Re: Whitespace in passwords

["Bruce K. Marshall" <bkmlstsgohere () comcast net>]

Anurag,

You're right that a space character shouldn't make a difference if they are 
using any respectable hashing algorithm.  But since we're talking about real 
applications, you can't assume they will use a well-known hashing algorithm, 
or even perform hashing at all.  People make unfortunate decisions all the 
time when it comes to password systems.  Remember the Unix 8 character 
password limitation?  Remember Windows LM hashing?

The ISACA (www.isaca.org) Web site wants you to use letters and numbers in 
your account password.  What about letters and symbols?  There are actually 
more symbols, so they should make a better pool to choose from than numbers. 
Nope, the application doesn't accept it; you must have letters and numbers. 
And this is a computer security organization.

I can't say for sure what symbols people actually try, but spaces, 
underscores, and dashes aren't the most popular choices for users.

----
Bruce K. Marshall - bkmarshall () passwordresearch com
Password Research Institute - http://www.passwordresearch.com


----- Original Message ----- 
From: "Anurag Joshi" <mastermindanu () gmail com>
To: <pen-test () securityfocus com>
Sent: Thursday, September 08, 2005 9:46 PM
Subject: Re: Whitespace in passwords


> List,
>           With due respect i dont think whitespaces would make any 
> difference. It just depends on the encrypting algo. In all cases 
> whitespace amounts to a ASCII code and hence a binary representation, thus 
> encrypting or decrypting would make no difference. If the algo has no no 
> rule for whitespaces then it is not allowed. But when it comes to symbols 
> whitespaces, underscores, dash are probably the first ones anyone will 
> look for.
>
> Anurag Joshi 


------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------