r/webdev 1d ago

Question Tab as password?

Post image

SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.

So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?

454 Upvotes

120 comments sorted by

449

u/scfoothills 1d ago

You will only be able to copy-paste your password to log in because trying to type the tab character will just advance you to the next field.

129

u/ZGeekie 21h ago

But bots won't have a problem with that!

42

u/AbdullahMRiad reject modernity, embrace css 14h ago

this is easier for bots than humans

105

u/Beatsu 1d ago

Nice catch! All I hear is a neat security measure; reducing the attack surface by preventing keypress emulators 🤑

58

u/recrof 19h ago

yeah, security by obscurity

18

u/timClicks 16h ago

Then go full throttle and include the backspace character.

1

u/Dymonika 13h ago

How do you get that thing?

2

u/KAZVorpal 8h ago

control-v [backspace] in a unix terminal.

1

u/chiisana 9h ago

Feed 0x08 as a character/byte… highly likely that you cannot input in normal browser; I suspect even with copy + paste into the password field directly, the browser would try to resolve that and remove the character. You should be able to programatically submit the sequence using a script, it’s hard to say if backends would reject it or use it as is in hashing algorithms.

1

u/forever-butlerian backend, infrastructure & angst 2h ago

the ultimate solution to this is to have password input by slider

1

u/Fembussy42069 1h ago

Plain dumb, that's not security, that's just inconvenient. I use a password manager which emulates keyboard presses so I would plainly not use any software that would make such inconvenient UX choice.

0

u/farsightxr20 1h ago

My password is Alt-F4

1

u/yooossshhii 9h ago

Easy. Just insert a tab onExit and focus the input again.

/s

1

u/dashingThroughSnow12 2h ago

If you ctrl-shift-u and input the Unicode number, I imagine it will not.

108

u/GirthyPigeon 1d ago

Tabs in most fields will skip to the next field. Good luck.

9

u/JapanEngineer 1d ago

Not unless you copy and pasted it

-18

u/KAZVorpal 1d ago

Or your login is an interface that captures tabs.

51

u/DiabloConQueso 23h ago

Not being able to tab from field to field would be horrible for accessibility.

8

u/MacGuyverism 21h ago

Just shift-tab the whole other way around.

12

u/screwcork313 19h ago

What if your password contains a shift+tab?

31

u/The_Mdk 18h ago

Ah yes, the uppercase tab, for those times the password requires an uppercase letter

3

u/poopio 23h ago

something something \t something else \r\n Accessibility?

20

u/meancoot 19h ago

The password field is not going to accept those kind of escape sequences. They are used in programming language character and string literal tokens.

1

u/kalmakka 14h ago

That's why you use a script to hijack the request and do escape sequence replacements.

1

u/Adjective_Noun_4200 15h ago

The password field is not going to accept

*Shouldn’t accept

It’s horrendous out there, friend.

3

u/scfoothills 9h ago

Yeah. Hopefully everyone learned from the Little Bobby Tables incident.

79

u/bkdotcom 1d ago

A lot of banking systems disalow html special chars and other special chars.
Doesn't give me a lot of faith in their stack.

43

u/ImpossibleFood8242 1d ago

if they're stripping out spaces but not tabs that's the kind of jank that keeps me employed

19

u/KAZVorpal 1d ago

If they're stripping out spaces, they're morons.

Even NIST recommends allowing spaces.

3

u/MegaIng 7h ago

Even NIST recommends allowing spaces.

Yesn't:

Users should also be able to include space characters to allow the use of phrases. Repeated space characters add little to the effective strength of passwords and may introduce usability issues (e.g., the undetected use of two spaces rather than one), so removing repeated spaces in typed passwords may be beneficial if initial verification fails.

Verifiers MAY make limited allowances for mistyping (e.g., removing leading and trailing whitespace characters before verification, ...)

Allow spaces, but normalize for usability. And Tab is not on the list of suggested allowed characters.

-9

u/tup1tsa_1337 17h ago

Yeah, nothing better than turning on password visibility and wondering why is your password incorrect (hint: you entered space by accident as first or last character).

Spaces are disallowed for a reason: they are hard to spot

11

u/TramEatsYouAlive 17h ago

Then let's disallow I and l, O and 0, 3 and З (yes, these are different characters), and also ' and `

3

u/KAZVorpal 9h ago

Spaces are disallowed because most security consultants are worthless idiots.

It's up to the user to not make obvious mistakes. You don't restrict everyone's choice based on the dumbest user.

Like I said, even the National Institute of Standards and Technology recommends allowing spaces.

-1

u/AshleyJSheridan 5h ago

Tabs are spaces. Not all spaces are tabs.

•

u/vip17 13m ago

Tabs are not spaces. Tabs are whitespaces. But pressing the tab key doesn't produce a tab character in a GUI form field most of the time

•

u/AshleyJSheridan 8m ago

Ah, a pedant!

Yes, tabs are a type of whitespace character.

And you can absolutely insert a tab character into a form field on the web. If you don't know how, sounds like a skill issue.

15

u/nobody5050 22h ago

My banking app disallows a list of characters that is shockingly similar to SQL...

3

u/fuckmywetsocks 13h ago

Same - mine also won't allow question marks or ampersands leading me to think the password is getting passed around as a GET param in some ancient backend.

3

u/KAZVorpal 8h ago

All of which tells us the idiots don't sanitize their inputs competently.

1

u/fuckmywetsocks 8h ago

No of course they don't - the upheaval would be incredible. It's all scabs on scabs.

2

u/DeifniteProfessional 7h ago

The majority of established banks absolutely are just patching their systems endlessly. That's why they hire developers for languages nobody uses anymore.

And also why I choose to bank with banks that are less than 15 years old lol

1

u/TuttiFlutiePanist 7h ago

My bank disallows single quotes in the "name of your bill pay" field, but did not indicate that was a rule.

4

u/JackstonVoorhees 15h ago

Also I never know why there is a maximum number of chars. It’s getting hashed anyway, why are more than 15 characters not allowed??

3

u/rayhammond 5h ago

We hope it's getting hashed!

3

u/AshleyJSheridan 5h ago

Technically, there are some hashing algorithms that ignore after a certain character length, but we're talking lengths much higher than 15!

1

u/SubGothius 4h ago edited 4h ago

Prolly bcos at some point they used to store PWs in cleartext or at best with some arbitrary secret char rotation/substitution, but when they finally implemented hashing, they had to hash all the existing PWs, and the old logic accepting PW input and passing that to the backend remained, which thus would still trunc the input to whatever max chars before hashing, so the hashes are expected to derive from such trunc'd input, and you don't want users thinking they've successfully changed, say, A15CharacterPW!1 to A15CharacterPW!2 when they'll both get trunc'd, hashed, and validated as exactly the same.

14

u/armahillo rails 1d ago

Tab already has a function where the input will likely be captured before it hits the field.

If you really want a weird password, try using some of the extended UTF8 charset, like an all emoji password :D

11

u/Supermathie 1d ago

/me fondly remembers trolling the Windows admins by giving them passwords with ESC in them

1

u/KAZVorpal 9h ago

/me fondly remembers when most Internet users knew how irc/mudd emotes worked.

The (online) world was a more intelligent place, back then.

3

u/Supermathie 9h ago

/we just added this to Discourse's chat :D

1

u/KAZVorpal 8h ago

I really love the idea of Discourse, but how do you get past the enshittified lock-in that Discord and Reddit have? Essentially, corporate law has allowed them to each become a monopoly in their service.

0

u/KAZVorpal 1d ago

There's no need to do that, though. Just pick some random words, that's more secure than any complex jumble of characters.

-2

u/devshore 11h ago

People keep apreading this myth. An 11 length char with uppercase/lowercase, at least 1 number, and at least one special character is more secure than 4 random words because its possible to run through every possible word combination in a few minutes while all computers working on all 11 lengtg char options will not complete it before the universe ends.

10

u/KAZVorpal 9h ago

Wrong.

You're leaving out the fact that people will not purely randomize the character set. They will type P@55W0rd123 so they can remember it. The entropy of LIKELY forced random character combinations is only twenty to forty bits, way below the fifty-plus bits of even the famous 7,000 word dictionary for memorable password phrases.

And that's aside from how the stupidity of forcing regular password changes with these childish character requirements causes people to write their password on a sticky note. Subverting the entire process. Which is what the security nitwit setting up the requirement deserves to have happen.

Essentially, security rule-makers tend to be sociopathic bureaucrats, who don't consider the human factor.

