r/webdev • u/Beatsu • Aug 02 '26
Question Tab as password?
SAS disallows spaces in your password. My password manager suggested an invalid (but secure) password.
So now that I have to make my own password: Out of spite, hypothetically, what implications could having tabs in my password have?
119
u/GirthyPigeon Aug 02 '26
Tabs in most fields will skip to the next field. Good luck.
12
u/JapanEngineer Aug 02 '26
Not unless you copy and pasted it
-23
u/KAZVorpal Aug 02 '26
Or your login is an interface that captures tabs.
52
u/DiabloConQueso Aug 02 '26
Not being able to tab from field to field would be horrible for accessibility.
8
u/MacGuyverism Aug 02 '26
Just shift-tab the whole other way around.
12
u/screwcork313 Aug 02 '26
What if your password contains a shift+tab?
34
u/The_Mdk Aug 02 '26
Ah yes, the uppercase tab, for those times the password requires an uppercase letter
4
u/poopio Aug 02 '26
something something \t something else \r\n Accessibility?
20
u/meancoot Aug 02 '26
The password field is not going to accept those kind of escape sequences. They are used in programming language character and string literal tokens.
2
u/Adjective_Noun_4200 Aug 02 '26
The password field is not going to accept
*Shouldnât accept
Itâs horrendous out there, friend.
3
u/scfoothills Aug 02 '26
Yeah. Hopefully everyone learned from the Little Bobby Tables incident.
1
u/little_phoenix_girl Aug 03 '26
I had to fix a Bobby Tables vulnerability about a month ago when I was looking for something else entirely. My boss said "those files come from our vendor so we can trust them, no need to fix it". I fixed it anyway -_-
1
u/kalmakka Aug 02 '26
That's why you use a script to hijack the request and do escape sequence replacements.
19
u/armahillo rails Aug 02 '26
Tab already has a function where the input will likely be captured before it hits the field.
If you really want a weird password, try using some of the extended UTF8 charset, like an all emoji password :D
10
u/Supermathie Aug 02 '26
/me fondly remembers trolling the Windows admins by giving them passwords with ESC in them
3
u/KAZVorpal Aug 02 '26
/me fondly remembers when most Internet users knew how irc/mudd emotes worked.
The (online) world was a more intelligent place, back then.
3
u/Supermathie Aug 02 '26
/we just added this to Discourse's chat :D
2
u/KAZVorpal Aug 02 '26
I really love the idea of Discourse, but how do you get past the enshittified lock-in that Discord and Reddit have? Essentially, corporate law has allowed them to each become a monopoly in their service.
2
u/Supermathie Aug 04 '26
It's a constant struggle; one of my favourite arguments (towards forum owners) is that it's a business risk for another company to OWN YOUR DATA.
e.g. nVidia would never let another company own their forum data
Even if you're not a behemoth, take care & control of your community.
0
u/KAZVorpal Aug 02 '26
There's no need to do that, though. Just pick some random words, that's more secure than any complex jumble of characters.
1
-1
u/devshore Aug 02 '26
People keep apreading this myth. An 11 length char with uppercase/lowercase, at least 1 number, and at least one special character is more secure than 4 random words because its possible to run through every possible word combination in a few minutes while all computers working on all 11 lengtg char options will not complete it before the universe ends.
9
u/KAZVorpal Aug 02 '26
Wrong.
You're leaving out the fact that people will not purely randomize the character set. They will type P@55W0rd123 so they can remember it. The entropy of LIKELY forced random character combinations is only twenty to forty bits, way below the fifty-plus bits of even the famous 7,000 word dictionary for memorable password phrases.
And that's aside from how the stupidity of forcing regular password changes with these childish character requirements causes people to write their password on a sticky note. Subverting the entire process. Which is what the security nitwit setting up the requirement deserves to have happen.
Essentially, security rule-makers tend to be sociopathic bureaucrats, who don't consider the human factor.
I was going to paste in the famous XKCD comic that debunked this nonsense, but this sub doesn't allow images in comments, for whatever silly reason.
xkcd #936 â Password Strength
Panel 1
Tr0ub4dor&3
- Uncommon (non-gibberish) base word
- Caps?
- Common substitutions
- Order unknown
- Numeral
- Punctuation
(You can add a few more bits to account for the fact that this is only one of a few common formats.)
Panel 2
~28 bits of entropy2²⸠= 3 days at 1000 guesses/sec
(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but itâs not what the average user should worry about.)
Difficulty to guess: EASY
Panel 3
Cueball, struggling:
âWas it trombone? No, Troubador. And one of the Oâs was a zero? And there was some symbolâŚâDifficulty to remember: HARD
Panel 4
correct horse battery stapleFour random common words
Panel 5
~44 bits of entropy2â´â´ = 550 years at 1000 guesses/sec
Difficulty to guess: HARD
Panel 6
Cueball thinks of a horse standing next to a battery with a staple stuck in it.Horse: âThatâs a battery staple.â
Cueball: âCorrect.âDifficulty to remember: Youâve already memorized it
Caption
Through 20 years of effort, weâve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.-2
u/devshore Aug 02 '26
Yes, if you strawman it and limit it to variations of âpasswordâ like âpaSSword123â it loses. However, if you dont strawman, and have a password like âh7SR&$nzWffâ, it beats âmorninghouserainbowtreeâ because there are fewer combinations of 4 words let alone that your strawman applies to your case where people will choose 4 words from a very small pool of actually-used words.
7
u/KAZVorpal Aug 02 '26
There's that sociopathy I was talking about.
Failing to model the way actual human beings function.
It's not a straw man, it's that most people will not, and should not be expected to, make up completely random combinations of 96 glyphs every 90 days as their password. That's pure nonsense.
Back in the real world, this kind of bad security theater produces sticky notes with passwords on monitors, and leetspeak passwords. And plain text word combinations are far superior to that.
The problem here is that these dingbats steel man how the passwords are going to be handled, far beyond what anyone would tolerate.
-1
u/devshore Aug 02 '26
It is a strawman to force a rule that âit must be memoriazableâ âbecause thats how people areâ. Nobody is debating whether people are doing things correctly or not, we are debating what the correct way is. So may moving of goals posts and strawmen. Why do you think most places wont even allow âorangetreefaststreetâ as a password and insist on uppercase/lowercase/min number/special char? Because orangetreefastroadncan be cracked in seconds because its part of a âtypeâ that a hacker will attempt because it costs nothing to attempt, whereas they wont bother with the other.
3
u/KAZVorpal Aug 02 '26
It takes a LOT of sociopathy to not understand that "the right way" is meaningless when it's miserable for users, who will therefore, quite rightfully, undermine that "way".
And no, orangetreefastroad is fifty bits of entropy. That makes it harder to crack than the ACTUAL leetspeak passwords that nitwit admins force users to come up with.
5
u/AshleyJSheridan Aug 02 '26
So, imagine a user has that as their computer login password.
No password vault to rely on, they have to type this in manually.
This is straight up going onto a post-it under their keyboard.
And now their computer and everything on it is completely open to everyone, from Janet in accounts to Kevin the cleaner.
2
u/KAZVorpal Aug 02 '26
It's bizarre how slow some people are to understand this basic stuff.
2
u/AshleyJSheridan Aug 02 '26
He replied with the second most common scenario, and still thinks it's a "strawman argument". Something tells me he doesn't know what that term means, but perhaps thinks it sounds cool in an argument!
1
u/KAZVorpal Aug 04 '26
Good point, I was unfairly assuming he at least knew what his arguments meant.
0
u/devshore Aug 02 '26
Another strawman - narrowing it down to a scenario where they only have to memorize one password (their computer login). Nobody is going to memorize their 4 word combos on hundreds of things they use passwords on. However, they can memorize a password for a self-hosted password manager. In fact, they can even menorize a password with uppercase/lowercase/numbers/special characters.
2
u/AshleyJSheridan Aug 02 '26
It's not a strawman, it's a legitimate scenario! Dude, it's a well-known fact that when tasked with creating a password of random characters, people will create something that's easy to remember, especially if they can't use a password manager to help them. I listed the most common scenario where people absolutely won't have a password manager. You just listed the second most common scenario, thanks!
