2

Recently I came up with a password requirement rules as follows:

The password must

  • be 8-16 characters
  • contain at least one number
  • contain at least one lower case letter
  • contain at least one upper case letter
  • contain at least one of these special characters: "@#$%^+=*_.?"
  • cannot start with a "?"
  • cannot have the same character repeated more than 2 times in a row (e.g "aa")

Everything except can not start with a "?", is acceptable. Does anyone know a special reason for this requirement?

Improve this question
7
  • You want to know why they do not allow passwords that start with a ? ? Your second to last line is a little difficult to understand.
    – schroeder ♦
    Commented Feb 19, 2019 at 13:53
  • 1
    I believe he's trying to say "It cannot start with a ? (and I mean the "?" not the letter "a")", but it does make it pretty confusing. @MuhammetAliAsan is that correct?
    – AndrolGenhald
    Commented Feb 19, 2019 at 14:11
  • @AndrolGenhald I tried to read that line a dozen different ways and never saw that interpretation. Thanks. I'm still not certain, though.
    – schroeder ♦
    Commented Feb 19, 2019 at 14:22
  • 1
    Muhammet, Androl changed your wording. Is it what you meant to say?
    – schroeder ♦
    Commented Feb 19, 2019 at 14:23
  • 2
    Maybe it is used in a URL querystring parameter and do have some poor coding, for example. /hello.aspx?param1=value1&param2=value2
    – bradbury9
    Commented Feb 19, 2019 at 15:57

3 Answers 3

Reset to default
5

This seems to be a technical requirement of SAP.

The first character may not be an exclamation point (!) or a question mark (?).

Source

Improve this answer
3
  • 1
    Wow, SAP sucks. Pretty sure this implies that they don't properly hash passwords: "At least one character in the new password must be different from the old password."
    – Conor Mancone
    Commented Feb 19, 2019 at 15:27
  • 1
    @ConorMancone That sounds like a weird way of saying that it can't match the old password, but the linked document says "the administrator can specify the minimum number of characters that must be different". Otoh as long as it always requires you to type the old password when changing, it doesn't imply anything about the hashing.
    – AndrolGenhald
    Commented Feb 19, 2019 at 15:51
  • @AndrolGenhald Yes, I think it is a weird (and less effective) way of making sure it doesn't match the old password. Good point though - they do require the old password when changing password, so this doesn't require adding them to plaintextoffenders.com SAP is pretty much the definition of "legacy", so I just assumed the worst (especially given all of their other less-traditional) password rules.
    – Conor Mancone
    Commented Feb 19, 2019 at 16:06
6

In SQL, prepared statements often use the ? as a placeholder. If they used parameterised queries but did not sanitise the inputs, then starting the password with a ? could confuse their code and result in an error.

This does not mean that this requirement is justified. It means that they know that they have insecure/buggy code and are forcing the users to enter their passwords in a certain way instead of fixing their code.

Improve this answer
3
  • That may be a reason why someone would forbid question marks, and certainly +1 for "that doesn't mean the requirement is justified". However, as a frequent user of prepared statements, I don't see how a password using a question mark would cause any confusion. The password contents themselves are never seen in the code, and the SQL driver certainly wouldn't be confused.
    – Conor Mancone
    Commented Feb 19, 2019 at 15:08
  • @ConorMancone it all depends on how the inputs are parsed. If the PHP passes everything over to another system, then you would have this problem. I've seen crappy code like this before.
    – schroeder ♦
    Commented Feb 19, 2019 at 15:10
  • 1
    To steal from Homer (the Simpson one, not the greek one): Scrappy code: the cause of - and solution to - all of life's problems.
    – Conor Mancone
    Commented Feb 19, 2019 at 15:11
5

No

There is no good reason to disallow any particular letter or character at the start of a password.

This sounds like an attempt to stop people from using common "bad" passwords (like making a rule that passwords can't start with a 'p' to stop people from using password as their password).

To go further though, almost all of these rules disagree with the latest password guidelines from the NIST. In particular, requiring special characters is no longer considered best practice. Rather, the most important rule these days is to simply check against a list of known leaked passwords (which can be easily done using services like haveibeenpwned).

In particular I would point out that the last rule (no repeated characters) sounds good, but in practice decreases entropy of unique random passwords, and therefore actually makes passwords less secure. These kinds of rules are generally recognized as more "security theater" than anything else, and don't actually help users make better passwords.

Improve this answer
5
  • You are assuming that the OP came up with these rules. I'm not sure he did or if he discovered these rules from somewhere else. I read it as though he found these rules somewhere. All in all, a confusing question.
    – schroeder ♦
    Commented Feb 19, 2019 at 14:45
  • @schroeder Definitely a confusing question, although I decided to answer because the answer is the same regardless. I wasn't sure myself if this was a proposed set of rules he would implement or a set of rules he ran across, and meant to keep my answer a bit general as a result. I'll edit accordingly...
    – Conor Mancone
    Commented Feb 19, 2019 at 14:55
  • But there is a technology that uses ? in its control set to start parsing. I'm looking for it. If the OP found these requirements, then that technology would be the direct answer to the question
    – schroeder ♦
    Commented Feb 19, 2019 at 14:57
  • @schroeder That doesn't seem like a reason why a password policy should disallow a particular character. The password system should treat the password as simple data. Something like that might be an excuse why an engineer might add one more silly rule, but it is not a justifiable reason for such a password rule.
    – Conor Mancone
    Commented Feb 19, 2019 at 15:06
  • I'm not saying it is justified. I'm saying that it is the reason
    – schroeder ♦
    Commented Feb 19, 2019 at 15:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .