Hacker News Reader

Comment by axefrog | Hacker News Reader

I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...

View on HN

I had this annoyance with FastMail[0], recently. They give this justification for their restriction:

    FastMail provides a lot of different services over many
    different protocols. To ensure that your password is
    compatible with all of them, and the many (often
    slightly buggy) clients out there, we only allow
    the characters A-Z, a-z, 0-9 and !?@#$%^&*()-=_+[]{}.,:;<>/\|~"'`.

Which I understand, but how about a checkbox that says "for goodness sake, I'm a grown up, I promise not to moan if I use a "buggy" client, now please let me the password of my choosing."

[0] https://www.fastmail.fm/help/account/password.html

Spaces do however sometimes cause some problems on html forms. For instance, they get trimmed off the end of each value of a form when the request is sent (happens on Chrome at least).

There was another gotcha I noticed with spaces and html forms once; an option in a select list with multiple consecutive spaces in the middle of it had those spaces reduced to one space when the request was sent (once again, happens on Chrome at least).

Twitter is also included in the list of annoying sites. I think AppleID is one too, their password policy just sucks anyway, I'd love to see the stats on the amount of "Forgot Password?"'s on their service

you can try camelCasing your passwords, same effect really

Passwords don't need to be legible in the first place. There's nothing wrong with correcthorsebatterystaple.

On the other hand, forbidding spaces is absolutely misguided.

Unless the website silently lowercases all passwords. A lot of them do, in the name of making life easier for people who have Caps Lock on.

IIRC Facebook creates three passwords to deal with character case issues; the one you enter, an inverted case version and a version with the first characters case inverted.

I'd be very surprised if they created all 3. They probably check the other 2 variations if the first one fails though:

  if (entered == password || entered.swapcase() == password) .. // etc

In order to be performant, since the check is not against your actual password but just against a stored hash (salted/bcyrpted/etc), I wouldn't be surprised if they simply stored all 3 hash results.

Reply on news.ycombinator.com