Just because completely valid and very common use cases don't agree with your position, doesn't make them strawman arguments. I would heavily suggest you go look up the definition of that, because I don't think you really know what it means...
2
u/AshleyJSheridan Aug 02 '26
You're missing several points.
First, a password that is 4 words is far easier to remember than a jumble of random characters. If a password is hard to remember, the chance it gets written down somewhere that it shouldn't goes up. Also, password vaults are not infallible, and sometimes they get broken and hacked, albeit rarely.
Second, there are approximately 350,000 words in the dictionary (just the English one). 4 ^ 350,000 is 1.99 Ă 10²šâ°â¸â°â´ (which is over 210,805 digits). However, a password of 11 characters that consists of letters, numbers, and punctuation (let's say, 26 letters in both cases, 10 digits, and 10 typical punctuation characters) is only 9,555,938,177,273,214,530,938,076,429,250,819,915,524,283,157,141,379,112,191,724,092,599,501,963,21 combinations. That's a lot less then 211K digits.
Third, if left to their own devices, and faced with creating a password based purely on letters, numbers, and symbols, people almost always default to symbols that look like letters. So, crap like
P4$$w0rdbecome common passwords. People want something that they can remember, and often a password vault isn't an option (for example, when switching between devices that don't have the same password manager installed, synced, and usable.)Fourth, and this is to nitpick. The term special character is ridiculous. Within the entire range of UTF8 there are more characters that are not alphanumerical than there are letters and numbers (across all languages). Therefore, the special characters would be letters and numbers if anything. The term is daft, a misnomer, and shouldn't be used. The fact that it is commonly misused is mildly infuriating.
2
u/JimTheEarthling Aug 02 '26 edited Aug 02 '26
The term special character is ridiculous.
LOL. This is true. What makes even just the 33 non-alphanumeric, printable ASCII characters "special?"
But what would you call them instead? đ¤
P.S. You can't call them "symbols," because letters and numbers are also symbols.
1
u/AshleyJSheridan Aug 02 '26
33? And the rest. I can type more than that from my keyboard, and that's without resorting to
alt+ Numpad combinations.Symbols is a better name, as letters and numbers are such a specific set, that most people don't even consider the hundreds of letter and number characters as symbols. Even one of the sub-categories of UTF8 is called symbols.
However, given that the rest of UTF8 is taken up with symbols, maths symbols, punctuation, diacritic cominbators, game symbols, weather symbols, currency, map symbols, emoticons (a separate subset from emoji), and emoji, which number in the many thousands, I would say that not only are they the least special of the group, but that symbols is a good collective name for them.
1
u/JimTheEarthling Aug 02 '26
33? And the rest.
Exactly. I was agreeing with you.
most people don't even consider the hundreds of letter and number characters as symbols
Most people are wrong. That's the problem. The standard 52 letters and 10 digits are symbols, by definition. Let alone --as you point out-- thousands of other Latin letterforms like Ì, ù, å, and ç that are also symbols.
Using "symbols" as the label for the 8 to 33 non-alphanumeric characters that most websites allow in passwords is just as bad/mildly infuriating as using "special characters."
So what's the solution? (I don't think there is one. đ)
1
u/AshleyJSheridan Aug 02 '26 edited Aug 02 '26
Ideally, websites wouldn't have such a limit on what characters can be used in passwords. If I want to write mine entirely in Tibetan letters and maths symbols, I should be allowed to.
Any website that has a limit on the type of characters allowed in a password is indicating that they have some potentially serious security issues under the hood.
I do think that symbols are a perfectly fine term for the non-alphanumeric characters. Given that websites already use the term "character" as the blanket collective word, it does leave symbol free. While it's not technically correct, it's a whole lot better than "special characters", which seems like the sort of thing coined by someone who just discovered what all those "extra" keys on their keyboard are for.
