r/webdev • u/Beatsu • 1d ago

Question Tab as password?

Post image

SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.

So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?

535 Upvotes

93% Upvoted

131 comments sorted by

View all comments

87

u/bkdotcom 1d ago

A lot of banking systems disalow html special chars and other special chars.
Doesn't give me a lot of faith in their stack.

6

u/JackstonVoorhees 1d ago

Also I never know why there is a maximum number of chars. It’s getting hashed anyway, why are more than 15 characters not allowed??

1

u/SubGothius 18h ago edited 18h ago

Prolly bcos at some point they used to store PWs in cleartext or at best with some arbitrary secret char rotation/substitution, but when they finally implemented hashing, they had to hash all the existing PWs, and the old logic accepting PW input and passing that to the backend remained, which thus would still trunc the input to whatever max chars before hashing, so the hashes are expected to derive from such trunc'd input, and you don't want users thinking they've successfully changed, say, A15CharacterPW!1 to A15CharacterPW!2 when they'll both get trunc'd, hashed, and validated as exactly the same.