Hacker News Reader

Comment by wwweston | Hacker News Reader

The only line of reasoning in the article that seems somewhat convincing to me is Microsoft's point that stronger passwords don't prevent phishing, malware, or compromise via another site (and I'm not sure about the third one -- I guess it's true if the other site is storing passwords in the clear, but if they're hashed, I'd think stronger passwords would be harder to get using rainbow tables). But even if it's true that password strength isn't the weakest link for MS, why not allow for stronger passwords anyway? Is it really a big investment that would require tradeoffs to make that kind of change?

Evernote's reason seems more like an admission of a technical debt than any kind of defense.

AT&T's reason doesn't make sense either -- if users don't like entering certain characters on a mobile phone, they can pick a different password.

View on HN

"Evernote's reason seems more like an admission of a technical debt than any kind of defense."

Our eyebrows are only raising because an article with a strong focus on passwords was written and they saw fit to include this tidbit. In isolation I doubt any of us, including the developers of this particular little thing, sees it as something worth caring about. The point about leading or trailing spaces is definitely true, and who cares if you can have spaces in the middle? If your password policies are so awesome that that is your biggest problem, I'm ready to declare victory and move on.

Eh, spaces are nice if you want to have an actual passphrase.

Exactly!

Passphrases are lame.

You use the "passphrase" thing in a system that silently ignores the extra characters (see below for "brokerage and banking company Charles Schwab" which does just that), and "wonderful undefeated password ftw" becomes "wonderful" (trivially cracked with a dictionary attack). Pwned.

Or you get your way, and, as a naive user, use a common passphrase, included in more involved attacks. Like "rage against the machine", "let me in", "my secret password", "empire strikes back", etc. Pwned.

Or you end up with 30 passphrases in 30 different systems. Or, since a lot of them don't allow long password, you end with a mix with passphrases and short passwords.

Might as well have used a password management app with cryptic generated passwords all along.

There's no technical reason for this. It's all about reducing their support burden. I wish they'd just be honest.

Sounds like lack of technical thinking if it actually reduces support burden. It's trivial to just remove spaces before storing the password, allowing authentication with or without spaces. I'm not sure why people don't realise that normalizing the password before saving the hash is acceptable, so long there's still enough password material being used.

So.. IF I would buy the argument that leading/trailing spaces are evil: How would the expression triple in size by exclusing those?

And more important: Why is that relevant in any way? An article about maximum password length presents a quote that reads like "that's over our maximum regex length".

Certainly no big deal, but I can't help raising my eyebrows at that line of reasoning..

> if users don't like entering certain characters on a mobile phone, they can pick a different password

Fundamentally, I don't think it's unreasonable to try to protect users from themselves.

Only in america. Because people in other parts of the world actually have a brain.

Thank you for the important reminder that Americans are sub-humans and have a monopoly on the world supply of stupid.

I'm not sure if you meant this is sarcasm, but I read this quote as being more appropriate for an Onion-type article than for a serious discussion about security.

You do have a valid point. I used to have a password with a backtick (`) in it. That is a standard key on a QWERTY keyboard but seemingly untypeable on an iPhone. I didn't realize that until I actually tried to enter that password on my iPhone.

Here's how to do it: Hold down the apostrophe key until a menu pops up showing similar characters, then choose the backtick.

Good to know. I am not sure if that is a relatively new feature, but a quick Google search didn't reveal the answer when I initially ran into the problem. It was easier to just change my password than to delve too deep into it.

Or change your password using a computer, to a more iphone friendly password.

Reply on news.ycombinator.com