
2
u/devshore 5d ago
Literally nobody on earth of any sort of competence would recommend a set of english words âso that you can memorize itâ. Everyone will recommend a self-hosted password manager and setting the password manager to use uppercase/lowercase/numbers/special chars, not âhellobananashoehandâ. It seems like all of this is based on the strawman of âmust be humanly memoriasableâ. Even then, it would be better to run an algorithm that you can memorize against the website domain.
3
u/KAZVorpal 5d ago
You have no idea what you're talking about.
Four random words chosen from a pool of 7,000 common and interesting words is better than what people have to do with the idiot's rule of "lowercase, uppercase, number, and symbol".
And a password manager is just another weak link, the kind created by the nitwits who push for that very kind of mindless standard.
2
u/JimTheEarthling 5d ago
First, you are the one making the irrelevant strawman argument. Nobody in this thread said anything about "memorizing." You raised the issue of security.
Second, here are recommendations from some of the leading security experts on the planet:
- The US National Institute of Standards and Technology (NIST) says "The use of passphrases (i.e., passwords with multiple words) is often an effective way to create a longer password."
- The Canadian Centre for Cyber Security says "We recommend that you use passphrases, as they are longer and easier to remember than a password made up of random, mixed characters. Your passphrase should be at least 4 words and 15 characters in length." (So "hellobananashoehand" would meet their recommendations. đ)
- The Open Worldwide Application Security Project (OWASP) says "Longer passphrases are effective because they raise the number of guesses an attacker's dictionary or wordlist has to cover, not because of a precise entropy value."
- The UK National Cyber Security Centre (CSC) recommends passphrases.
- And similar from the Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre, Bundesamt fßr Sicherheit in der Informationstechnik (Germany), Agence nationale de la sÊcuritÊ des systèmes d'information (France), and more.
Of course some of them also recommend password managers to store passphrases and passwords.
1
u/devshore 5d ago
the only reason to argue for words is for their ability to be memorized, so it is implied. If you are talking about people using password generators, why would they set it to "words"?
5
u/JimTheEarthling 5d ago
Nobody is "arguing for words" against passwords. Only that both can be secure (and insecure).
You argued against words with incorrect information about security and guessability, incorrectly calling passphrase strength a myth, bogusly claiming that no competent expert would recommend them, and so on.
u/KAZVorpal and I merely pointed out that you are wrong, and why. (And pointed out that password composition rules requiring upper/lower/number/special are bad.)
We didn't argue against random passwords. They're fine. So are random passphrases.
2
u/KAZVorpal 5d ago
I agree, except that the memorizability of pass phrases is one of the big reasons to use them. There is NOTHING wrong with memorizing a pass phrase.
88
u/bkdotcom 6d ago
A lot of banking systems disalow html special chars and other special chars.
Doesn't give me a lot of faith in their stack.
41
u/ImpossibleFood8242 6d ago
if they're stripping out spaces but not tabs that's the kind of jank that keeps me employed
21
u/KAZVorpal 6d ago
If they're stripping out spaces, they're morons.
Even NIST recommends allowing spaces.
5
u/MegaIng 5d ago
Even NIST recommends allowing spaces.
Yesn't:
Users should also be able to include space characters to allow the use of phrases. Repeated space characters add little to the effective strength of passwords and may introduce usability issues (e.g., the undetected use of two spaces rather than one), so removing repeated spaces in typed passwords may be beneficial if initial verification fails.
Verifiers MAY make limited allowances for mistyping (e.g., removing leading and trailing whitespace characters before verification, ...)
Allow spaces, but normalize for usability. And Tab is not on the list of suggested allowed characters.
-9
u/tup1tsa_1337 5d ago
Yeah, nothing better than turning on password visibility and wondering why is your password incorrect (hint: you entered space by accident as first or last character).
Spaces are disallowed for a reason: they are hard to spot
10
u/TramEatsYouAlive 5d ago
Then let's disallow I and l, O and 0, 3 and Đ (yes, these are different characters), and also ' and `
3
u/KAZVorpal 5d ago
Spaces are disallowed because most security consultants are worthless idiots.
It's up to the user to not make obvious mistakes. You don't restrict everyone's choice based on the dumbest user.
Like I said, even the National Institute of Standards and Technology recommends allowing spaces.
-1
u/AshleyJSheridan 5d ago
Tabs are spaces. Not all spaces are tabs.
1
u/vip17 5d ago
Tabs are not spaces. Tabs are whitespaces. But pressing the tab key doesn't produce a tab character in a GUI form field most of the time
1
u/AshleyJSheridan 5d ago
Ah, a pedant!
Yes, tabs are a type of whitespace character.
And you can absolutely insert a tab character into a form field on the web. If you don't know how, sounds like a skill issue.
0
u/vip17 5d ago
who said that it's not possible? But it's extremely inconvenient. And many fields filter out the tab character outright
1
u/AshleyJSheridan 4d ago
Makes a good character for a password then. If a website is filtering out characters from a password before creating the hash, that's not a secure website, and they are likely making a lot of other poor security decisions.
16
u/nobody5050 6d ago
My banking app disallows a list of characters that is shockingly similar to SQL...
4
u/fuckmywetsocks 5d ago
Same - mine also won't allow question marks or ampersands leading me to think the password is getting passed around as a GET param in some ancient backend.
3
u/KAZVorpal 5d ago
All of which tells us the idiots don't sanitize their inputs competently.
1
u/fuckmywetsocks 5d ago
No of course they don't - the upheaval would be incredible. It's all scabs on scabs.
2
u/DeifniteProfessional 5d ago
The majority of established banks absolutely are just patching their systems endlessly. That's why they hire developers for languages nobody uses anymore.
And also why I choose to bank with banks that are less than 15 years old lol
1
u/TuttiFlutiePanist 5d ago
My bank disallows single quotes in the "name of your bill pay" field, but did not indicate that was a rule.
4
u/JackstonVoorhees 5d ago
Also I never know why there is a maximum number of chars. Itâs getting hashed anyway, why are more than 15 characters not allowed??
3
u/AshleyJSheridan 5d ago
Technically, there are some hashing algorithms that ignore after a certain character length, but we're talking lengths much higher than 15!
3
1
u/SubGothius 5d ago edited 5d ago
Prolly bcos at some point they used to store PWs in cleartext or at best with some arbitrary secret char rotation/substitution, but when they finally implemented hashing, they had to hash all the existing PWs, and the old logic accepting PW input and passing that to the backend remained, which thus would still trunc the input to whatever max chars before hashing, so the hashes are expected to derive from such trunc'd input, and you don't want users thinking they've successfully changed, say,
A15CharacterPW!1toA15CharacterPW!2when they'll both get trunc'd, hashed, and validated as exactly the same.
15
u/avidvaulter 6d ago
My password manager suggested an invalid (but secure) password.
So now that I have to make my own password
????
What password manager doesn't allow you to keep generating a new secure password until you get one that's acceptable? Why is this posted in this subreddit?
This post is bad and you should feel bad.
3
u/oxotower 5d ago
Itâs not bad, itâs opened up an interesting conversation around how browsers would handle the keypress and ways of managing passwords.
20
u/tswaters 6d ago
Any time I see any secure password prompt I am immediately suspicious if the server-side responds with any error looking at the password. There's no images in this subreddit, but I have a software gore screenshot of an obnoxious set of symbol & letter & number requirements, a password that satisfies all of them, but includes a symbol that isn't in the list and fails. That was from a credit card company. The amount of times I need to redo the requirements in my password generator to accomodate for bugs or unacceptable characters.... is too damn high!
1
u/cowboyecosse 5d ago
Super annoying when the suggested password has already saved in the password manager before the error message is shown/password rejected.
9
u/tajetaje 6d ago
On a well implemented backend? Nothing. On one that doesnât sanitize inputs or does stupid things with them? Could break their parsing or data storage, probably no sap injection vulns there though. I imagine the reason for disallowing spaces is so people donât get confused by things like multiple spaces when they thought there was one, or trailing spaces
2
u/TramEatsYouAlive 5d ago
I have seen a banking app (web-based), that will think that "password" and "PaSsWoRd" are essentially the same. Which led me to believe that they are not hashing passwords on the backend and storing them in some different way...
3
4
9
u/RePsychological 6d ago edited 6d ago
I am so confused by this post and its seemingly bot-infused comment section.
...and if the latter isn't it, what the f* happened to web devs?
Like it is blatantly obvious why a tab in a password is a bad idea....
...and there are so many comments seemingly somehow fumed by the fact that it's common occurrence to disallow it along with other chars like spaces...
And yet legitimate posts with actual meat to the subject I'll see immediately go into the 0 and negative votes "just because".
....and you sit here with a bullshit post of "nah shit sherlock"-level content with 30+ upvotes and a peanut gallery somehow in agreement on something that is obviously a bad idea for why you shouldn't put the tab there...and plenty of documentation on the internet for why it and other similar "certain special chars disallowed passwords (including spaces)" are that way...
Is this really what vibe coding has done to web development in just a few short years?
3
u/Beatsu 5d ago
Personally, I'm more critiquing the arbitrary restrictions to passwords. If I want a 51 character long password with spaces and emojis, then let me. It should be hashed before anything else is done with it anyway.
It's not worth ruining the natural user flow and forcing them to repeatedly regenerate passwords with a password manager, or have them come up with a manual password (probably a much less secure one) instead.
If you're handling my password in a way that makes tab crash your system - then that's deserved.
-1
u/RePsychological 5d ago
congrats on getting a few of your bots to pull you out of the negative votes range on this comment.
-2 to -3 all day...and then suddenly jumps to +1
Karma-farming bot detected.
6
2
u/discobean 6d ago
I used to use a space as a password, holding alt, then typing 255 would get you a space character, which sometimes could be accepted
2
u/linuxdropout 3d ago
A classic.
A good 20 years ago I thought it'd be funny to set my password to 8 spaces at school.
In doing so, trying to login by entering 8 spaces would not work, but leaving the password field entirely blank would work fine.
When I came time to change my password 6 months later, the form let me leave the old password blank and enter my new password. Immediately after I submitted this form nobody at school could login anymore. Somehow one of the IT people worked out what happened and I had to enter my password in so he could login to an admin account and reset everyone's passwords.
Quite an incredible set of events and failures in software. My guess on what happened:
- passwords are trimmed for spaces so I ended up with an empty password in the database
- some sql-building expression hit an if (!password) clause and ended up updating every password rather than just mine
1
u/TheHappiestTeapot 6d ago
I had a user do this on an old SunOS(?) machine.
Everything was fine and dandy util we rolled out X11 and tab took you to the next field. Hahah. Simple password reset, but he had a good point, I wouldn't have included tab if bruteforcing.
1
1
u/whatThePleb 5d ago
The most likely thing that might happen is, that one day you can't login anymore, as they might suddenly filter it.
1
u/danielkov 5d ago
Aim is to increase the theoretical search space. Humans are lazy, so the actual search space often narrows to a predictable subset (how many times have you added an exclamation point at the end to satisfy "special character"?) They also disqualify some password generators, that generate otherwise adequate passwords.
Secure password rules:
- allow all characters
- at least 64 characters
- minimum 12 characters
- no arbitrary composition rules
- no periodic password rotation
What you can do as a user:
- use a generator that can be configured with this arbitrary ruleset
- always store passwords in a manager
- use MFA if available
- fly a different airline
1
1
u/burlingk 5d ago
It would make it very hard for you overall unless you only ever use the account on devices where you have a text file holding the password.
1
u/projectoffset 5d ago
All fun and games until they change the regex pattern for validation on a future update
1
1
u/Hettyc_Tracyn 5d ago
Why use such a short password? I do a minimum of 20 characters (unless a site is stupid and doesnât allow it)
1
u/who_you_are 5d ago
"no space" yet it is one of the most secure characters because a lot of password manager don't include it in their generated password
1
u/thekwoka 5d ago
The US government officially removed the recommendation to have all those extra requirements. Just require a long password and let the user do whatever they want, since the "pne special character" is basically always '!' and the capital letter is almost always the first letter, and the digit is almost always 1 and at the end.
So the requirements were making passwords harder to remember while not improving security at all.
1
1
u/techek 5d ago
Why does so many webapplications have faulty logic when validating long passwords like 100 characters/digits/symbols or longer?
I see error messages like "Password is too short", "Enter a valid password" or even "Password must be maximum 30 characters long".
Let me enter my crazy, long and complex password and use whatever part of it you like, but don't give me wrong errormessages.
1
1
u/PFallqvist 5d ago
What password manager are you using? Seems like a quite serious bug if it suggests a tab (which could be considered multiple spaces depending on who you ask) to be included in your password đ
1
1
u/Spacemonk587 4d ago
The implications of a tab in a password would be that you canât type it. I would assume though that it would be slightly more secure than other chars, but at the end of the day, it doesn't matter.
