<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Aug 15, 2017, at 8:05 AM, Peter Gutmann <<a href="mailto:pgut001@cs.auckland.ac.nz" class="">pgut001@cs.auckland.ac.nz</a>> wrote:</div><div class=""><br class=""></div></blockquote>...<br class=""><blockquote type="cite" class=""><div class=""><div class="">If you've ever had to do friends-and-family support for Windows, particularly<br class="">for older people, you'll have noticed that random spaces added to the start<br class="">and end of filenames aren't uncommon. It's most visible in that case because<br class="">it perturbs the natural sort order of filenames, but it's bound to be present<br class="">in other locations as well. In the specific case of passwords I've caught<br class="">several occurrences of "my password doesn't work any more" that involve a<br class="">spurious space at the start or end. <br class=""><br class="">So if the space-mangling also includes stripping spaces at the start and end,<br class="">it seems like sensible advice, because every time I've encountered those it's<br class="">been due to mistyping, and since they're invisible there's no way for non-<br class="">geeks to spot the problem.<br class=""><br class="">Peter.<br class=""></div></div></blockquote><br class=""></div><div>NIST deals with this problem via the following recommendation in 800-63B Section 5.1.1.2:</div><div><br class=""></div><div><i class="">In order to assist the claimant in successfully entering a memorized secret, the verifier SHOULD offer an option to display the secret — rather than a series of dots or asterisks — until it is entered. This allows the claimant to verify their entry if they are in a location where their screen is unlikely to be observed.</i></div><div class=""><br class=""></div>If the password is displayed in a monospace font, the extra spaces would be clear, except maybe at the end. A font that had a glyph for space, a faint blue dot perhaps, would be even better. <div class=""><br class=""><div class="">In addition, if extra erroneous spaces are a significant problem, there is nothing to prevent the password verifier from displaying a message when rejecting a password saying it contains spaces at the beginning and end, or multiple consecutive spaces in the middle. Some systems i have encountered warn you that the caps lock is on. (They may have a way to detect this directly in JavaScript, but detecting that all alphabetic characters in the bad password are uppercase would work too.) </div></div><div class=""><br class=""></div><div class="">I would much rather have a clear principle that passwords should be evaluated as entered without any changes. If there is a perceived need to protect the user from common typing errors, issuing a warning when possible errors are detected is a better solution. Any kind of password mangling, especially if its silent, weakens security for a few users and simplifies the task for attackers by reducing the number of combinations they have to try. By contrast, warnings have no security impact, as any attacker can be presumed to know what characters they entered. </div><div class=""><br class=""></div><div class="">As a separate matter, I think systems using passwords should be required to disclose the security measures they are using to protect those passwords. Otherwise users must always select passwords strong enough for the worst case.</div><div class=""><br class=""></div><div class="">Arnold Reinhold</div></body></html>