/edit are to is
1
u/devshore Aug 02 '26
âSpecial symbolsâ has a meaning, and more importantly has a meaning to the user reading the instructions. Otherwise they will be confused why their password is being denied
1
u/JimTheEarthling Aug 03 '26
âSpecial symbolsâ has a meaning
Does it?
- Some websites only allow (!@#$%^&*. Is that what "special" means?
- Some websites allow space + 32 ASCII printable: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~). Is that what "special" means?
- Some websites allow the Latin-1 set, such as Ì, ù, å, ß, and ç. These appear very commonly in French, Spanish, German, etc. Are they "special"?
- Some websites allow many or all Unicode codepoints.
Which ones are special and which are not special?
You can argue that "special" means any (printable) character other than alphanumeric, but u/AshleyJSheridan's point was that it's mildly infuriating to them that thousands of characters are somehow "special" compared to the small minority of 62 primary characters.
But more importantly, there should not be instructions to add special characters ...
they will be confused why their password is being denied
Yes, that's exactly the problem that u/AshleyJSheridan and u/KAZVorpal are talking about. Websites should never force users to add "special characters" to their passwords. This completely avoids the problem of denying passwords and confusing users.
Password "complexity" rules are bad security practice, not to mention bad user experience, and they create predictable patterns instead of complexity. NIST and other have recommended against this for years. (Forcing people to use upper/lower/digits/special in an 8-character password blocks over 50% of the possible passwords, significantly reducing entropy and user security.)
1
u/AshleyJSheridan Aug 03 '26
The term "special characters" seems to be almost entirely synonymous with "punctuation", as that is what most websites mean when they use the term "special characters".
1
u/JimTheEarthling Aug 02 '26
all computers working on all 11 lengtg char options will not complete it before the universe ends
A cracking rig of 16 Nvidia 5090s can generate MD5 hashes for every 11-character password (from upper/lower/numbers/usual 8 specials; 67 bits of entropy) in about a year. Not the end of the universe, but reasonably secure.
its possible to run through every possible word combination in a few minutes
From what set of words? English only? Does the attacker know what word list you used?
The average high school student knows around 20,000 - 35,000 English words (50,000 to 80,000 with inflections, verb forms, etc.), so a 4-word passphrase (with random separators from the usual 8 specials; 60 to 68 bits of entropy) could take from 4 days to 2 years to guess. Assuming the attacker knows you used a passphrase.
Also, if you use a word that's not on the attacker's list, they will never guess it. That's the difference between a known keyspace (characters) and an unknown keyspace.
And that's why it's not a myth, and it's why security experts recommend passphrases.
2
u/devshore Aug 02 '26
Literally nobody on earth of any sort of competence would recommend a set of english words âso that you can memorize itâ. Everyone will recommend a self-hosted password manager and setting the password manager to use uppercase/lowercase/numbers/special chars, not âhellobananashoehandâ. It seems like all of this is based on the strawman of âmust be humanly memoriasableâ. Even then, it would be better to run an algorithm that you can memorize against the website domain.
3
u/KAZVorpal Aug 02 '26
You have no idea what you're talking about.
Four random words chosen from a pool of 7,000 common and interesting words is better than what people have to do with the idiot's rule of "lowercase, uppercase, number, and symbol".
And a password manager is just another weak link, the kind created by the nitwits who push for that very kind of mindless standard.
2
u/JimTheEarthling Aug 02 '26
First, you are the one making the irrelevant strawman argument. Nobody in this thread said anything about "memorizing." You raised the issue of security.
Second, here are recommendations from some of the leading security experts on the planet:
- The US National Institute of Standards and Technology (NIST) says "The use of passphrases (i.e., passwords with multiple words) is often an effective way to create a longer password."
- The Canadian Centre for Cyber Security says "We recommend that you use passphrases, as they are longer and easier to remember than a password made up of random, mixed characters. Your passphrase should be at least 4 words and 15 characters in length." (So "hellobananashoehand" would meet their recommendations. đ)
- The Open Worldwide Application Security Project (OWASP) says "Longer passphrases are effective because they raise the number of guesses an attacker's dictionary or wordlist has to cover, not because of a precise entropy value."