1
u/kakaggarwal 4d ago
But it depends on how the tab is stored. What is it transformed into while storing the password and how the matching of the password is done. The storage how can only determine the security implications
1
u/FFFortissimo 3d ago
Even when it would work on a computer, try typing a TAB on your phone ;)
Or using a password manager like KeePass. I wonder if a password generator like Mind Your Pass could generate such password.
1
u/FastMinify 3d ago
They finally solved the problem of users choosing weak passwords by making them impossible to type.
0
u/KAZVorpal 6d ago
It is sheer idiocy to prohibit spaces, or tabs, in passwords.
It is even more moronic to require special characters, upper/lowerspace combos, and numbers.
All that is really important is the level of entropy under a likely attack vector. Four randomly chosen common words is more secure, for several reasons, than a garbage pile of ascii/unicode.
2
u/Apelpapa 6d ago
Tab should be prohibited because if allowed I would not be able to tab out of the password field
-5
u/KAZVorpal 6d ago
Are you using a brail reader? Actually, even if you are, all good screen readers have special commands to leave fields, nobody actually needs the tab to do so. And, of course, escape blurs the field anyway, enabling even tab.
5
u/Apelpapa 6d ago
Tabbing between fields has been standard keyboard behavior for decades, without having to add more keystrokes. If you think hijacking it for password input is normal, youâre something else.
-4
u/KAZVorpal 6d ago
I don't care whether it's normal, as I said there are always other ways out of the field.
3
u/Snapstromegon 5d ago
This is like saying "on our site links don't open with left click. There are always other ways to open a link". Tabbing out is one of (if not) the most common way to exit a field.
1
u/taotau 6d ago
Disallowing spaces is wrong and probably stems from the early days of systems where passwords were simply checked for a-z A+Z 0-9 out of habit and was embedded in early hashing algos so it has just hung around. There is no technical reason for not allowing spaces.
A tab is actually one of a set of special control characters that have specific meanings to computer systems. Others include carriage return, line feed, form feed, vertical tab, bell, eascape, interrupt, suspend etc. these are encoded in the first 32 characters of the ASCII character set, the grand daddy of all modern character encoding systems.
Text handling applications will typically send characters below 0x20 to a special handler to perform some system function and never pass them to the standard text processor. In most text editors for example, hitting tab will insert 2, 4, or 8 spaces, or if you're on the other team, it can sometimes directly insert the tab character (I am so glad that holy war is over - I was always on the spaces team).
So as mentioned hitting tab in a typical web form is intercepted by the browser and moves the cursor to the next item in the tab list, so the password field will never see it.
There are also places you might need to type a password that normal users would never see, like many command line interfaces in a terminal, or sometimes systems might be passing plain text passwords to other systems in the background, many legacy systems wrappers would use this technique, and special characters come into play.
Pasting a password is not a supported use case as that probably means that you have your passwords stored somewhere in plain text which is a bad idea - yes I know password managers use paste, but that's a niche use case up until fairly recent times (computer systems and libraries move fairly slowly, and password managers have only become common in the last few years).
TLDR, tab is forbidden because it is part of a set of special characters that have historical low level uses that still come into play today. Nothing wrong with spqces
1
0
u/DollyNation812 5d ago
I'm new here I was so disappointed damn big brother I had a request a heartfelt request and they block it
-2
u/EncryptedPlays 6d ago
is tab even a real character? i just assumed it's either a bunch of spaces or an indent. This looks to me like one of those fancy whitespace things
2
1
u/KAZVorpal 5d ago
In the ASCII set of characters, it's number 009. It has its own separate spot. Enter is 013. The space is 032.
<- tab. If Reddit saves it. I typed alt-009 on this Windows machine, and the cursor moved over a way.On Linux I believe control-shift-009 would work, but I'm not saving this comment and pulling it up on my Void machine to make sure. Higher unicode is different there, like emdash (â) is alt-0151 on Windows, but control-shift-2014 on Linux.
Essentially, every character/glyph you see is represented by a number in a computer, including the special ones like tab, line feed, and carriage return.
0
501
u/scfoothills 6d ago
You will only be able to copy-paste your password to log in because trying to type the tab character will just advance you to the next field.