Home page logo

pen-test logo Penetration Testing mailing list archives

Re: Whitespace in passwords
From: "Bruce K. Marshall" <bkmlstsgohere () comcast net>
Date: Sun, 11 Sep 2005 14:21:37 -0500


You're right that a space character shouldn't make a difference if they are using any respectable hashing algorithm. But since we're talking about real applications, you can't assume they will use a well-known hashing algorithm, or even perform hashing at all. People make unfortunate decisions all the time when it comes to password systems. Remember the Unix 8 character password limitation? Remember Windows LM hashing?

The ISACA (www.isaca.org) Web site wants you to use letters and numbers in your account password. What about letters and symbols? There are actually more symbols, so they should make a better pool to choose from than numbers. Nope, the application doesn't accept it; you must have letters and numbers. And this is a computer security organization.

I can't say for sure what symbols people actually try, but spaces, underscores, and dashes aren't the most popular choices for users.

Bruce K. Marshall - bkmarshall () passwordresearch com
Password Research Institute - http://www.passwordresearch.com

----- Original Message ----- From: "Anurag Joshi" <mastermindanu () gmail com>
To: <pen-test () securityfocus com>
Sent: Thursday, September 08, 2005 9:46 PM
Subject: Re: Whitespace in passwords

With due respect i dont think whitespaces would make any difference. It just depends on the encrypting algo. In all cases whitespace amounts to a ASCII code and hence a binary representation, thus encrypting or decrypting would make no difference. If the algo has no no rule for whitespaces then it is not allowed. But when it comes to symbols whitespaces, underscores, dash are probably the first ones anyone will look for.

Anurag Joshi

Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]