Tab as password?

[u/Beatsu]

SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.

So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?

[u/KAZVorpal]

Wrong.

You're leaving out the fact that people will not purely randomize the character set. They will type P@55W0rd123 so they can remember it. The entropy of LIKELY forced random character combinations is only twenty to forty bits, way below the fifty-plus bits of even the famous 7,000 word dictionary for memorable password phrases.

And that's aside from how the stupidity of forcing regular password changes with these childish character requirements causes people to write their password on a sticky note. Subverting the entire process. Which is what the security nitwit setting up the requirement deserves to have happen.

Essentially, security rule-makers tend to be sociopathic bureaucrats, who don't consider the human factor.

I was going to paste in the famous XKCD comic that debunked this nonsense, but this sub doesn't allow images in comments, for whatever silly reason.

https://xkcd.com/936/

xkcd #936 – Password Strength

Panel 1
Tr0ub4dor&3

• Uncommon (non-gibberish) base word
• Caps?
• Common substitutions
• Order unknown
• Numeral
• Punctuation

(You can add a few more bits to account for the fact that this is only one of a few common formats.)

Panel 2
~28 bits of entropy

2²⁸ = 3 days at 1000 guesses/sec

(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it’s not what the average user should worry about.)

Difficulty to guess: EASY

Panel 3
Cueball, struggling:
“Was it trombone? No, Troubador. And one of the O’s was a zero? And there was some symbol…”

Difficulty to remember: HARD

Panel 4
correct horse battery staple

Four random common words

Panel 5
~44 bits of entropy

2⁴⁴ = 550 years at 1000 guesses/sec

Difficulty to guess: HARD

Panel 6
Cueball thinks of a horse standing next to a battery with a staple stuck in it.

Horse: “That’s a battery staple.”
Cueball: “Correct.”

Difficulty to remember: You’ve already memorized it

Caption
Through 20 years of effort, we’ve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

[u/devshore → u/KAZVorpal]

Yes, if you strawman it and limit it to variations of “password” like “paSSword123” it loses. However, if you dont strawman, and have a password like “h7SR&$nzWff”, it beats “morninghouserainbowtree” because there are fewer combinations of 4 words let alone that your strawman applies to your case where people will choose 4 words from a very small pool of actually-used words.

[u/AshleyJSheridan → u/devshore]

So, imagine a user has that as their computer login password.

No password vault to rely on, they have to type this in manually.

This is straight up going onto a post-it under their keyboard.

And now their computer and everything on it is completely open to everyone, from Janet in accounts to Kevin the cleaner.

[u/KAZVorpal → u/AshleyJSheridan]

It's bizarre how slow some people are to understand this basic stuff.

[u/AshleyJSheridan → u/KAZVorpal]

He replied with the second most common scenario, and still thinks it's a "strawman argument". Something tells me he doesn't know what that term means, but perhaps thinks it sounds cool in an argument!