Timeline for Need some docs that say we shouldn't upper the string when saving it as a password [closed]
Current License: CC BY-SA 3.0
29 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 30, 2015 at 18:47 | comment | added | Felipe M | @Batuhan take a look at this: csrc.nist.gov/publications/drafts/800-118/draft-sp800-118.pdf (Page 3-8), starting at "Some password mechanisms have more limited character"... See? There is something, just need more of this, friend. Never saw something like this? I know that's obvious, but I need paper, doc telling it! | |
| Mar 30, 2015 at 18:15 | comment | added | Batuhan | @FelipeM Stop searching, you can't find a material saying like this. As I say this is not a common practice, no one write something about that obvious. Why don't be the first? | |
| Mar 30, 2015 at 18:06 | comment | added | Felipe M | @Batuhan I know, I agree. That's the reason why I look for some material that tells "don't upper all, preserve the lower and upper"... But I din't find yet. Just some material saying "you can do that, you can do that"... | |
| Mar 30, 2015 at 16:29 | history | edited | Felipe M | CC BY-SA 3.0 |
added 6 characters in body
|
| Mar 30, 2015 at 15:05 | history | edited | Felipe M | CC BY-SA 3.0 |
improve formatting
|
| Mar 30, 2015 at 14:42 | comment | added | Batuhan | @FelipeM When you uppercase a string, you destroy all lowercase letters. See GZBK's answer below, its strength will decrease and it will become more vulnerable against bruteforce or dictionary attacks and loose user's characteristic (imgur.com/a/NzABs). Passwords shouldn't be modified without users knowledge. | |
| Mar 30, 2015 at 14:37 | comment | added | Xander | @FelipeM Your requirement is too specific. While it's possible something so specific may exist, you are going to expend a great deal of time and energy trying to find it, and there's no guarantee that you will. If you want a document that specific, I suggest you write it. | |
| Mar 30, 2015 at 14:33 | comment | added | Felipe M | @Batuhan No, Batuhan, they say "you can use...". For example, MS says ( technet.microsoft.com/en-us/library/cc786468(v=ws.10).aspx ) that the password must contain characters from three of five categories: upper, lower, Nonalphanumeric, number and unicode. If I upper the string, I still have a strong password. That's the (bad) point. Help me, please :( | |
| Mar 30, 2015 at 14:30 | comment | added | Batuhan | @FelipeM you can't find something like that, because strength password rules are clear. They say use both upper and lowercase letters. If you agree with that, there is no need for "don't uppercase" rule. This question is not frequently asking one, so I don't see a reason for special explanation. Your guideline will be fine without that exception, don't worry. | |
| Mar 30, 2015 at 14:22 | history | edited | Felipe M | CC BY-SA 3.0 |
improved the question
|
| Mar 30, 2015 at 14:14 | comment | added | Felipe M | @Xander "I'm sure", "I think", "I guess", etc.. I need some doc that says "don't upper your string when you're going to save it as a password", explicit as this. | |
| Mar 30, 2015 at 14:08 | comment | added | Xander | This question is essentially a subset of a previous question: Why do some websites and programs restrict password characteristics? Though the implementation is different, functionally it's the same...The developers are preventing users from using lowercase letters in their passwords, and the answers explain why this is bad, particularly the "Bottom Line" section of D.W.'s answer. | |
| Mar 30, 2015 at 14:00 | review | Reopen votes | |||
| Mar 30, 2015 at 14:38 | |||||
| Mar 30, 2015 at 13:44 | history | edited | Felipe M | CC BY-SA 3.0 |
improve my question about the need of some material saying "don't do that"
|
| Mar 30, 2015 at 13:38 | comment | added | Felipe M | @Batuhan yes... but I need find somewhere some doc that says "don't upper all the string". For example, MS says ( technet.microsoft.com/en-us/library/cc786468(v=ws.10).aspx ) that the password must contain characters from three of five categories: upper, lower, Nonalphanumeric, number and unicode. If I upper the string, I still have possibilities. Agree? | |
| Mar 30, 2015 at 13:35 | comment | added | Felipe M | @Philipp I agree about that, maybe there isn't a "rule" about don't upper all the string. I'm going to edit my question asking, then, the explicit recomendation to not upper the string when it's a password because safe reasons. | |
| Mar 30, 2015 at 13:31 | comment | added | apsillers | In what way does conversion to all-uppercase not violate the recommendation mixed-case passwords be allowed? Such a to-uppercase practice is incompatible with mixed-case passwords (since no password, as your application understands passwords, could ever have a lowercase letter). | |
| Mar 30, 2015 at 13:30 | history | closed |
SilverlightFox M'vy Stephane Jens Erat RoraΖ |
Needs details or clarity | |
| Mar 30, 2015 at 13:28 | comment | added | Batuhan | Well, a safe password must contains uppercase & lowercase letters, symbols and numbers. Saving them as uppercase breaks that rule. You can find that safe password rule everywhere and you can use it as "don't uppercase before saving" rule because this action will break complexity rule. | |
| Mar 30, 2015 at 13:25 | answer | added | WhiteWinterWolf | timeline score: 1 | |
| Mar 30, 2015 at 13:24 | comment | added | Philipp | @FelipeM What is the exact difference between "rules" and "recommendations" in your opinion? Any offical "Rule" only applies to a specific organization which is subject to that set of rules, so for everyone else they are just recommendations at best and completely irrelevant at worst. | |
| Mar 30, 2015 at 13:23 | answer | added | tim | timeline score: 2 | |
| Mar 30, 2015 at 13:21 | comment | added | Felipe M | @Philipp I found a lot of password policy, but they just tell us recommendations. I'm looking for rules, not guidelines. Some web post, anything, that tells "don't upper the string before save". I found this: csrc.nist.gov/publications/drafts/800-118/draft-sp800-118.pdf page 3-8, but it's not "DON'T DO THAT" exactly. | |
| Mar 30, 2015 at 13:18 | review | Close votes | |||
| Mar 30, 2015 at 13:30 | |||||
| Mar 30, 2015 at 13:13 | comment | added | Philipp | You could just point to any passwort policy which demands mixed case. That it is pointless to demand mixed case when you then throw it away on the backend should be obvious to anyone. Another pitfall is that upper-casing some more exotic unicode characters is non-trivial and often done inconsistently even by common libraries, which can lead to ambiguity. | |
| Mar 30, 2015 at 13:09 | comment | added | Felipe M | @Batuhan I already saw many applications doing that, I mean, converting lower cases caracters to upper before saving on database. I'm going to write a guideline about safe passwords and need some documentations, manuals, etc., exactly telling that it's not safe upper the caracters. | |
| Mar 30, 2015 at 13:02 | comment | added | Batuhan | I can't see any logic here, its nothing more than an illogical crap in my opinion. | |
| Mar 30, 2015 at 13:00 | review | First posts | |||
| Mar 30, 2015 at 13:01 | |||||
| Mar 30, 2015 at 12:59 | history | asked | Felipe M | CC BY-SA 3.0 |