- The UK National Cyber Security Centre (CSC) recommends passphrases.
- And similar from the Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre, Bundesamt fßr Sicherheit in der Informationstechnik (Germany), Agence nationale de la sÊcuritÊ des systèmes d'information (France), and more.
Of course some of them also recommend password managers to store passphrases and passwords.
1
u/devshore Aug 02 '26
the only reason to argue for words is for their ability to be memorized, so it is implied. If you are talking about people using password generators, why would they set it to "words"?
6
u/JimTheEarthling Aug 02 '26
Nobody is "arguing for words" against passwords. Only that both can be secure (and insecure).
You argued against words with incorrect information about security and guessability, incorrectly calling passphrase strength a myth, bogusly claiming that no competent expert would recommend them, and so on.
u/KAZVorpal and I merely pointed out that you are wrong, and why. (And pointed out that password composition rules requiring upper/lower/number/special are bad.)
We didn't argue against random passwords. They're fine. So are random passphrases.
2
u/KAZVorpal Aug 02 '26
I agree, except that the memorizability of pass phrases is one of the big reasons to use them. There is NOTHING wrong with memorizing a pass phrase.
85
u/bkdotcom Aug 02 '26
A lot of banking systems disalow html special chars and other special chars.
Doesn't give me a lot of faith in their stack.
43
u/ImpossibleFood8242 Aug 02 '26
if they're stripping out spaces but not tabs that's the kind of jank that keeps me employed
21
u/KAZVorpal Aug 02 '26
If they're stripping out spaces, they're morons.
Even NIST recommends allowing spaces.
5
u/MegaIng Aug 02 '26
Even NIST recommends allowing spaces.
Yesn't:
Users should also be able to include space characters to allow the use of phrases. Repeated space characters add little to the effective strength of passwords and may introduce usability issues (e.g., the undetected use of two spaces rather than one), so removing repeated spaces in typed passwords may be beneficial if initial verification fails.
Verifiers MAY make limited allowances for mistyping (e.g., removing leading and trailing whitespace characters before verification, ...)
Allow spaces, but normalize for usability. And Tab is not on the list of suggested allowed characters.
-8
u/tup1tsa_1337 Aug 02 '26
Yeah, nothing better than turning on password visibility and wondering why is your password incorrect (hint: you entered space by accident as first or last character).
Spaces are disallowed for a reason: they are hard to spot
11
u/TramEatsYouAlive Aug 02 '26
Then let's disallow I and l, O and 0, 3 and Đ (yes, these are different characters), and also ' and `
3
u/KAZVorpal Aug 02 '26
Spaces are disallowed because most security consultants are worthless idiots.
It's up to the user to not make obvious mistakes. You don't restrict everyone's choice based on the dumbest user.
Like I said, even the National Institute of Standards and Technology recommends allowing spaces.
-1
u/AshleyJSheridan Aug 02 '26
Tabs are spaces. Not all spaces are tabs.
1
u/vip17 Aug 03 '26
Tabs are not spaces. Tabs are whitespaces. But pressing the tab key doesn't produce a tab character in a GUI form field most of the time
1
u/AshleyJSheridan Aug 03 '26
Ah, a pedant!
Yes, tabs are a type of whitespace character.
And you can absolutely insert a tab character into a form field on the web. If you don't know how, sounds like a skill issue.
0
u/vip17 Aug 03 '26
who said that it's not possible? But it's extremely inconvenient. And many fields filter out the tab character outright
1
u/AshleyJSheridan Aug 03 '26
Makes a good character for a password then. If a website is filtering out characters from a password before creating the hash, that's not a secure website, and they are likely making a lot of other poor security decisions.
17
u/nobody5050 Aug 02 '26
My banking app disallows a list of characters that is shockingly similar to SQL...
4
u/fuckmywetsocks Aug 02 '26
Same - mine also won't allow question marks or ampersands leading me to think the password is getting passed around as a GET param in some ancient backend.
3
u/KAZVorpal Aug 02 '26
All of which tells us the idiots don't sanitize their inputs competently.
