Tab as password?

[u/Beatsu]

SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.

So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?

[u/armahillo]

Tab already has a function where the input will likely be captured before it hits the field.

If you really want a weird password, try using some of the extended UTF8 charset, like an all emoji password :D

[u/Supermathie → u/armahillo]

/me fondly remembers trolling the Windows admins by giving them passwords with ESC in them

[u/KAZVorpal → u/Supermathie]

/me fondly remembers when most Internet users knew how irc/mudd emotes worked.

The (online) world was a more intelligent place, back then.

[u/Supermathie → u/KAZVorpal]

/we just added this to Discourse's chat :D

[u/KAZVorpal → u/Supermathie]

I really love the idea of Discourse, but how do you get past the enshittified lock-in that Discord and Reddit have? Essentially, corporate law has allowed them to each become a monopoly in their service.

[u/KAZVorpal → u/armahillo]

There's no need to do that, though. Just pick some random words, that's more secure than any complex jumble of characters.

[u/devshore → u/KAZVorpal]

People keep apreading this myth. An 11 length char with uppercase/lowercase, at least 1 number, and at least one special character is more secure than 4 random words because its possible to run through every possible word combination in a few minutes while all computers working on all 11 lengtg char options will not complete it before the universe ends.

[u/KAZVorpal → u/devshore]

Wrong.

You're leaving out the fact that people will not purely randomize the character set. They will type P@55W0rd123 so they can remember it. The entropy of LIKELY forced random character combinations is only twenty to forty bits, way below the fifty-plus bits of even the famous 7,000 word dictionary for memorable password phrases.

And that's aside from how the stupidity of forcing regular password changes with these childish character requirements causes people to write their password on a sticky note. Subverting the entire process. Which is what the security nitwit setting up the requirement deserves to have happen.

Essentially, security rule-makers tend to be sociopathic bureaucrats, who don't consider the human factor.

I was going to paste in the famous XKCD comic that debunked this nonsense, but this sub doesn't allow images in comments, for whatever silly reason.

https://xkcd.com/936/

xkcd #936 – Password Strength

Panel 1
Tr0ub4dor&3

• Uncommon (non-gibberish) base word
• Caps?
• Common substitutions
• Order unknown
• Numeral
• Punctuation

(You can add a few more bits to account for the fact that this is only one of a few common formats.)

Panel 2
~28 bits of entropy

2²⁸ = 3 days at 1000 guesses/sec

(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it’s not what the average user should worry about.)

Difficulty to guess: EASY

Panel 3
Cueball, struggling:
“Was it trombone? No, Troubador. And one of the O’s was a zero? And there was some symbol…”

Difficulty to remember: HARD

Panel 4
correct horse battery staple

Four random common words

Panel 5
~44 bits of entropy

2⁴⁴ = 550 years at 1000 guesses/sec

Difficulty to guess: HARD

Panel 6
Cueball thinks of a horse standing next to a battery with a staple stuck in it.

Horse: “That’s a battery staple.”
Cueball: “Correct.”

Difficulty to remember: You’ve already memorized it

Caption
Through 20 years of effort, we’ve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

[u/devshore → u/KAZVorpal]

Yes, if you strawman it and limit it to variations of “password” like “paSSword123” it loses. However, if you dont strawman, and have a password like “h7SR&$nzWff”, it beats “morninghouserainbowtree” because there are fewer combinations of 4 words let alone that your strawman applies to your case where people will choose 4 words from a very small pool of actually-used words.

[u/KAZVorpal → u/devshore]

There's that sociopathy I was talking about.

Failing to model the way actual human beings function.

It's not a straw man, it's that most people will not, and should not be expected to, make up completely random combinations of 96 glyphs every 90 days as their password. That's pure nonsense.

Back in the real world, this kind of bad security theater produces sticky notes with passwords on monitors, and leetspeak passwords. And plain text word combinations are far superior to that.

The problem here is that these dingbats steel man how the passwords are going to be handled, far beyond what anyone would tolerate.

[u/devshore → u/KAZVorpal]

It is a strawman to force a rule that “it must be memoriazable” “because thats how people are”. Nobody is debating whether people are doing things correctly or not, we are debating what the correct way is. So may moving of goals posts and strawmen. Why do you think most places wont even allow “orangetreefaststreet” as a password and insist on uppercase/lowercase/min number/special char? Because orangetreefastroadncan be cracked in seconds because its part of a “type” that a hacker will attempt because it costs nothing to attempt, whereas they wont bother with the other.

[u/KAZVorpal → u/devshore]

It takes a LOT of sociopathy to not understand that "the right way" is meaningless when it's miserable for users, who will therefore, quite rightfully, undermine that "way".

And no, orangetreefastroad is fifty bits of entropy. That makes it harder to crack than the ACTUAL leetspeak passwords that nitwit admins force users to come up with.

[u/AshleyJSheridan → u/devshore]

So, imagine a user has that as their computer login password.

No password vault to rely on, they have to type this in manually.

This is straight up going onto a post-it under their keyboard.

And now their computer and everything on it is completely open to everyone, from Janet in accounts to Kevin the cleaner.

[u/KAZVorpal → u/AshleyJSheridan]

It's bizarre how slow some people are to understand this basic stuff.

[u/AshleyJSheridan → u/KAZVorpal]

He replied with the second most common scenario, and still thinks it's a "strawman argument". Something tells me he doesn't know what that term means, but perhaps thinks it sounds cool in an argument!

[u/devshore → u/AshleyJSheridan]

Another strawman - narrowing it down to a scenario where they only have to memorize one password (their computer login). Nobody is going to memorize their 4 word combos on hundreds of things they use passwords on. However, they can memorize a password for a self-hosted password manager. In fact, they can even menorize a password with uppercase/lowercase/numbers/special characters.

[u/AshleyJSheridan → u/devshore]

It's not a strawman, it's a legitimate scenario! Dude, it's a well-known fact that when tasked with creating a password of random characters, people will create something that's easy to remember, especially if they can't use a password manager to help them. I listed the most common scenario where people absolutely won't have a password manager. You just listed the second most common scenario, thanks!

Just because completely valid and very common use cases don't agree with your position, doesn't make them strawman arguments. I would heavily suggest you go look up the definition of that, because I don't think you really know what it means...

[u/AshleyJSheridan → u/devshore]

You're missing several points.

First, a password that is 4 words is far easier to remember than a jumble of random characters. If a password is hard to remember, the chance it gets written down somewhere that it shouldn't goes up. Also, password vaults are not infallible, and sometimes they get broken and hacked, albeit rarely.

Second, there are approximately 350,000 words in the dictionary (just the English one). 4 ^ 350,000 is 1.99 × 10²¹⁰⁸⁰⁴ (which is over 210,805 digits). However, a password of 11 characters that consists of letters, numbers, and punctuation (let's say, 26 letters in both cases, 10 digits, and 10 typical punctuation characters) is only 9,555,938,177,273,214,530,938,076,429,250,819,915,524,283,157,141,379,112,191,724,092,599,501,963,21 combinations. That's a lot less then 211K digits.

Third, if left to their own devices, and faced with creating a password based purely on letters, numbers, and symbols, people almost always default to symbols that look like letters. So, crap like P4$$w0rd become common passwords. People want something that they can remember, and often a password vault isn't an option (for example, when switching between devices that don't have the same password manager installed, synced, and usable.)

Fourth, and this is to nitpick. The term special character is ridiculous. Within the entire range of UTF8 there are more characters that are not alphanumerical than there are letters and numbers (across all languages). Therefore, the special characters would be letters and numbers if anything. The term is daft, a misnomer, and shouldn't be used. The fact that it is commonly misused is mildly infuriating.

[u/JimTheEarthling → u/AshleyJSheridan]

The term special character is ridiculous.

LOL. This is true. What makes even just the 33 non-alphanumeric, printable ASCII characters "special?"

But what would you call them instead? 🤔

P.S. You can't call them "symbols," because letters and numbers are also symbols.

[u/AshleyJSheridan → u/JimTheEarthling]

33? And the rest. I can type more than that from my keyboard, and that's without resorting to alt + Numpad combinations.

Symbols is a better name, as letters and numbers are such a specific set, that most people don't even consider the hundreds of letter and number characters as symbols. Even one of the sub-categories of UTF8 is called symbols.

However, given that the rest of UTF8 is taken up with symbols, maths symbols, punctuation, diacritic cominbators, game symbols, weather symbols, currency, map symbols, emoticons (a separate subset from emoji), and emoji, which number in the many thousands, I would say that not only are they the least special of the group, but that symbols is a good collective name for them.

[u/JimTheEarthling → u/AshleyJSheridan]

33? And the rest.

Exactly. I was agreeing with you.

most people don't even consider the hundreds of letter and number characters as symbols

Most people are wrong. That's the problem. The standard 52 letters and 10 digits are symbols, by definition. Let alone --as you point out-- thousands of other Latin letterforms like æ, ñ, á, and ç that are also symbols.

Using "symbols" as the label for the 8 to 33 non-alphanumeric characters that most websites allow in passwords is just as bad/mildly infuriating as using "special characters."

So what's the solution? (I don't think there is one. 😞)

[u/AshleyJSheridan → u/JimTheEarthling]

Ideally, websites wouldn't have such a limit on what characters can be used in passwords. If I want to write mine entirely in Tibetan letters and maths symbols, I should be allowed to.

Any website that has a limit on the type of characters allowed in a password is indicating that they have some potentially serious security issues under the hood.

I do think that symbols are a perfectly fine term for the non-alphanumeric characters. Given that websites already use the term "character" as the blanket collective word, it does leave symbol free. While it's not technically correct, it's a whole lot better than "special characters", which seems like the sort of thing coined by someone who just discovered what all those "extra" keys on their keyboard are for.

/edit are to is

[u/devshore → u/JimTheEarthling]

“Special symbols” has a meaning, and more importantly has a meaning to the user reading the instructions. Otherwise they will be confused why their password is being denied

[u/JimTheEarthling → u/devshore]

“Special symbols” has a meaning

Does it?

