4 ms·

I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which character

by axefrog 12y ago

I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...

rtpg 12y ago
you can try camelCasing your passwords, same effect really
- certainly_not 12y ago
  Passwords don't need to be legible in the first place. There's nothing wrong with correcthorsebatterystaple. On the other hand, forbidding spaces is absolutely misguided.
- kijin 12y ago
  Unless the website silently lowercases all passwords. A lot of them do, in the name of making life easier for people who have Caps Lock on.
  - alistairjcbrown 12y ago
    IIRC Facebook creates three passwords to deal with character case issues; the one you enter, an inverted case version and a version with the first characters case inverted.
    - jsmeaton 12y ago
      I'd be very surprised if they created all 3. They probably check the other 2 variations if the first one fails though: if (entered == password || entered.swapcase() == password) .. // etc
      - r00fus 12y ago
        In order to be performant, since the check is not against your actual password but just against a stored hash (salted/bcyrpted/etc), I wouldn't be surprised if they simply stored all 3 hash results.
thisishugo 12y ago
I had this annoyance with FastMail[0], recently. They give this justification for their restriction: FastMail provides a lot of different services over many different protocols. To ensure that your password is compatible with all of them, and the many (often slightly buggy) clients out there, we only allow the characters A-Z, a-z, 0-9 and !?@#$%^&*()-=_+[]{}.,:;<>/\|~"'`. Which I understand, but how about a checkbox that says "for goodness sake, I'm a grown up, I promise not to moan if I use a "buggy" client, now please let me the password of my choosing." [0] https://www.fastmail.fm/help/account/password.html https://www.fastmail.fm/help/account/password.html
SlashmanX 12y ago
Twitter is also included in the list of annoying sites. I think AppleID is one too, their password policy just sucks anyway, I'd love to see the stats on the amount of "Forgot Password?"'s on their service
xtrumanx 12y ago
Spaces do however sometimes cause some problems on html forms. For instance, they get trimmed off the end of each value of a form when the request is sent (happens on Chrome at least). There was another gotcha I noticed with spaces and html forms once; an option in a select list with multiple consecutive spaces in the middle of it had those spaces reduced to one space when the request was sent (once again, happens on Chrome at least).

by axefrog 12y ago

rtpg 12y ago

you can try camelCasing your passwords, same effect really

certainly_not 12y ago
Passwords don't need to be legible in the first place. There's nothing wrong with correcthorsebatterystaple. On the other hand, forbidding spaces is absolutely misguided.
kijin 12y ago
Unless the website silently lowercases all passwords. A lot of them do, in the name of making life easier for people who have Caps Lock on.
- alistairjcbrown 12y ago
  IIRC Facebook creates three passwords to deal with character case issues; the one you enter, an inverted case version and a version with the first characters case inverted.
  - jsmeaton 12y ago
    I'd be very surprised if they created all 3. They probably check the other 2 variations if the first one fails though: if (entered == password || entered.swapcase() == password) .. // etc
    - r00fus 12y ago
      In order to be performant, since the check is not against your actual password but just against a stored hash (salted/bcyrpted/etc), I wouldn't be surprised if they simply stored all 3 hash results.

thisishugo 12y ago

I had this annoyance with FastMail[0], recently. They give this justification for their restriction: FastMail provides a lot of different services over many different protocols. To ensure that your password is compatible with all of them, and the many (often slightly buggy) clients out there, we only allow the characters A-Z, a-z, 0-9 and !?@#$%^&*()-=_+[]{}.,:;<>/\|~"'`. Which I understand, but how about a checkbox that says "for goodness sake, I'm a grown up, I promise not to moan if I use a "buggy" client, now please let me the password of my choosing." [0] https://www.fastmail.fm/help/account/password.html https://www.fastmail.fm/help/account/password.html

SlashmanX 12y ago

Twitter is also included in the list of annoying sites. I think AppleID is one too, their password policy just sucks anyway, I'd love to see the stats on the amount of "Forgot Password?"'s on their service

xtrumanx 12y ago

Spaces do however sometimes cause some problems on html forms. For instance, they get trimmed off the end of each value of a form when the request is sent (happens on Chrome at least). There was another gotcha I noticed with spaces and html forms once; an option in a select list with multiple consecutive spaces in the middle of it had those spaces reduced to one space when the request was sent (once again, happens on Chrome at least).