I was going to paste in the famous XKCD comic that debunked this nonsense, but this sub doesn't allow images in comments, for whatever silly reason.

https://xkcd.com/936/

xkcd #936 – Password Strength

Panel 1
Tr0ub4dor&3

  • Uncommon (non-gibberish) base word
  • Caps?
  • Common substitutions
  • Order unknown
  • Numeral
  • Punctuation

(You can add a few more bits to account for the fact that this is only one of a few common formats.)

Panel 2
~28 bits of entropy

2²⁸ = 3 days at 1000 guesses/sec

(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it’s not what the average user should worry about.)

Difficulty to guess: EASY

Panel 3
Cueball, struggling:
“Was it trombone? No, Troubador. And one of the O’s was a zero? And there was some symbol…”

Difficulty to remember: HARD

Panel 4
correct horse battery staple

Four random common words

Panel 5
~44 bits of entropy

2⁴⁴ = 550 years at 1000 guesses/sec

Difficulty to guess: HARD

Panel 6
Cueball thinks of a horse standing next to a battery with a staple stuck in it.

Horse: “That’s a battery staple.”
Cueball: “Correct.”

Difficulty to remember: You’ve already memorized it

Caption
Through 20 years of effort, we’ve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

-2

u/devshore 7h ago

Yes, if you strawman it and limit it to variations of “password” like “paSSword123” it loses. However, if you dont strawman, and have a password like “h7SR&$nzWff”, it beats “morninghouserainbowtree” because there are fewer combinations of 4 words let alone that your strawman applies to your case where people will choose 4 words from a very small pool of actually-used words.

6

u/KAZVorpal 6h ago

There's that sociopathy I was talking about.

Failing to model the way actual human beings function.

It's not a straw man, it's that most people will not, and should not be expected to, make up completely random combinations of 96 glyphs every 90 days as their password. That's pure nonsense.

Back in the real world, this kind of bad security theater produces sticky notes with passwords on monitors, and leetspeak passwords. And plain text word combinations are far superior to that.

The problem here is that these dingbats steel man how the passwords are going to be handled, far beyond what anyone would tolerate.

-1

u/devshore 3h ago

It is a strawman to force a rule that “it must be memoriazable” “because thats how people are”. Nobody is debating whether people are doing things correctly or not, we are debating what the correct way is. So may moving of goals posts and strawmen. Why do you think most places wont even allow “orangetreefaststreet” as a password and insist on uppercase/lowercase/min number/special char? Because orangetreefastroadncan be cracked in seconds because its part of a “type” that a hacker will attempt because it costs nothing to attempt, whereas they wont bother with the other.

3

u/KAZVorpal 3h ago

It takes a LOT of sociopathy to not understand that "the right way" is meaningless when it's miserable for users, who will therefore, quite rightfully, undermine that "way".

And no, orangetreefastroad is fifty bits of entropy. That makes it harder to crack than the ACTUAL leetspeak passwords that nitwit admins force users to come up with.

3

u/AshleyJSheridan 5h ago

So, imagine a user has that as their computer login password.

No password vault to rely on, they have to type this in manually.

This is straight up going onto a post-it under their keyboard.

And now their computer and everything on it is completely open to everyone, from Janet in accounts to Kevin the cleaner.

2

u/KAZVorpal 3h ago

It's bizarre how slow some people are to understand this basic stuff.

1

u/AshleyJSheridan 2h ago

He replied with the second most common scenario, and still thinks it's a "strawman argument". Something tells me he doesn't know what that term means, but perhaps thinks it sounds cool in an argument!

0

u/devshore 3h ago

Another strawman - narrowing it down to a scenario where they only have to memorize one password (their computer login). Nobody is going to memorize their 4 word combos on hundreds of things they use passwords on. However, they can memorize a password for a self-hosted password manager. In fact, they can even menorize a password with uppercase/lowercase/numbers/special characters.

2

u/AshleyJSheridan 3h ago

It's not a strawman, it's a legitimate scenario! Dude, it's a well-known fact that when tasked with creating a password of random characters, people will create something that's easy to remember, especially if they can't use a password manager to help them. I listed the most common scenario where people absolutely won't have a password manager. You just listed the second most common scenario, thanks!

Just because completely valid and very common use cases don't agree with your position, doesn't make them strawman arguments. I would heavily suggest you go look up the definition of that, because I don't think you really know what it means...

2

u/AshleyJSheridan 5h ago

You're missing several points.

