13

Why won't Google allow me to use a password ending in a space anymore?

Please don't begin or end your password with a blank space

Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different websites and services, without using the same password twice. In the case of Google, my cipher requires that the last character be a space. Now I have to create an annoying exception to my cipher.

This never used to be a problem, so why is Google doing this now, and is there any way I can get around this?

4
  • 11
    I'm voting to close this question as off-topic because only Google can really speak to their intentions regarding changes to their authentication systems. Absent any announcements from them on the matter, or an authoritative Google representative being permitted to address the issue on a public third-party forum, this question cannot be answered here.
    – Iszi
    Commented May 14, 2015 at 14:19
  • 3
    @Iszi, agree that only Google can speak to intentions, but the there might still be a valid question here helping people understand what drives password limitations - just like the use of traditional DES password hashes imposed an 8-character limit on passwords. Just 2 cents.
    – gowenfawr
    Commented May 14, 2015 at 14:25
  • @gowenfawr A more general question on what drives password limitations may make sense, but that's equally closeable for being too broad or subjective.
    – Iszi
    Commented May 14, 2015 at 14:31
  • @Akiva feel free to reword the question to not mention Google specifically but to ask what criteria might make a password with leading/trailing spaces unsuitable. Commented May 14, 2015 at 14:39

4 Answers 4

18

They trim passwords to deal with the (sometimes insecure) process of people copying and pasting them.

Note:

As a clipboard is not considered a secure data store, nobody worries about keeping it secret. So applications that watch the clipboard feel free to store, for example, store it in publicly accessible data files. You just can't know who actually is watching the clipboard and what they're doing with it. Consider how careful applications like browsers are to keep your password secure. Clipboard apps just don't think like that. Using a secure keystore --> great. Having the clipboard contents logged to disk --> not so good.

4
  • 3
    Could you elaborate what's insecure about copying and pasting passwords (say from high entropy password generator)? The only attack I can think of is when attacker already monitors clipboard but then it has control over some program so (s)he could just attach debugger. Commented May 14, 2015 at 15:47
  • 1
    As a clipboard is not considered a secure data store, nobody worries about keeping it secret. So applications that watch the clipboard feel free to store, for example, store it in publicly accessible data files. You just can't know who actually is watching the clipboard and what they're doing with it. Consider how careful applications like browsers are to keep your password secure. Clipboard apps just don't think like that. Using a secure keystore --> great. Having the clipboard contents logged to disk --> not so good. Commented May 14, 2015 at 16:20
  • 1
    A note on copy-pasting: a significant source are password reset emails, where the password will presumably be immediately changed. Commented May 14, 2015 at 17:22
  • Good point @user3757614. I modified the text to make a less strong statement. Commented May 14, 2015 at 17:40
13

Drilling a bit deeper on the copy and paste issue:

Microsoft products, particularly the Office suite, are notorious for attempting to help by adding trailing white space to items copied from, say, Outlook and pasted elsewhere. The purpose of doing this is so that you don't have to be as careful where you place the cursor when copying and pasting to avoid running words together. This works fine within this tool set but fails miserably when pasting outside that tool set into a browser, because there's no way for the browser to know whether the white space is required or not.

Web sites then have to trim this white space in order to prevent floods of customer support calls asking "why this stupid form doesn't work". I know this because I work with an internal web site which does not do this (because the audience for the web site is restricted to a small team and it is not for general consumption) and practically every time I paste into the form I have to backspace off the trailing space that gets pasted in to get it to function.

Leaving aside the reasons why some folks (I am not among them) don't want you copying and pasting passwords (see http://www.troyhunt.com/2014/05/the-cobra-effect-that-is-disabling.html for an analysis of why prohibiting copy/paste is a really bad idea), if you are going to copy and paste passwords you need to be sure all the software involved is doing it correctly or you are going to be frustrated. Hence Google's attempt to head off trouble at the pass and disallowing leading and trailing spaces in passwords.

