Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I logged in to a website today and found this message:

As a part of new security systems upgrades, we are requiring all existing customers to change their password to enhance the protection of their private information.
We recommend using a password which is easy for you to remember but difficult for others to guess. Please note the new password should be between 8 ~ 16 characters and special characters, "'", """, ";", "|", "?", "<", ">", "^", "*", ":", "=", and "#" are prohibited. Thanks for your understanding and cooperation.

16 characters is probably long enough, but I don't see a good reason for the length restriction.

More interesting to me is the disallowing of certain special characters. There are still plenty of special characters available with this scheme, though I've heard of other sites that only allow alphanumeric characters. Why should the content of my password matter to the hashing algorithm? It's just a hash, or a base-64 encoding of that hash, right?

  1. Does this policy place the security of my account at risk?
  2. Is there a specific password handler can't deal with the character set ',";|?<>^*:=#?
  3. Should I be concerned about the security policies elsewhere on the site?
share|improve this question

closed as too localized by Shane Madden, Jim B, Iain, Scott Pack, RobM Apr 9 '11 at 18:05

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

I hate sites like that. Almost all of my passwords have one of those characters, if not multiples. – Reid Apr 9 '11 at 17:48
@Reid - Mine, too. That's why I'm here! What do you do about it? – Kevin Vermeer Apr 9 '11 at 18:06
@Closers - De-localized it somewhat. – Kevin Vermeer Apr 9 '11 at 20:04
Update: (Quote) Thank you for your email and the opportunity to respond to your concerns. Customer passwords are encrypted in our database. The reason that we limit the special characters is because we have a Web Application Firewall that may falsely interpret them as a SQL injection attempt that would cause an error to occur when submitted. By restricting these characters we minimize the likelihood of this occurring. (/Quote) – Kevin Vermeer Apr 11 '11 at 20:02
"Why would some..." instead of "Why do some..." would probably make for a less localized question. And might I add, I think it's a pretty good question! – Belmin Fernandez Apr 12 '11 at 16:17

Almost certainly to stop people embedding code inside regular fields (a la SQL injection).

share|improve this answer
It's a shit way to do it though. – Tom O'Connor Apr 9 '11 at 17:50
Does this mean that they're not properly sanitizing and filtering their inputs (implying that they've got poor security practices, and I should start shopping elsewhere), or is this just another layer of protection? – Kevin Vermeer Apr 9 '11 at 17:53
Ghetto-sanitisation I'm guessing. – Chopper3 Apr 9 '11 at 19:46
Almost certainly ghetto-sanitization; honestly sites like this should be deeply ashamed of their (in)security practices, but apparently their not. This stuff ain't that complicated, but it does take minimal effort, and some people simply aren't willing to put out. – Chris S Apr 10 '11 at 0:43

Because they did a crappy job of sql injection prevention. I can almost understand not allowing ' and " (your grade goes from F to C) everything else is simply sloppy

share|improve this answer

Should I be concerned about the security policies elsewhere on the site?

Yes, you should.

Because if they are able to know what characters are in your password, that means it's stored in plaintext in the database. And this is BAAAD.

share|improve this answer
I would hope they have some client side validation that weeds out invalid characters and then assuming it passes the test it is then hashed in their database. Obviously I could be wrong, but thats what I would expect. – Sam Apr 9 '11 at 20:07
When setting the password it has to be sent in plain text so it can be stored without nonce (or other) encodings that make it session unique. – Chris S Apr 10 '11 at 0:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.