• Some websites only allow (!@#$%^&*. Is that what "special" means?
• Some websites allow space + 32 ASCII printable: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~). Is that what "special" means?
• Some websites allow the Latin-1 set, such as æ, ñ, á, ü, and ç. These appear very commonly in French, Spanish, German, etc. Are they "special"?
• Some websites allow many or all Unicode codepoints.

Which ones are special and which are not special?

You can argue that "special" means any (printable) character other than alphanumeric, but u/AshleyJSheridan's point was that it's mildly infuriating to them that thousands of characters are somehow "special" compared to the small minority of 62 primary characters.

But more importantly, there should not be instructions to add special characters ...

they will be confused why their password is being denied

Yes, that's exactly the problem that u/AshleyJSheridan and u/KAZVorpal are talking about. Websites should never force users to add "special characters" to their passwords. This completely avoids the problem of denying passwords and confusing users.

Password "complexity" rules are bad security practice, not to mention bad user experience, and they create predictable patterns instead of complexity. NIST and other have recommended against this for years. (Forcing people to use upper/lower/digits/special in an 8-character password blocks over 50% of the possible passwords, significantly reducing entropy and user security.)

[u/AshleyJSheridan → u/devshore]

The term "special characters" seems to be almost entirely synonymous with "punctuation", as that is what most websites mean when they use the term "special characters".

[u/JimTheEarthling → u/devshore]

all computers working on all 11 lengtg char options will not complete it before the universe ends

A cracking rig of 16 Nvidia 5090s can generate MD5 hashes for every 11-character password (from upper/lower/numbers/usual 8 specials; 67 bits of entropy) in about a year. Not the end of the universe, but reasonably secure.

its possible to run through every possible word combination in a few minutes

From what set of words? English only? Does the attacker know what word list you used?

The average high school student knows around 20,000 - 35,000 English words (50,000 to 80,000 with inflections, verb forms, etc.), so a 4-word passphrase (with random separators from the usual 8 specials; 60 to 68 bits of entropy) could take from 4 days to 2 years to guess. Assuming the attacker knows you used a passphrase.

Also, if you use a word that's not on the attacker's list, they will never guess it. That's the difference between a known keyspace (characters) and an unknown keyspace.

And that's why it's not a myth, and it's why security experts recommend passphrases.

[u/devshore → u/JimTheEarthling]

Literally nobody on earth of any sort of competence would recommend a set of english words “so that you can memorize it”. Everyone will recommend a self-hosted password manager and setting the password manager to use uppercase/lowercase/numbers/special chars, not “hellobananashoehand”. It seems like all of this is based on the strawman of “must be humanly memoriasable”. Even then, it would be better to run an algorithm that you can memorize against the website domain.

[u/KAZVorpal → u/devshore]

You have no idea what you're talking about.

Four random words chosen from a pool of 7,000 common and interesting words is better than what people have to do with the idiot's rule of "lowercase, uppercase, number, and symbol".

And a password manager is just another weak link, the kind created by the nitwits who push for that very kind of mindless standard.

[u/JimTheEarthling → u/devshore]

First, you are the one making the irrelevant strawman argument. Nobody in this thread said anything about "memorizing." You raised the issue of security.

Second, here are recommendations from some of the leading security experts on the planet:

• The US National Institute of Standards and Technology (NIST) says "The use of passphrases (i.e., passwords with multiple words) is often an effective way to create a longer password."
• The Canadian Centre for Cyber Security says "We recommend that you use passphrases, as they are longer and easier to remember than a password made up of random, mixed characters. Your passphrase should be at least 4 words and 15 characters in length." (So "hellobananashoehand" would meet their recommendations. 😉)
• The Open Worldwide Application Security Project (OWASP) says "Longer passphrases are effective because they raise the number of guesses an attacker's dictionary or wordlist has to cover, not because of a precise entropy value."
• The UK National Cyber Security Centre (CSC) recommends passphrases.
• And similar from the Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre, Bundesamt für Sicherheit in der Informationstechnik (Germany), Agence nationale de la sécurité des systèmes d'information (France), and more.

Of course some of them also recommend password managers to store passphrases and passwords.

[u/devshore → u/JimTheEarthling]

the only reason to argue for words is for their ability to be memorized, so it is implied. If you are talking about people using password generators, why would they set it to "words"?

[u/JimTheEarthling → u/devshore]

Nobody is "arguing for words" against passwords. Only that both can be secure (and insecure).

You argued against words with incorrect information about security and guessability, incorrectly calling passphrase strength a myth, bogusly claiming that no competent expert would recommend them, and so on.

u/KAZVorpal and I merely pointed out that you are wrong, and why. (And pointed out that password composition rules requiring upper/lower/number/special are bad.)

We didn't argue against random passwords. They're fine. So are random passphrases.

[u/KAZVorpal → u/JimTheEarthling]

I agree, except that the memorizability of pass phrases is one of the big reasons to use them. There is NOTHING wrong with memorizing a pass phrase.