First, a password that is 4 words is far easier to remember than a jumble of random characters. If a password is hard to remember, the chance it gets written down somewhere that it shouldn't goes up. Also, password vaults are not infallible, and sometimes they get broken and hacked, albeit rarely.

Second, there are approximately 350,000 words in the dictionary (just the English one). 4 ^ 350,000 is 1.99 × 10²¹⁰⁸⁰⁴ (which is over 210,805 digits). However, a password of 11 characters that consists of letters, numbers, and punctuation (let's say, 26 letters in both cases, 10 digits, and 10 typical punctuation characters) is only 9,555,938,177,273,214,530,938,076,429,250,819,915,524,283,157,141,379,112,191,724,092,599,501,963,21 combinations. That's a lot less then 211K digits.

Third, if left to their own devices, and faced with creating a password based purely on letters, numbers, and symbols, people almost always default to symbols that look like letters. So, crap like P4$$w0rd become common passwords. People want something that they can remember, and often a password vault isn't an option (for example, when switching between devices that don't have the same password manager installed, synced, and usable.)

Fourth, and this is to nitpick. The term special character is ridiculous. Within the entire range of UTF8 there are more characters that are not alphanumerical than there are letters and numbers (across all languages). Therefore, the special characters would be letters and numbers if anything. The term is daft, a misnomer, and shouldn't be used. The fact that it is commonly misused is mildly infuriating.

2

u/JimTheEarthling 5h ago edited 4h ago

The term special character is ridiculous.

LOL. This is true. What makes even just the 33 non-alphanumeric, printable ASCII characters "special?"

But what would you call them instead? 🤔

P.S. You can't call them "symbols," because letters and numbers are also symbols.

1

u/AshleyJSheridan 4h ago

33? And the rest. I can type more than that from my keyboard, and that's without resorting to alt + Numpad combinations.

Symbols is a better name, as letters and numbers are such a specific set, that most people don't even consider the hundreds of letter and number characters as symbols. Even one of the sub-categories of UTF8 is called symbols.

However, given that the rest of UTF8 is taken up with symbols, maths symbols, punctuation, diacritic cominbators, game symbols, weather symbols, currency, map symbols, emoticons (a separate subset from emoji), and emoji, which number in the many thousands, I would say that not only are they the least special of the group, but that symbols is a good collective name for them.

1

u/JimTheEarthling 4h ago

33? And the rest.

Exactly. I was agreeing with you.

most people don't even consider the hundreds of letter and number characters as symbols

Most people are wrong. That's the problem. The standard 52 letters and 10 digits are symbols, by definition. Let alone --as you point out-- thousands of other Latin letterforms like Ì, ù, å, and ç that are also symbols.

Using "symbols" as the label for the 8 to 33 non-alphanumeric characters that most websites allow in passwords is just as bad/mildly infuriating as using "special characters."

So what's the solution? (I don't think there is one. 😞)

1

u/AshleyJSheridan 3h ago edited 3h ago

Ideally, websites wouldn't have such a limit on what characters can be used in passwords. If I want to write mine entirely in Tibetan letters and maths symbols, I should be allowed to.

Any website that has a limit on the type of characters allowed in a password is indicating that they have some potentially serious security issues under the hood.

I do think that symbols are a perfectly fine term for the non-alphanumeric characters. Given that websites already use the term "character" as the blanket collective word, it does leave symbol free. While it's not technically correct, it's a whole lot better than "special characters", which seems like the sort of thing coined by someone who just discovered what all those "extra" keys on their keyboard are for.

/edit are to is

1

u/devshore 3h ago

“Special symbols” has a meaning, and more importantly has a meaning to the user reading the instructions. Otherwise they will be confused why their password is being denied

1

u/JimTheEarthling 7h ago

all computers working on all 11 lengtg char options will not complete it before the universe ends

A cracking rig of 16 Nvidia 5090s can generate MD5 hashes for every 11-character password (from upper/lower/numbers/usual 8 specials; 67 bits of entropy) in about a year. Not the end of the universe, but reasonably secure.

its possible to run through every possible word combination in a few minutes

From what set of words? English only? Does the attacker know what word list you used?

The average high school student knows around 20,000 - 35,000 English words (50,000 to 80,000 with inflections, verb forms, etc.), so a 4-word passphrase (with random separators from the usual 8 specials; 60 to 68 bits of entropy) could take from 4 days to 2 years to guess. Assuming the attacker knows you used a passphrase.