1
u/fuckmywetsocks Aug 02 '26
No of course they don't - the upheaval would be incredible. It's all scabs on scabs.
2
u/DeifniteProfessional Aug 02 '26
The majority of established banks absolutely are just patching their systems endlessly. That's why they hire developers for languages nobody uses anymore.
And also why I choose to bank with banks that are less than 15 years old lol
1
u/TuttiFlutiePanist Aug 02 '26
My bank disallows single quotes in the "name of your bill pay" field, but did not indicate that was a rule.
4
u/JackstonVoorhees Aug 02 '26
Also I never know why there is a maximum number of chars. Itâs getting hashed anyway, why are more than 15 characters not allowed??
5
u/AshleyJSheridan Aug 02 '26
Technically, there are some hashing algorithms that ignore after a certain character length, but we're talking lengths much higher than 15!
3
1
u/SubGothius Aug 02 '26 edited Aug 02 '26
Prolly bcos at some point they used to store PWs in cleartext or at best with some arbitrary secret char rotation/substitution, but when they finally implemented hashing, they had to hash all the existing PWs, and the old logic accepting PW input and passing that to the backend remained, which thus would still trunc the input to whatever max chars before hashing, so the hashes are expected to derive from such trunc'd input, and you don't want users thinking they've successfully changed, say,
A15CharacterPW!1toA15CharacterPW!2when they'll both get trunc'd, hashed, and validated as exactly the same.
15
u/avidvaulter Aug 02 '26
My password manager suggested an invalid (but secure) password.
So now that I have to make my own password
????
What password manager doesn't allow you to keep generating a new secure password until you get one that's acceptable? Why is this posted in this subreddit?
This post is bad and you should feel bad.
8
4
u/oxotower Aug 02 '26
Itâs not bad, itâs opened up an interesting conversation around how browsers would handle the keypress and ways of managing passwords.
20
u/tswaters Aug 02 '26
Any time I see any secure password prompt I am immediately suspicious if the server-side responds with any error looking at the password. There's no images in this subreddit, but I have a software gore screenshot of an obnoxious set of symbol & letter & number requirements, a password that satisfies all of them, but includes a symbol that isn't in the list and fails. That was from a credit card company. The amount of times I need to redo the requirements in my password generator to accomodate for bugs or unacceptable characters.... is too damn high!
1
u/cowboyecosse Aug 02 '26
Super annoying when the suggested password has already saved in the password manager before the error message is shown/password rejected.
9
u/tajetaje Aug 02 '26
On a well implemented backend? Nothing. On one that doesnât sanitize inputs or does stupid things with them? Could break their parsing or data storage, probably no sap injection vulns there though. I imagine the reason for disallowing spaces is so people donât get confused by things like multiple spaces when they thought there was one, or trailing spaces
2
u/TramEatsYouAlive Aug 02 '26
I have seen a banking app (web-based), that will think that "password" and "PaSsWoRd" are essentially the same. Which led me to believe that they are not hashing passwords on the backend and storing them in some different way...
3
4
11
u/RePsychological Aug 02 '26 edited Aug 02 '26
I am so confused by this post and its seemingly bot-infused comment section.
...and if the latter isn't it, what the f* happened to web devs?
Like it is blatantly obvious why a tab in a password is a bad idea....
...and there are so many comments seemingly somehow fumed by the fact that it's common occurrence to disallow it along with other chars like spaces...
And yet legitimate posts with actual meat to the subject I'll see immediately go into the 0 and negative votes "just because".
....and you sit here with a bullshit post of "nah shit sherlock"-level content with 30+ upvotes and a peanut gallery somehow in agreement on something that is obviously a bad idea for why you shouldn't put the tab there...and plenty of documentation on the internet for why it and other similar "certain special chars disallowed passwords (including spaces)" are that way...
Is this really what vibe coding has done to web development in just a few short years?
3
u/Beatsu Aug 02 '26
Personally, I'm more critiquing the arbitrary restrictions to passwords. If I want a 51 character long password with spaces and emojis, then let me. It should be hashed before anything else is done with it anyway.
