4 ms·

Some of the restrictions of special characters I can somewhat understand: Depending on the keyboard layout, many of these often disallowed characters require pr

by pilif 10y ago

Some of the restrictions of special characters I can somewhat understand: Depending on the keyboard layout, many of these often disallowed characters require proper right-alt support to be set up in order to be typed. People tend to get these wrong or to be unaware of the currently set keyboard layout which will cause support issues. Same goes for non-ASCII characters where this also depends on the browser configuration and version as they still get the encodings wrong at times. Yes. For us advanced users using password managers this is a non-issue as we're pasting anyways, but for people typing the passwords manually, this can be a problem. Case in point is me setting up new linux boxes and always using a safe initial password (long but pure ASCII) knowing that I'can't be absolutely sure I've configured the keyboard layout correctly. I've started this practice after having been forced to force-reset my password via the `init=/bin/sh` boot argument as the first step after the install :-) What I absolutely don't get though is maximum lengths on passwords. You should be hashing them anyways, so setting a maximum length is completely pointless.

Nadya 10y ago
What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... QWERTY isn't the only keyboard layout. Nor do you need right-alt support to type things like é or ç, you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems). >Case in point is me setting up new linux boxes and always using a safe initial password (long but pure ASCII) knowing that I'can't be absolutely sure I've configured the keyboard layout correctly. That is smart for an initial password that you change once you know your keyboard is configured properly. A temporary password while spinning up a new machine isn't too big of a security deal if you're going to be changing it within a few hours anyways.
- pilif 10y ago
  > What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... I have had to deal with people not being able to type their passwords because a character wasn't on their current keyboard of choice (some people use iPads and don't know how to type a # for example) > you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems) you're giving way too much credit to the knowledge of the average computer user.
  - Nadya 10y ago
    >you're giving way too much credit to the knowledge of the average computer user. If they're creating a password with ß in it I'm assuming they know how to type ß, yes. I don't expect the average user to know how to type ß. :)
    - detaro 10y ago
      And then they travel and use a different device with a different keyboard layout and suddenly they don't know how to type ß anymore.
      - deleted 10y ago
        [deleted]
      - pilif 10y ago
        Also that ß submitted by one browser is \xc3 \x9f in one browser and \xdf in another and \xe1 in yet another. Sure - if the client behaves correctly, you'd know what it arrives as, but some browsers don't and suddenly the password 'foobar' can be used to log-in, but 'foßbar' can't. By not allowing non-ascii characters in the first place you remove a whole class of support issues.

by pilif 10y ago

Nadya 10y ago

What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... QWERTY isn't the only keyboard layout. Nor do you need right-alt support to type things like é or ç, you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems). >Case in point is me setting up new linux boxes and always using a safe initial password (long but pure ASCII) knowing that I'can't be absolutely sure I've configured the keyboard layout correctly. That is smart for an initial password that you change once you know your keyboard is configured properly. A temporary password while spinning up a new machine isn't too big of a security deal if you're going to be changing it within a few hours anyways.

pilif 10y ago
> What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... I have had to deal with people not being able to type their passwords because a character wasn't on their current keyboard of choice (some people use iPads and don't know how to type a # for example) > you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems) you're giving way too much credit to the knowledge of the average computer user.
- Nadya 10y ago
  >you're giving way too much credit to the knowledge of the average computer user. If they're creating a password with ß in it I'm assuming they know how to type ß, yes. I don't expect the average user to know how to type ß. :)
  - detaro 10y ago
    And then they travel and use a different device with a different keyboard layout and suddenly they don't know how to type ß anymore.
    - deleted 10y ago
      [deleted]
    - pilif 10y ago
      Also that ß submitted by one browser is \xc3 \x9f in one browser and \xdf in another and \xe1 in yet another. Sure - if the client behaves correctly, you'd know what it arrives as, but some browsers don't and suddenly the password 'foobar' can be used to log-in, but 'foßbar' can't. By not allowing non-ascii characters in the first place you remove a whole class of support issues.