6 ms·

Also, don't restrict allowed characters unnecessarily. It's just stupid to have "Use special characters, but only !$() and _ are allowed!". God, why?

by _0ffh 5y ago

daveFNbuck 5y ago
Also, do restrict allowed characters when necessary. If one of your apps doesn't allow me to input a particular special character in the password field, don't allow me to have that character in my password.
- InitialBP 5y ago
  What kind of situation occurs where you can't input special characters in a password field? I think in general the advice is that there should not be any limitations on special characters anywhere in the tech stack at all. (Including a broken UI that won't let you input special characters.) The situation you described sounds more to me like a very poorly written application.
  - unilynx 5y ago
    There's one restriction you should do, trim spaces from the start and end of a password (or any input field, for that matter, unless there's a good reason not to). People copy/pasting from emails or Word documents are good at accidentally picking up spaces.
  - daveFNbuck 5y ago
    Sometimes the device you're logging in with doesn't have the full range of character sets available. This has happened to me with set-top boxes in the past.
technotarek 5y ago
I’ve always assumed this was a reserved character escaping issue that a dev didn’t want to tackle.
jedberg 5y ago
In some cases it's laziness, but in some cases it's because you're looking at the frontend to a legacy system. Especially if it's a bank or other finance site, there is a good chance it fronts a system from the 70s that can only take 8 character passwords and special characters blow it up.
- cratermoon 5y ago
  Oracle allows (not sure if still true) alphanumerics and _, $, and #, and some websites just mirrored those rules. Oh and by alphanumerics I'm not even sure that includes anything outside of 7-bit ASCII.

Also, don't restrict allowed characters unnecessarily. It's just stupid to have "Use special characters, but only !$() and _ are allowed!". God, why?

by _0ffh 5y ago

Also, don't restrict allowed characters unnecessarily. It's just stupid to have "Use special characters, but only !$() and _ are allowed!". God, why?

daveFNbuck 5y ago

Also, do restrict allowed characters when necessary. If one of your apps doesn't allow me to input a particular special character in the password field, don't allow me to have that character in my password.

InitialBP 5y ago
What kind of situation occurs where you can't input special characters in a password field? I think in general the advice is that there should not be any limitations on special characters anywhere in the tech stack at all. (Including a broken UI that won't let you input special characters.) The situation you described sounds more to me like a very poorly written application.
- unilynx 5y ago
  There's one restriction you should do, trim spaces from the start and end of a password (or any input field, for that matter, unless there's a good reason not to). People copy/pasting from emails or Word documents are good at accidentally picking up spaces.
- daveFNbuck 5y ago
  Sometimes the device you're logging in with doesn't have the full range of character sets available. This has happened to me with set-top boxes in the past.

technotarek 5y ago

I’ve always assumed this was a reserved character escaping issue that a dev didn’t want to tackle.

jedberg 5y ago

In some cases it's laziness, but in some cases it's because you're looking at the frontend to a legacy system. Especially if it's a bank or other finance site, there is a good chance it fronts a system from the 70s that can only take 8 character passwords and special characters blow it up.

cratermoon 5y ago
Oracle allows (not sure if still true) alphanumerics and _, $, and #, and some websites just mirrored those rules. Oh and by alphanumerics I'm not even sure that includes anything outside of 7-bit ASCII.