0

To use a good password, I was thinking about adding special characters. I remember that some login services don't allow all characters. Perhaps it depends also on the keyboard layout.

Could these special characters be used in a common password?

+ @ * # ç % & / ( ) = ? ^ ! [ ] { } - _ : ; > < | , .
Improve this question
1
  • 3
    Short answer, it depends on the system. And even then... Windows permits the use of alt-code characters in passwords, but (at least, once upon a time) Outlook Web Access didn't. – gowenfawr May 24 '16 at 21:36
3

Special characters don't add as much to security as you might think. They increase the number of possible characters, but the most powerful multiplier comes from password length.

Let's say you have a very limited character set consisting of [A-Z][a-z][0-9], giving you 62 possible characters. Therefore a 10 character password has 62^10 possible passwords, or 8.3*10^17. Now add 10 special characters, and the number of possibilities goes to 72^10 possible passwords, or 3.2*10^18.

Choosing an 11 character password from the simple set, you have 62^11 possible passwords, or 5.2*10^19, which is another order of magnitude stronger than adding symbols to a 10 character password.

Of course, if you're picking only dictionary words, even with symbol substitutions, John the Ripper will likely shred the password in short order. Pick long passwords that aren't dictionary words, and you'll make a real difference in your security.

Improve this answer
3
  • Yes that's true. Maybe some login services doesn't allow such long passwords. – Tech-IO May 24 '16 at 20:59
  • Note that this assumes that there are only 10 symbols or punctuation available - ASCII contains 33. This changes the answer wildly as the possible inclusion of the additional 23 characters gives you 5.987369392384e19 possible combinations, or about 7.8e18 more possibilities vs. The 11 character password. – Chase Haddleton May 24 '16 at 21:04
  • 2
    @ChaseHaddleton, agreed; the point is that lengthening the password can be as effective as adding symbols while not running afoul of the random special character blacklists that attempt to prevent SQL, javascript, or path injection attacks. Symbols don't magically improve security. – John Deters May 24 '16 at 21:20
1

If the login service is programmed properly there shouldn't be a problem with you using any of those characters. In fact, it is suggested you use a special character!

When I say "programmed properly" its because sometimes a programmer will not set up his database to support "UTF-8" and then a character such as "ç" might not work...

Improve this answer
3
  • Okay, thank you. It would be good to know if it's programmed well and supports utf-8 or not. It could be a problem when for example creating a random password. – Tech-IO May 24 '16 at 20:29
  • That is correct. While this is a mistake people almost never do it can still be a problem. – Bubble Hacker May 24 '16 at 20:30
  • 1
    @Bubble: if the password is hashed (as it should be), supporting UTF-8 or not in the database, is not a problem, but supporting them at server-side code is. – lepe May 25 '16 at 0:47
1

It depends on where and how you store them. The character set is what comes into play here. As long as all parts in the chain that use the password are setup to use a character set that allows these characters than yes, it's perfectly fine.

A warning

I say all parts because if one part of the chain doesn't support them, it can cause all sorts of problems.

However if this causes a problem, I'd suggest you stop using that service if at all possible and alert them to the issue.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.