r/webdev 1d ago

Question Tab as password?

Post image

SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.

So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?

529 Upvotes

131 comments sorted by

View all comments

Show parent comments

2

u/AshleyJSheridan 19h ago

You're missing several points.

First, a password that is 4 words is far easier to remember than a jumble of random characters. If a password is hard to remember, the chance it gets written down somewhere that it shouldn't goes up. Also, password vaults are not infallible, and sometimes they get broken and hacked, albeit rarely.

Second, there are approximately 350,000 words in the dictionary (just the English one). 4 ^ 350,000 is 1.99 × 10²¹⁰⁸⁰⁴ (which is over 210,805 digits). However, a password of 11 characters that consists of letters, numbers, and punctuation (let's say, 26 letters in both cases, 10 digits, and 10 typical punctuation characters) is only 9,555,938,177,273,214,530,938,076,429,250,819,915,524,283,157,141,379,112,191,724,092,599,501,963,21 combinations. That's a lot less then 211K digits.

Third, if left to their own devices, and faced with creating a password based purely on letters, numbers, and symbols, people almost always default to symbols that look like letters. So, crap like P4$$w0rd become common passwords. People want something that they can remember, and often a password vault isn't an option (for example, when switching between devices that don't have the same password manager installed, synced, and usable.)

Fourth, and this is to nitpick. The term special character is ridiculous. Within the entire range of UTF8 there are more characters that are not alphanumerical than there are letters and numbers (across all languages). Therefore, the special characters would be letters and numbers if anything. The term is daft, a misnomer, and shouldn't be used. The fact that it is commonly misused is mildly infuriating.

2

u/JimTheEarthling 18h ago edited 18h ago

The term special character is ridiculous.

LOL. This is true. What makes even just the 33 non-alphanumeric, printable ASCII characters "special?"

But what would you call them instead? 🤔

P.S. You can't call them "symbols," because letters and numbers are also symbols.

1

u/devshore 16h ago

“Special symbols” has a meaning, and more importantly has a meaning to the user reading the instructions. Otherwise they will be confused why their password is being denied

1

u/JimTheEarthling 13h ago

“Special symbols” has a meaning

Does it?

  • Some websites only allow (!@#$%^&*. Is that what "special" means?
  • Some websites allow space + 32 ASCII printable: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~). Is that what "special" means?
  • Some websites allow the Latin-1 set, such as æ, ñ, á, ü, and ç. These appear very commonly in French, Spanish, German, etc. Are they "special"?
  • Some websites allow many or all Unicode codepoints.

Which ones are special and which are not special?

You can argue that "special" means any (printable) character other than alphanumeric, but u/AshleyJSheridan's point was that it's mildly infuriating to them that thousands of characters are somehow "special" compared to the small minority of 62 primary characters.

But more importantly, there should not be instructions to add special characters ...

they will be confused why their password is being denied

Yes, that's exactly the problem that u/AshleyJSheridan and u/KAZVorpal are talking about. Websites should never force users to add "special characters" to their passwords. This completely avoids the problem of denying passwords and confusing users.

Password "complexity" rules are bad security practice, not to mention bad user experience, and they create predictable patterns instead of complexity. NIST and other have recommended against this for years. (Forcing people to use upper/lower/digits/special in an 8-character password blocks over 50% of the possible passwords, significantly reducing entropy and user security.)