Timeline for Why not allow spaces in a password?
Current License: CC BY-SA 3.0
17 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 13, 2016 at 21:57 | comment | added | AJ Henderson | @DanHenderson - indeed, the 4 word phrase is certainly more secure than just one word in terms of guessing. The risk is that most people will realize "teapot" isn't secure, but they might not realize that "I'm a little teapot short and stout" really isn't that much more secure. Giving someone the illusion of security can be very dangerous from a user's perspective. That said, I don't thing a "no space" policy does much to actually accomplish that, but it's literally the only reason I can think of that someone might try to limit it. Unfortunately ineffective but well meaning policy is common | |
| Jan 13, 2016 at 21:45 | comment | added | Dan Henderson | ...be tried before 4-word meaningful phrases. | |
| Jan 13, 2016 at 21:44 | comment | added | Dan Henderson | @AJHenderson well, by the same token, "teapot" isn't really 6^26 for the same reason - there are only about 10 letters that would logically follow the initial t (including v), and possibly just one letter to follow "teapo". However, just as an attacker doesn't know you used "teapot" without capitals and must therefore include "Alpha" and "aLPhA" and "a!3h^" in his attack, and deciding which of those come before "teapot" affects the effective strength of "teapot", he also doesn't know that you didn't use "horse battery staple" and must decide whether 3-word nonsense phrases should | |
| Jan 13, 2016 at 21:23 | comment | added | AJ Henderson | @PatrickM - I don't disagree it's probably a bad policy. However, if someone chooses a simple word, they know it is insecure. If they make a sentence they may think it is more secure without actually being significantly more secure. I suppose the hope would be that by not letting them be "clever" they might actually make a secure password, but that's really not a particularly good idea either since they could simply drop the spaces. | |
| Jan 13, 2016 at 21:19 | comment | added | AJ Henderson | @DanHenderson - No, your entropy calculations are incorrect because they are not randomly selected words. Meaningful sentences have a lot of structure which drastically reduces the actual entropy. Simply entropy calculations are only valid for truly random choices. For example, if you have "I'm a little ........" then there are much fewer than 250k words likely to fill that spot. Unless it's purely random, it isn't simple entropy. Also, like your last name... :) | |
| Jan 13, 2016 at 21:13 | comment | added | Dan Henderson | So, to summarize these comments: "I'm a little teapot" (entropy 4^250k) is better than "teapot" (6^26) but possibly worse than "T3@p0t45" (8^128) due to being a very well-known phrase. It's definitely no worse (and perhaps marginally better) than "I'malittleteapot" (also 4^250k), but "I really enjoy drinking tea, especially if it's from a high-quality teapot." is better than all of the others, with 13 words plus 3 punctuation marks (comma, hyphen, and period - the apostrophe in "it's" doesn't add to entropy) - so 16^250k, and while it has meaning, it's not a particularly common sentence. | |
| Aug 6, 2014 at 0:40 | comment | added | Kevin Fairchild | I'm not sure I agree with words-with-spaces being less secure than words-without-spaces. If the 'no spaces' rule is known, any attempts that would have occurred using phrases with spaces would then just be done without spaces. Unless you are counting on an attacker who doesn't check the password rules prior to launching an attack, I guess... | |
| Mar 17, 2013 at 1:16 | comment | added | Patrick M | Basically, in a perfect world people would pick good passwords, but nudging someone from a badly selected phrase to a badly selected word is a mistake. (I'm ignoring number and symbol requirements, because adding numbers and symbols to a word usually doesn't improve it more than adding numbers and symbols to a phrase) | |
| Mar 17, 2013 at 1:11 | comment | added | Patrick M | @AJHenderson Yes, it can be worse than a "well selected" english word, but if you need a password policy, you are assuming that most users will not be "well selecting" their password. Basically, my claim is that a badly selected sentence is almost always better than an equally badly selected password. As an example, people often pick what is in front of them for their password. So, I might pick "horse" or "On a Pale Horse". (A book that was randomly in front of me) Now, I admit that phrase is a bad password, but that phrase is often BETTER than an equivalently badly selected word. | |
| Mar 16, 2013 at 23:58 | comment | added | ewanm89 | Of course in all cases random nonsensical strings of words or characters of sufficient length is more secure than non random. but with characters people also make them make sense, and there are less combinations that make sense. after all all are consonant sound, vowel sound consonant sound, vowel sound phonetically. There are less ways to connect a string to make a memorable word especially as we tend to be taught to read/write phonetically. | |
| Mar 16, 2013 at 23:53 | comment | added | ewanm89 | @PatrickM that would depend if the attacker knew you were using a phrase or not. If an attacker had a phrase dictionary of the most commonly used phrases it is the same as a dictionary of most commonly used passwords. | |
| Mar 16, 2013 at 20:14 | comment | added | AJ Henderson | @PatrickM - horse battery staple works because they are random words. Sentences don't add much because there are fairly few options for how they connect. Not saying they don't add anything, but they can actually be destructive compared to a well selected non-English password that is much shorter. | |
| Mar 16, 2013 at 16:05 | comment | added | Patrick M | @ewanm89 Actually, it is very different from using "password". "This is my password" is in fact much safer than "password". Also, if it is requiring numbers and special characters, you are likely to end up with "1his is my p@ssword" which is at least more secure than "p@ssw0rd". Finally, this is probably rather instructive: xkcd.com/936 | |
| Mar 15, 2013 at 21:20 | comment | added | ewanm89 | yes, but that is no different from people using password as there password... the same issues apply, sentences are easier to remember and can have vast varying meanings with a higher number of possibilities using the most common in either case is always bad as it is going to be the first the attacker is going to try. | |
| Mar 15, 2013 at 19:51 | comment | added | AJ Henderson | @ewanm89 - You are correct that random words are not insecure, but people would tend to make meaningful sentences like "this is my password" which are not secure by any means. I'm also not saying it's a GOOD reason. I'm just saying it may be a reason. Personally, I wouldn't block spaces. | |
| Mar 15, 2013 at 19:18 | comment | added | ewanm89 | Sentences for passwords aren't all that insecure there are more possible ways of stringing together 5 words from a dictionary of ~250,000 words than 5 characters from a character set of 128 characters (ASCII). Even if we only choose combinations of words that have meaning against random individual characters there happens to be more entropy, the problem is some phrases are likely to be more common than others is also an issue with character strings used as passwords. Finally refusing space doesn't stop the use of a sentence, just don't put the spaces between the words. | |
| Mar 15, 2013 at 16:16 | history | answered | AJ Henderson | CC BY-SA 3.0 |