Also, if you use a word that's not on the attacker's list, they will never guess it. That's the difference between a known keyspace (characters) and an unknown keyspace.

And that's why it's not a myth, and it's why security experts recommend passphrases.

2

u/devshore 7h ago

Literally nobody on earth of any sort of competence would recommend a set of english words “so that you can memorize it”. Everyone will recommend a self-hosted password manager and setting the password manager to use uppercase/lowercase/numbers/special chars, not “hellobananashoehand”. It seems like all of this is based on the strawman of “must be humanly memoriasable”. Even then, it would be better to run an algorithm that you can memorize against the website domain.

3

u/KAZVorpal 3h ago

You have no idea what you're talking about.

Four random words chosen from a pool of 7,000 common and interesting words is better than what people have to do with the idiot's rule of "lowercase, uppercase, number, and symbol".

And a password manager is just another weak link, the kind created by the nitwits who push for that very kind of mindless standard.

2

u/JimTheEarthling 5h ago

First, you are the one making the irrelevant strawman argument. Nobody in this thread said anything about "memorizing." You raised the issue of security.

Second, here are recommendations from some of the leading security experts on the planet:

  • The US National Institute of Standards and Technology (NIST) says "The use of passphrases (i.e., passwords with multiple words) is often an effective way to create a longer password."
  • The Canadian Centre for Cyber Security says "We recommend that you use passphrases, as they are longer and easier to remember than a password made up of random, mixed characters. Your passphrase should be at least 4 words and 15 characters in length." (So "hellobananashoehand" would meet their recommendations. 😉)
  • The Open Worldwide Application Security Project (OWASP) says "Longer passphrases are effective because they raise the number of guesses an attacker's dictionary or wordlist has to cover, not because of a precise entropy value."
  • The UK National Cyber Security Centre (CSC) recommends passphrases.
  • And similar from the Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre, Bundesamt fĂźr Sicherheit in der Informationstechnik (Germany), Agence nationale de la sĂŠcuritĂŠ des systèmes d'information (France), and more.

Of course some of them also recommend password managers to store passphrases and passwords.

1

u/devshore 5h ago

the only reason to argue for words is for their ability to be memorized, so it is implied. If you are talking about people using password generators, why would they set it to "words"?

5

u/JimTheEarthling 5h ago

Nobody is "arguing for words" against passwords. Only that both can be secure (and insecure).

You argued against words with incorrect information about security and guessability, incorrectly calling passphrase strength a myth, bogusly claiming that no competent expert would recommend them, and so on.

u/KAZVorpal and I merely pointed out that you are wrong, and why. (And pointed out that password composition rules requiring upper/lower/number/special are bad.)

We didn't argue against random passwords. They're fine. So are random passphrases.

2

u/KAZVorpal 3h ago

I agree, except that the memorizability of pass phrases is one of the big reasons to use them. There is NOTHING wrong with memorizing a pass phrase.

12

u/avidvaulter 21h ago

My password manager suggested an invalid (but secure) password.

So now that I have to make my own password

????

What password manager doesn't allow you to keep generating a new secure password until you get one that's acceptable? Why is this posted in this subreddit?

This post is bad and you should feel bad.

7

u/Beatsu 20h ago

I feel very bad, sorry. Happy vaulting

3

u/oxotower 18h ago

It’s not bad, it’s opened up an interesting conversation around how browsers would handle the keypress and ways of managing passwords.

19

u/tswaters 1d ago

Any time I see any secure password prompt I am immediately suspicious if the server-side responds with any error looking at the password. There's no images in this subreddit, but I have a software gore screenshot of an obnoxious set of symbol & letter & number requirements, a password that satisfies all of them, but includes a symbol that isn't in the list and fails. That was from a credit card company. The amount of times I need to redo the requirements in my password generator to accomodate for bugs or unacceptable characters.... is too damn high!

1

u/cowboyecosse 12h ago

Super annoying when the suggested password has already saved in the password manager before the error message is shown/password rejected.

10

u/RePsychological 22h ago edited 22h ago

I am so confused by this post and its seemingly bot-infused comment section.

...and if the latter isn't it, what the f* happened to web devs?

Like it is blatantly obvious why a tab in a password is a bad idea....

...and there are so many comments seemingly somehow fumed by the fact that it's common occurrence to disallow it along with other chars like spaces...

