4 ms·

No spaces in passwords? Obviously not hashing them.

• 1945 12y ago
  Why are they obviously not hashing?
  • iancarroll 12y ago
    because if they were hashed, spaces would be irrelevant (hashes don't have spaces)
    • pconner 12y ago
      You can apply a hashing algorithm to a string that contains spaces. The spaces are very much relevant. In MD5 "String with spaces" yields eab431cd212fb8b5ae223acbcfe58cca "Stringwithspaces" gives 3cd297b2d7e48709d92890f88abdde0a
      • iancarroll 12y ago
        I meant the hashes themselves wouldn't have spaces, therefore any odd database storage requirement wouldn't matter.
        • deleted 12y ago
          [deleted]
    • mattkrea 12y ago
      client-side validation?
    • tomschlick 12y ago
      its probably because of dumb users. user makes password with spaces, then tries with without spaces and cant figure out why it wont work...
      • taspeotis 12y ago
        I don't know why this is getting downvoted. It's pretty easy to have accidently insert leading or trailing whitespace when copying/pasting a password. (Users should never store passwords in plain text or email them to one-another but the reality is they do.)
• pconner 12y ago
  Spaces are just characters. Their presence has nothing to do with hashing algorithms working or not.
  • PavlovsCat 12y ago
    That's the point; since spaces in the password cleartext should not matter for storing the password hash, what would be a good reason to disallow them?
    • aaronem 12y ago
      There isn't one.
      • nwh 12y ago
        Which begs the question why I was downvoted heavily and posted to @shit_HN_says for making the comment.
        • aaronem 12y ago
          How the hell should I know? But if I had to guess, I'd say it was because your prior comment implicitly equates "spaces prohibited in passwords" and "passwords not hashed" and assumes the latter as a necessary consequence of the former, when the two are entirely unrelated. Now, to be fair, that's an uncharitable interpretation of the comment you're complaining about. But you helpfully make clear in a later comment that that was what you meant: > I'm saying that because they're disallowing the submission of spaces, they aren't hashing their passwords when they get to the server. And that just doesn't follow, and that's probably why your comment is getting downvoted, but not why I downvoted it just now. I don't downvote for content, but only for rudeness, unfunny jokes, and complaining about downvotes.
  • deleted 12y ago
    [deleted]
  • whoopdedo 12y ago
• arcticPeril 12y ago
  Actually, they are (or could be, given that I don't know for sure because I don't work there). It merely means that they are most likely looking for spaces with client-side JavaScript, and rejecting any string that contains spaces. Or, they're checking the string server-side, before hashing and storing the hash to their persistent data store. Either way, as long as the connection is secure, it's reasonable to inspect the string in plain-text, both client-side and server-side, before creating the hash, as long as they actually create the hash when they do actually decide to save a representation of the password, rather than saving the plain-text password itself. Part of me would like to guess that the reason spaces might be forbidden in passwords (and pass phrases) would be to prevent frequency analysis. But that doesn't really make much sense, when it comes to hashes, does it? So then, might the case be that they are storing the passwords with reversible encryption, and decrypting the token for a match? In my mind of minds, I doubt it, but you never know. What I really think is that the password policy is simply contrived and idiotic, and whatever rationale they've used to forbid spaces is silly and ill-conceived. Either way, I agree with the author, whole-heartedly. That is a damned frustrating sign-up process. Two-factor account creation AND a CAPTCHA check? Holy moly!
  • nwh 12y ago
    I'm very much aware of that. I'm saying that because they're disallowing the submission of spaces, they aren't hashing their passwords when they get to the server. > they're checking the string server-side, before hashing and storing the hash to their persistent data store. But why? People don't just add a rule because they feel like it, I'm suggesting that they are storing it in a stupid way that is not hashed and does not allow spaces. > part of me would like to guess that the reason spaces might be forbidden in passwords (and pass phrases) would be to prevent frequency analysis. The output of a cryptographic hash is completely random, you can't do any sort of analysis except for determining H(a) == H(b). You don't even know if H(b) was the same input as H(a) or just a collision against it.
    • arcticPeril 12y ago
      > But why? Because you cannot trust any checks performed on the client-side, since the user may have total control over the client-side system, and possess the ability to (somehow) bypass or spoof client-side validation. Client-side validation only exists to pluck the low-hanging fruit, and provide convenience to the majority of users. You cannot rely on any client-side events, when attempting to secure server-side resources. All user input must be considered evil until proven otherwise.
• bowlofpetunias 12y ago
  It's the lazy way of stopping users from cheating a minimum password length requirement. To be fair, any other way would be lead to convoluted rules like "no consecutive spaces", "no leading/trailing spaces" or "spaces don't count towards the password length". This is exactly why forcing users to use strong passwords is a shit idea in the first places. The rules either become ridiculously complicated or you disallow perfectly good passwords. There's no middle ground.
• theboss 12y ago
  There's a difference between not allowing spaces and not hashing. They could have just written a bad PW policy that doesn't completely make sense You're drawing conclusions from information that doesn't lead you to one.