Hacker News Reader

Comment by _0ffh | Hacker News Reader

Also, don't restrict allowed characters unnecessarily. It's just stupid to have "Use special characters, but only !$() and _ are allowed!". God, why?

View on HN

Also, do restrict allowed characters when necessary. If one of your apps doesn't allow me to input a particular special character in the password field, don't allow me to have that character in my password.

What kind of situation occurs where you can't input special characters in a password field?

I think in general the advice is that there should not be any limitations on special characters anywhere in the tech stack at all. (Including a broken UI that won't let you input special characters.)

The situation you described sounds more to me like a very poorly written application.

There's one restriction you should do, trim spaces from the start and end of a password (or any input field, for that matter, unless there's a good reason not to). People copy/pasting from emails or Word documents are good at accidentally picking up spaces.

Sometimes the device you're logging in with doesn't have the full range of character sets available. This has happened to me with set-top boxes in the past.

In some cases it's laziness, but in some cases it's because you're looking at the frontend to a legacy system. Especially if it's a bank or other finance site, there is a good chance it fronts a system from the 70s that can only take 8 character passwords and special characters blow it up.

Oracle allows (not sure if still true) alphanumerics and _, $, and #, and some websites just mirrored those rules. Oh and by alphanumerics I'm not even sure that includes anything outside of 7-bit ASCII.

I’ve always assumed this was a reserved character escaping issue that a dev didn’t want to tackle.

Reply on news.ycombinator.com