It's not worth ruining the natural user flow and forcing them to repeatedly regenerate passwords with a password manager, or have them come up with a manual password (probably a much less secure one) instead.
If you're handling my password in a way that makes tab crash your system - then that's deserved.
-1
u/RePsychological Aug 03 '26
congrats on getting a few of your bots to pull you out of the negative votes range on this comment.
-2 to -3 all day...and then suddenly jumps to +1
Karma-farming bot detected.
6
2
u/discobean Aug 02 '26
I used to use a space as a password, holding alt, then typing 255 would get you a space character, which sometimes could be accepted
2
u/linuxdropout Aug 04 '26
A classic.
A good 20 years ago I thought it'd be funny to set my password to 8 spaces at school.
In doing so, trying to login by entering 8 spaces would not work, but leaving the password field entirely blank would work fine.
When I came time to change my password 6 months later, the form let me leave the old password blank and enter my new password. Immediately after I submitted this form nobody at school could login anymore. Somehow one of the IT people worked out what happened and I had to enter my password in so he could login to an admin account and reset everyone's passwords.
Quite an incredible set of events and failures in software. My guess on what happened:
- passwords are trimmed for spaces so I ended up with an empty password in the database
- some sql-building expression hit an if (!password) clause and ended up updating every password rather than just mine
1
1
1
u/TheHappiestTeapot Aug 02 '26
I had a user do this on an old SunOS(?) machine.
Everything was fine and dandy util we rolled out X11 and tab took you to the next field. Hahah. Simple password reset, but he had a good point, I wouldn't have included tab if bruteforcing.
1
1
u/whatThePleb Aug 02 '26
The most likely thing that might happen is, that one day you can't login anymore, as they might suddenly filter it.
1
u/danielkov Aug 02 '26
Aim is to increase the theoretical search space. Humans are lazy, so the actual search space often narrows to a predictable subset (how many times have you added an exclamation point at the end to satisfy "special character"?) They also disqualify some password generators, that generate otherwise adequate passwords.
Secure password rules:
- allow all characters
- at least 64 characters
- minimum 12 characters
- no arbitrary composition rules
- no periodic password rotation
What you can do as a user:
- use a generator that can be configured with this arbitrary ruleset
- always store passwords in a manager
- use MFA if available
- fly a different airline
1
u/burlingk Aug 02 '26
It would make it very hard for you overall unless you only ever use the account on devices where you have a text file holding the password.
1
u/projectoffset Aug 02 '26
All fun and games until they change the regex pattern for validation on a future update
1
1
u/Hettyc_Tracyn Aug 02 '26
Why use such a short password? I do a minimum of 20 characters (unless a site is stupid and doesnât allow it)
1
u/who_you_are Aug 02 '26
"no space" yet it is one of the most secure characters because a lot of password manager don't include it in their generated password
1
u/thekwoka Aug 02 '26
The US government officially removed the recommendation to have all those extra requirements. Just require a long password and let the user do whatever they want, since the "pne special character" is basically always '!' and the capital letter is almost always the first letter, and the digit is almost always 1 and at the end.
So the requirements were making passwords harder to remember while not improving security at all.
1
1
u/techek Aug 02 '26
Why does so many webapplications have faulty logic when validating long passwords like 100 characters/digits/symbols or longer?
I see error messages like "Password is too short", "Enter a valid password" or even "Password must be maximum 30 characters long".
Let me enter my crazy, long and complex password and use whatever part of it you like, but don't give me wrong errormessages.
1
1
u/PFallqvist Aug 03 '26
What password manager are you using? Seems like a quite serious bug if it suggests a tab (which could be considered multiple spaces depending on who you ask) to be included in your password đ
1
1
u/Spacemonk587 Aug 03 '26
The implications of a tab in a password would be that you canât type it. I would assume though that it would be slightly more secure than other chars, but at the end of the day, it doesn't matter.
1
u/kakaggarwal Aug 03 '26
But it depends on how the tab is stored. What is it transformed into while storing the password and how the matching of the password is done. The storage how can only determine the security implications
1
u/FFFortissimo Aug 04 '26
Even when it would work on a computer, try typing a TAB on your phone ;)
Or using a password manager like KeePass. I wonder if a password generator like Mind Your Pass could generate such password.
