3 ms·

I found this very strange The permitted characters and length for passwords are defined as a regular expression in Evernote’s API, but spaces are left

I found this very strange The permitted characters and length for passwords are defined as a regular expression in Evernote’s API, but spaces are left out, Evernote says, because leading and trailing spaces presents a problem. “Software needs to precisely determine how to treat leading and trailing spaces,” Dave Engberg, Evernote’s CTO, told Ars. “Some UI frameworks and third-party applications would unreliably trim spaces, others would not.” What frameworks and third party applications are they passing the password through? And what kind of framework strips anything from a password field anyway? Sounds like the guy writing the regex thought it might be a problem so instead of thinking about it just opted for the safer option. Why do any kind of a regex validation at all for a password? As long as you are hashing it straight after receiving it the user should be able to send whatever they want.

seanalltogether 14y ago
Additionally. "Adding support for spaces only in the middle of the password would make the regular expression defining them three times longer, Engberg said." So they admit they already have the regex definition that would allow this, but for some reason don't want to put it in production? How strange.
- shawabawa3 14y ago
  but it's 3 times longer! Think of all the ram that would use! They can't even cite performance reasons as hashing passwords should be very cpu intensive anyway
  - troels 14y ago
    The regexp might be longer to write, but I doubt it would perform worse, once compiled.
- Terretta 14y ago
  Sounds like he's thinking his regex is of their allowed "set" of [A-Za-z0-9!@#$%^&*()_.-], and thinks that to support space but not at start or end, he'd need ^[set][ set]{6,}[set]$, repeating his set 3 times except with a space added to the middle set. That's not accurate. He can add a space to his set, then put a not-space assertion at the start and end, like ^(?! )[ set]{8,}(?<! )$ and call it a day. (And perhaps \A and \Z instead of ^ and $ depending on what he does with new lines.)
- X-Istence 14y ago
  The better question is why is there a regex in the first place? If someone wants to set their password to some random chinese characters then why shouldn't they be able to?
hamburglar 14y ago
I assume the problem is related to space-handling on HTML form submission. I don't know off-hand how POST handling differs, but for forms submitted by GET, spaces get all screwed up and it wouldn't surprise me if some or all browsers automatically trimmed leading and trailing spaces, and it also wouldn't surprise me if various JS libs took varying approaches to compensating for this weirdness. Re: why you'd have a regex for validating passwords, I assume this is in the password setting user interface, so you can give the "hey that password doesn't meet the requirements" feedback without waiting for a round-trip to the server. Edit: the real frustrating thing about this article is that it doesn't actually answer the question in the title, and nobody seems to care. Yeah, Microsoft, great point: longer passwords may not actually be more secure, but prohibiting them causes your users problems if they've developed a nice consistent scheme for generating their passwords and have to have a special exception for your dumb site that limited the length for no good reason.
- jfb 14y ago
  I've noticed that the quality of Ars' work has been getting worse as they've widened their coverage. Much of it now seems to be either simply regurgitated PR garbage, or the lightest rewrite of PR garbage, with a sprinkling of "some people like cake; others, pie. You decide!" sort of non-journalism on top. It's a shame, because they have had excellent writers in the past.
  - illuminate 14y ago
    It's somewhat interesting, I've noticed that around the last 6 months or so, I'm not sure what changed. I first noticed all the tabloidy Xbox rumor-mongering based on "leaks". Ars was the best around, they don't need to emulate the Gawker network, even though those threads surely get more pagehits and comments.

seanalltogether 14y ago

Additionally. "Adding support for spaces only in the middle of the password would make the regular expression defining them three times longer, Engberg said." So they admit they already have the regex definition that would allow this, but for some reason don't want to put it in production? How strange.

shawabawa3 14y ago
but it's 3 times longer! Think of all the ram that would use! They can't even cite performance reasons as hashing passwords should be very cpu intensive anyway
- troels 14y ago
  The regexp might be longer to write, but I doubt it would perform worse, once compiled.
Terretta 14y ago
Sounds like he's thinking his regex is of their allowed "set" of [A-Za-z0-9!@#$%^&*()_.-], and thinks that to support space but not at start or end, he'd need ^[set][ set]{6,}[set]$, repeating his set 3 times except with a space added to the middle set. That's not accurate. He can add a space to his set, then put a not-space assertion at the start and end, like ^(?! )[ set]{8,}(?<! )$ and call it a day. (And perhaps \A and \Z instead of ^ and $ depending on what he does with new lines.)
X-Istence 14y ago
The better question is why is there a regex in the first place? If someone wants to set their password to some random chinese characters then why shouldn't they be able to?

hamburglar 14y ago

I assume the problem is related to space-handling on HTML form submission. I don't know off-hand how POST handling differs, but for forms submitted by GET, spaces get all screwed up and it wouldn't surprise me if some or all browsers automatically trimmed leading and trailing spaces, and it also wouldn't surprise me if various JS libs took varying approaches to compensating for this weirdness. Re: why you'd have a regex for validating passwords, I assume this is in the password setting user interface, so you can give the "hey that password doesn't meet the requirements" feedback without waiting for a round-trip to the server. Edit: the real frustrating thing about this article is that it doesn't actually answer the question in the title, and nobody seems to care. Yeah, Microsoft, great point: longer passwords may not actually be more secure, but prohibiting them causes your users problems if they've developed a nice consistent scheme for generating their passwords and have to have a special exception for your dumb site that limited the length for no good reason.

jfb 14y ago
I've noticed that the quality of Ars' work has been getting worse as they've widened their coverage. Much of it now seems to be either simply regurgitated PR garbage, or the lightest rewrite of PR garbage, with a sprinkling of "some people like cake; others, pie. You decide!" sort of non-journalism on top. It's a shame, because they have had excellent writers in the past.
- illuminate 14y ago
  It's somewhat interesting, I've noticed that around the last 6 months or so, I'm not sure what changed. I first noticed all the tabloidy Xbox rumor-mongering based on "leaks". Ars was the best around, they don't need to emulate the Gawker network, even though those threads surely get more pagehits and comments.