Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

The problem is that we send a user an email with a generated password if they forget.

If they choose to cut and paste it in, then Outlook typically adds a " " to the end of it.

When they paste it into the password textbox, it breaks for them.

Should I just make it invalid to put spaces in a password and trim all passwords?

share|improve this question
add comment

4 Answers

up vote 36 down vote accepted

Don't trim spaces, since some users do include spaces in their passwords.

Don't email a generated password. Instead send them a URL with an embedded one-time token, that takes them to a password reset screen.

If you really must send a password through email, note that Outlook only adds the space if there is a space after the word. For example, if you double-click the password below you'll get a space:

The password is here

But if you double-click the password below you won't get a space:

This is the password

So make sure the password is the last word on its line in the email, and the problem should go away.

share|improve this answer
23  
I don't think that any characters should be illegal for a password. It pretty much guarantees that you will introduce a usability issue if you do for someone. It also just encourages people to use "easy" passwords. –  phinetune Jun 9 '11 at 3:06
1  
@RoboShop spaces in passwords make them more secure as it will take a lot more time to crack them. –  Lode Jun 9 '11 at 5:25
7  
If you trim spaces (at beginning and end) when people sign up and when they sign in, nobody will notice. –  Lode Jun 9 '11 at 5:26
7  
@RoboShop: Suppose I have a a few different passwords, each for a certain security priority (e.g. One for banking, one for forums, etc.). If you reject any characters, you might reject one of my standard passwords, which irritates me and encourages me to pick something weak (that I still won't remember). I hate using sites/software that put arbitrary restrictions on passwords. –  Steve S Jun 9 '11 at 14:27
2  
@Bennett McElwee -- In my opinion, you MUST trim leading and trailing spaces, either at the client or at the server. Otherwise some users will be mighty pissed. Internal spaces are fine, of course, but there must be a printable graphic at either end. –  Pete Wilson Jun 9 '11 at 16:45
show 7 more comments

Specifically to your question, you could define the requirement that passwords do not contain spaces at the beginning or the end, but still allow spaces in the middle. This would enable you to trim the supplied password (left trim, right trim), but still enable users to submit pass-phrases.

On a more general note, if it is within your ability to change, you might consider not sending passwords in an email. Other recovery techniques including security questions, password hints (defined by the user of course), or reset links would allow the user to recover/reset their password without actually sending them the password itself. This would eliminate the need for the user to copy-paste the password, and it might benefit the overall security of your system.

share|improve this answer
    
I have the reset password as a link in the email as well. This is just kind of in case they want to know the temp password, which a case could be made that there is no need for that... –  RoboShop Jun 9 '11 at 3:09
add comment

I personally have never thought of or heard of people using spaces in passwords. If I were implementing passwords, I would require that passwords contain no white space, which is often the case with alphanumeric only passwords.

This would remove the conundrum entirely. If the user pastes in a piece of text with spaces on the end, it may be user friendly to simply do a TrimEnd() on the password text before performing the check.

share|improve this answer
1  
"I would require that passwords contain no white space" - Why? –  gef05 Jun 9 '11 at 13:08
1  
You've never heard of people using passphrases instead of passwords? Much more secure. –  Charles Boyung Jun 10 '11 at 12:27
    
I agree with Charles Boyung -- Diceware passphrases, as alluded to in the stackexchange discussion of XKCD #936, is something that everyone developing software that deals with passwords should know about. –  David Cary Jan 2 at 1:31
add comment
  1. Try password they entered without trimming.
  2. If it fails, and it has spaces, silently try it with trimming.

This allows people to use spaces if they wish, but doesn't punish people for accidentally including them.

We used to have a password entry where spaces were not trimmed. We've found that even if you don't send password emails, you still get errors like this there because people write their passwords down in text files, and then cut & paste them. Should they do that? Probably not, but you can't change that.

share|improve this answer
    
I almost agree with this. But then again it's up to the user to remember exactly what they typed. And seeing as password re-use runs rampant, it should not be a real issue for most people. But still, it's an interesting idea. –  Tim Meers Jun 10 '11 at 21:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.