1
u/FastMinify Aug 04 '26
They finally solved the problem of users choosing weak passwords by making them impossible to type.
0
u/KAZVorpal Aug 02 '26
It is sheer idiocy to prohibit spaces, or tabs, in passwords.
It is even more moronic to require special characters, upper/lowerspace combos, and numbers.
All that is really important is the level of entropy under a likely attack vector. Four randomly chosen common words is more secure, for several reasons, than a garbage pile of ascii/unicode.
2
Aug 02 '26 edited 13d ago
[deleted]
-5
u/KAZVorpal Aug 02 '26
Are you using a brail reader? Actually, even if you are, all good screen readers have special commands to leave fields, nobody actually needs the tab to do so. And, of course, escape blurs the field anyway, enabling even tab.
4
Aug 02 '26 edited 13d ago
[deleted]
-4
u/KAZVorpal Aug 02 '26
I don't care whether it's normal, as I said there are always other ways out of the field.
3
u/Snapstromegon Aug 02 '26
This is like saying "on our site links don't open with left click. There are always other ways to open a link". Tabbing out is one of (if not) the most common way to exit a field.
1
u/taotau Aug 02 '26
Disallowing spaces is wrong and probably stems from the early days of systems where passwords were simply checked for a-z A+Z 0-9 out of habit and was embedded in early hashing algos so it has just hung around. There is no technical reason for not allowing spaces.
A tab is actually one of a set of special control characters that have specific meanings to computer systems. Others include carriage return, line feed, form feed, vertical tab, bell, eascape, interrupt, suspend etc. these are encoded in the first 32 characters of the ASCII character set, the grand daddy of all modern character encoding systems.
Text handling applications will typically send characters below 0x20 to a special handler to perform some system function and never pass them to the standard text processor. In most text editors for example, hitting tab will insert 2, 4, or 8 spaces, or if you're on the other team, it can sometimes directly insert the tab character (I am so glad that holy war is over - I was always on the spaces team).
So as mentioned hitting tab in a typical web form is intercepted by the browser and moves the cursor to the next item in the tab list, so the password field will never see it.
There are also places you might need to type a password that normal users would never see, like many command line interfaces in a terminal, or sometimes systems might be passing plain text passwords to other systems in the background, many legacy systems wrappers would use this technique, and special characters come into play.
Pasting a password is not a supported use case as that probably means that you have your passwords stored somewhere in plain text which is a bad idea - yes I know password managers use paste, but that's a niche use case up until fairly recent times (computer systems and libraries move fairly slowly, and password managers have only become common in the last few years).
TLDR, tab is forbidden because it is part of a set of special characters that have historical low level uses that still come into play today. Nothing wrong with spqces
1
0
u/Tiaoshi Aug 02 '26
To be fair, whoâs gonna think about putting a tab in there? Iâd say that is one secure password lol
0
u/DollyNation812 Aug 02 '26
I'm new here I was so disappointed damn big brother I had a request a heartfelt request and they block it
-3
u/EncryptedPlays Aug 02 '26
is tab even a real character? i just assumed it's either a bunch of spaces or an indent. This looks to me like one of those fancy whitespace things
2
u/Expensive_Peace8153 Aug 02 '26
It's character code 09.
1
1
u/KAZVorpal Aug 02 '26
In the ASCII set of characters, it's number 009. It has its own separate spot. Enter is 013. The space is 032.
<- tab. If Reddit saves it. I typed alt-009 on this Windows machine, and the cursor moved over a way.On Linux I believe control-shift-009 would work, but I'm not saving this comment and pulling it up on my Void machine to make sure. Higher unicode is different there, like emdash (â) is alt-0151 on Windows, but control-shift-2014 on Linux.
Essentially, every character/glyph you see is represented by a number in a computer, including the special ones like tab, line feed, and carriage return.
0
498
u/scfoothills Aug 02 '26
You will only be able to copy-paste your password to log in because trying to type the tab character will just advance you to the next field.