10

Because they trim whitespace. The why of that is not known, but is not unusual, and often is related to the inability for humans to discriminate - you and I know that

foo bar

has a space in the middle, but it's hard for us to say how many spaces are in

foobar  

if any of them are trailing.

Judging from productforums posts, this policy is not new.

5
  • I'm confused. How is spacing more difficult to deal with in 'foobar ' or ' foobar' than it is in 'foo bar'?
    – Iszi
    Commented May 14, 2015 at 14:28
  • @Iszi because in contexts where you don't have ' or " at either end, you can't tell the difference. For example, a password stored in KeePass where you can reveal the text, or if pasted into notepad (we've all done it) temporarily. Spaces and newlines are both whitespace to humans.
    – gowenfawr
    Commented May 14, 2015 at 14:34
  • Yes, but humans aren't (shouldn't be) storing and processing our passwords when we're setting up an account with Google's services.
    – Iszi
    Commented May 14, 2015 at 14:39
  • On Google's end of the wire, that's true. On our end of the wire, it isn't. It's the user that's potentially negatively impacted by the whitespace, not Google.
    – gowenfawr
    Commented May 14, 2015 at 15:07
  • KeePass and similar are still rare enough that I'm sure this isn't a concern Google has in mind. Even then, those tools also have features which will auto-fill a form for you - largely eliminating the worry that a human will ever need to {mis-)read the password.
    – Iszi
    Commented May 14, 2015 at 15:11
5

It's probably a usability issue.

It's very easy to unintentionally accidentally add a space to the beginning or end of a username or password, especially on certain types of devices: mobile with autocomplete, people typing via voice, people using assistive technologies that auto-insert spaces, copying and pasting passwords, etc.

The other day I was typing an email address on a new phone and due to autocomplete bugs in the email field, the half-written address autocompleted and inserted a space at the end (before the @ - autocompleted_email @gmail.com) so the email address was malformed and couldn't be sent and it was annoying to get rid of the space.

I imagine someone at google found that starting/trailing spaces were frequently automatically inserted into login/password fields on some subset of devices.

So someone at google decided to fix that by always trimming outside whitespace, as logins can't end with spaces. They figured since this happens on logins, it probably also happens on passwords, so the trim outside whitespace inside passwords.

Now for Akiva's issue, if your password was as#gre34jCaDgaio, you can just set it to be as#gre34jCaDgaio and always type in as#gre34jCaDgaio and the login should work just fine.

I also wouldn't be surprised if many other sites are doing this silently. E.g., I've encountered many secure applications from security vendors that say only check the first 8 letters of my password or major corporations silently removing special characters from your password. Google is being safe by telling you ahead of time that the starting/trailing whitespace will not be processed as part of your password.

3
  • Strictly, Google isn't telling the user "ahead of time" here - at least, the screenshot provided appears to be an error message presented after the password is entered. That said, it's still better than what many companies do. The most user-unfriendly I've seen are the ones that state what the password requirements are (if any) but don't state - and don't define in error messages - what the limitations are. You have to brute-force to guess why your password is being rejected for length or inclusion of certain characters.
    – Iszi
    Commented May 14, 2015 at 15:16
  • My point was from a security perspective, its safer to tell you after inputting a password in a form that will be modified prior to hashing, that "we don't allow passwords greater than 8 characters/with this special character/with unicode characters/with starting/trailing whitespace" while you are setting your password.
    – dr jimbob
    Commented May 14, 2015 at 16:16
  • Depends on how you define "safer". From the application's standpoint, they're disclosing information that may point to weaknesses in their implementation where instead they could try to just silently sanitize the input with zero user awareness. From a user standpoint, it's best to know all requirements & limitations up-front rather than after the fact. In any case, the best UX includes notification to the user at some point - and Google's covering at least that much.
    – Iszi
    Commented May 14, 2015 at 16:54

Not the answer you're looking for? Browse other questions tagged .