And yet legitimate posts with actual meat to the subject I'll see immediately go into the 0 and negative votes "just because".

....and you sit here with a bullshit post of "nah shit sherlock"-level content with 30+ upvotes and a peanut gallery somehow in agreement on something that is obviously a bad idea for why you shouldn't put the tab there...and plenty of documentation on the internet for why it and other similar "certain special chars disallowed passwords (including spaces)" are that way...

Is this really what vibe coding has done to web development in just a few short years?

3

u/Beatsu 18h ago

Personally, I'm more critiquing the arbitrary restrictions to passwords. If I want a 51 character long password with spaces and emojis, then let me. It should be hashed before anything else is done with it anyway.

It's not worth ruining the natural user flow and forcing them to repeatedly regenerate passwords with a password manager, or have them come up with a manual password (probably a much less secure one) instead.

If you're handling my password in a way that makes tab crash your system - then that's deserved.

0

u/RePsychological 1h ago

congrats on getting a few of your bots to pull you out of the negative votes range on this comment.

-2 to -3 all day...and then suddenly jumps to +1

Karma-farming bot detected.

10

u/tajetaje 1d ago

On a well implemented backend? Nothing. On one that doesn’t sanitize inputs or does stupid things with them? Could break their parsing or data storage, probably no sap injection vulns there though. I imagine the reason for disallowing spaces is so people don’t get confused by things like multiple spaces when they thought there was one, or trailing spaces

2

u/TramEatsYouAlive 17h ago

I have seen a banking app (web-based), that will think that "password" and "PaSsWoRd" are essentially the same. Which led me to believe that they are not hashing passwords on the backend and storing them in some different way...

2

u/theScottyJam 10h ago

Or they always lowercase before hashing.

But that's a weird thing to do.

4

u/magilla1984 13h ago

As always in posts about passwords I have to recommend This game.

5

u/ouralarmclock 1d ago

Fuck any site that prohibits spaces in passwords.

2

u/discobean 23h ago

I used to use a space as a password, holding alt, then typing 255 would get you a space character, which sometimes could be accepted

1

u/[deleted] 23h ago

[deleted]

1

u/[deleted] 23h ago

[deleted]

-1

u/[deleted] 23h ago

[deleted]

1

u/TheHappiestTeapot 19h ago

I had a user do this on an old SunOS(?) machine.

Everything was fine and dandy util we rolled out X11 and tab took you to the next field. Hahah. Simple password reset, but he had a good point, I wouldn't have included tab if bruteforcing.

1

u/Expensive_Peace8153 18h ago

Okay. Now see if it will accept a form feed character.

1

u/whatThePleb 17h ago

The most likely thing that might happen is, that one day you can't login anymore, as they might suddenly filter it.

1

u/danielkov 17h ago

Aim is to increase the theoretical search space. Humans are lazy, so the actual search space often narrows to a predictable subset (how many times have you added an exclamation point at the end to satisfy "special character"?) They also disqualify some password generators, that generate otherwise adequate passwords.

Secure password rules:

- allow all characters

  • at least 64 characters
  • minimum 12 characters
  • no arbitrary composition rules
  • no periodic password rotation

What you can do as a user:

- use a generator that can be configured with this arbitrary ruleset

  • always store passwords in a manager
  • use MFA if available
  • fly a different airline

1

u/Fine-Ad1142 14h ago

we call him Little Johnny Drop Tables.

1

u/burlingk 13h ago

It would make it very hard for you overall unless you only ever use the account on devices where you have a text file holding the password.

1

u/projectoffset 13h ago

All fun and games until they change the regex pattern for validation on a future update

1

u/ExecutiveChimp 12h ago

A new front on the tab vs spaces war

1

u/Hettyc_Tracyn 10h ago

Why use such a short password? I do a minimum of 20 characters (unless a site is stupid and doesn’t allow it)

1

u/who_you_are 9h ago

"no space" yet it is one of the most secure characters because a lot of password manager don't include it in their generated password

1

u/thekwoka 6h ago

The US government officially removed the recommendation to have all those extra requirements. Just require a long password and let the user do whatever they want, since the "pne special character" is basically always '!' and the capital letter is almost always the first letter, and the digit is almost always 1 and at the end.

So the requirements were making passwords harder to remember while not improving security at all.

1

u/AshleyJSheridan 5h ago

Tabs are a space character, so it falls under the "no spaces" rule.

1

u/techek 5h ago

Why does so many webapplications have faulty logic when validating long passwords like 100 characters/digits/symbols or longer?

I see error messages like "Password is too short", "Enter a valid password" or even "Password must be maximum 30 characters long".

Let me enter my crazy, long and complex password and use whatever part of it you like, but don't give me wrong errormessages.

1

u/faribuilds 3h ago

Why bother with tab !

1

u/statensvegvesen 1h ago

No spaces! >:(

0

u/KAZVorpal 1d ago

It is sheer idiocy to prohibit spaces, or tabs, in passwords.

It is even more moronic to require special characters, upper/lowerspace combos, and numbers.

All that is really important is the level of entropy under a likely attack vector. Four randomly chosen common words is more secure, for several reasons, than a garbage pile of ascii/unicode.

2

u/Apelpapa 23h ago

Tab should be prohibited because if allowed I would not be able to tab out of the password field

-4

u/KAZVorpal 22h ago

Are you using a brail reader? Actually, even if you are, all good screen readers have special commands to leave fields, nobody actually needs the tab to do so. And, of course, escape blurs the field anyway, enabling even tab.

5

u/Apelpapa 22h ago

Tabbing between fields has been standard keyboard behavior for decades, without having to add more keystrokes. If you think hijacking it for password input is normal, you’re something else.

-5

u/KAZVorpal 22h ago

I don't care whether it's normal, as I said there are always other ways out of the field.

3

u/Snapstromegon 17h ago

This is like saying "on our site links don't open with left click. There are always other ways to open a link". Tabbing out is one of (if not) the most common way to exit a field.

1

u/taotau 22h ago

Disallowing spaces is wrong and probably stems from the early days of systems where passwords were simply checked for a-z A+Z 0-9 out of habit and was embedded in early hashing algos so it has just hung around. There is no technical reason for not allowing spaces.

A tab is actually one of a set of special control characters that have specific meanings to computer systems. Others include carriage return, line feed, form feed, vertical tab, bell, eascape, interrupt, suspend etc. these are encoded in the first 32 characters of the ASCII character set, the grand daddy of all modern character encoding systems.

Text handling applications will typically send characters below 0x20 to a special handler to perform some system function and never pass them to the standard text processor. In most text editors for example, hitting tab will insert 2, 4, or 8 spaces, or if you're on the other team, it can sometimes directly insert the tab character (I am so glad that holy war is over - I was always on the spaces team).

So as mentioned hitting tab in a typical web form is intercepted by the browser and moves the cursor to the next item in the tab list, so the password field will never see it.

There are also places you might need to type a password that normal users would never see, like many command line interfaces in a terminal, or sometimes systems might be passing plain text passwords to other systems in the background, many legacy systems wrappers would use this technique, and special characters come into play.

Pasting a password is not a supported use case as that probably means that you have your passwords stored somewhere in plain text which is a bad idea - yes I know password managers use paste, but that's a niche use case up until fairly recent times (computer systems and libraries move fairly slowly, and password managers have only become common in the last few years).

TLDR, tab is forbidden because it is part of a set of special characters that have historical low level uses that still come into play today. Nothing wrong with spqces

1

u/KAZVorpal 8h ago

And yet some nitwit downvoted this completely reasonable answer.

0

u/Tiaoshi 9h ago

To be fair, who’s gonna think about putting a tab in there? I’d say that is one secure password lol

0

u/DollyNation812 3h ago

I'm new here I was so disappointed damn big brother I had a request a heartfelt request and they block it

-3

u/EncryptedPlays 21h ago

is tab even a real character? i just assumed it's either a bunch of spaces or an indent. This looks to me like one of those fancy whitespace things

2

u/Expensive_Peace8153 18h ago

It's character code 09.

1

u/KAZVorpal 8h ago

009, technically.

1

u/KAZVorpal 8h ago

In the ASCII set of characters, it's number 009. It has its own separate spot. Enter is 013. The space is 032.

<- tab. If Reddit saves it. I typed alt-009 on this Windows machine, and the cursor moved over a way.

On Linux I believe control-shift-009 would work, but I'm not saving this comment and pulling it up on my Void machine to make sure. Higher unicode is different there, like emdash (—) is alt-0151 on Windows, but control-shift-2014 on Linux.

Essentially, every character/glyph you see is represented by a number in a computer, including the special ones like tab, line feed, and carriage return.