3 ms·

What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... QWERTY isn't the only ke

by Nadya 10y ago

What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... QWERTY isn't the only keyboard layout. Nor do you need right-alt support to type things like é or ç, you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems). >Case in point is me setting up new linux boxes and always using a safe initial password (long but pure ASCII) knowing that I'can't be absolutely sure I've configured the keyboard layout correctly. That is smart for an initial password that you change once you know your keyboard is configured properly. A temporary password while spinning up a new machine isn't too big of a security deal if you're going to be changing it within a few hours anyways.

pilif 10y ago
> What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... I have had to deal with people not being able to type their passwords because a character wasn't on their current keyboard of choice (some people use iPads and don't know how to type a # for example) > you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems) you're giving way too much credit to the knowledge of the average computer user.
- Nadya 10y ago
  >you're giving way too much credit to the knowledge of the average computer user. If they're creating a password with ß in it I'm assuming they know how to type ß, yes. I don't expect the average user to know how to type ß. :)
  - detaro 10y ago
    And then they travel and use a different device with a different keyboard layout and suddenly they don't know how to type ß anymore.
    - deleted 10y ago
      [deleted]
    - pilif 10y ago
      Also that ß submitted by one browser is \xc3 \x9f in one browser and \xdf in another and \xe1 in yet another. Sure - if the client behaves correctly, you'd know what it arrives as, but some browsers don't and suddenly the password 'foobar' can be used to log-in, but 'foßbar' can't. By not allowing non-ascii characters in the first place you remove a whole class of support issues.

by Nadya 10y ago

pilif 10y ago

> What? If a person is using a password that contains such a character, they'll know how to type it or at least find it to copy/paste... I have had to deal with people not being able to type their passwords because a character wasn't on their current keyboard of choice (some people use iPads and don't know how to type a # for example) > you just need to enable the US-International Keyboard layout (on Windows, I'm sure equivalents exist for other operating systems) you're giving way too much credit to the knowledge of the average computer user.

Nadya 10y ago
>you're giving way too much credit to the knowledge of the average computer user. If they're creating a password with ß in it I'm assuming they know how to type ß, yes. I don't expect the average user to know how to type ß. :)
- detaro 10y ago
  And then they travel and use a different device with a different keyboard layout and suddenly they don't know how to type ß anymore.
  - deleted 10y ago
    [deleted]
  - pilif 10y ago
    Also that ß submitted by one browser is \xc3 \x9f in one browser and \xdf in another and \xe1 in yet another. Sure - if the client behaves correctly, you'd know what it arrives as, but some browsers don't and suddenly the password 'foobar' can be used to log-in, but 'foßbar' can't. By not allowing non-ascii characters in the first place you remove a whole class of support issues.