3 ms·

What rule am i proposing? when am i "requiring" a special character? "correcthorsebatterystaple" is ok, "correct! horse battery Σtaple" is better. Why are you

by jfoutz 11y ago

What rule am i proposing? when am i "requiring" a special character? "correcthorsebatterystaple" is ok, "correct! horse battery Σtaple" is better. Why are you arguing i shouldn't be allowed to use any key on my keyboard? There is no reason to disallow any character in a password. let me use them all. limiting to A-Za-z0-9 is goofy and antiquated.

smsm42 11y ago
> "correcthorsebatterystaple" is ok, "correct! horse battery Σtaple" is better. "better" is a dangerous term. Better as for bruteforce guessing resilience? Sure. Better for security? That would be much less certain. Once you discover the users can't enter it on mobile (no Σ on default keyboard) you'd have to provide replacement mechanism for them or allow them to easily reset passwords. Which probably would be the way your security will be compromised soon. And, of course, the users will be losing such fancy passwords at incredible rates, which would generate a lot of noise on "password reset" system which would make it harder for you to detect abuse there. And that not even considering that humans are very bad at avoiding biases and choosing "random" character replacements - they probably would do the same thing in 90% of cases (yes, you are in the 10% of course, but that doesn't change the statistics), like replacing o with 0 and adding ! at the end. Which robots would defeat instantly. So it's not about forbidding you from using your special characters. It's that using them - on the whole, not for you personally - may not make any improvement, and if you force it, might actually make the matters worse. Encouraging long passwords that one can remember would seems to be actually better. Or doing away with passwords and using something else :)
- jfoutz 11y ago
  Not accepting all of unicode is mystifying to me. I've had to localize with code pages in the past. i'm probably scarred in horrible ways which causes a strong bias against the kinds of arbitrary limits people seem to be supporting. Anyway. Yeah, hopefully we'll come up with something other than passwords.

by jfoutz 11y ago

smsm42 11y ago

> "correcthorsebatterystaple" is ok, "correct! horse battery Σtaple" is better. "better" is a dangerous term. Better as for bruteforce guessing resilience? Sure. Better for security? That would be much less certain. Once you discover the users can't enter it on mobile (no Σ on default keyboard) you'd have to provide replacement mechanism for them or allow them to easily reset passwords. Which probably would be the way your security will be compromised soon. And, of course, the users will be losing such fancy passwords at incredible rates, which would generate a lot of noise on "password reset" system which would make it harder for you to detect abuse there. And that not even considering that humans are very bad at avoiding biases and choosing "random" character replacements - they probably would do the same thing in 90% of cases (yes, you are in the 10% of course, but that doesn't change the statistics), like replacing o with 0 and adding ! at the end. Which robots would defeat instantly. So it's not about forbidding you from using your special characters. It's that using them - on the whole, not for you personally - may not make any improvement, and if you force it, might actually make the matters worse. Encouraging long passwords that one can remember would seems to be actually better. Or doing away with passwords and using something else :)

jfoutz 11y ago
Not accepting all of unicode is mystifying to me. I've had to localize with code pages in the past. i'm probably scarred in horrible ways which causes a strong bias against the kinds of arbitrary limits people seem to be supporting. Anyway. Yeah, hopefully we'll come up with something other than passwords.