31

The problem is that we send a user an email with a generated password if they forget.

If they choose to cut and paste it in, then Outlook typically adds a " " to the end of it.

When they paste it into the password textbox, it breaks for them.

Should I just make it invalid to put spaces in a password and trim all passwords?

Improve this question

3 Answers 3

Reset to default
48

Don't trim spaces, since some users do include spaces in their passwords.

Don't email a generated password. Instead send them a URL with an embedded one-time token, that takes them to a password reset screen.

If you really must send a password through email, note that Outlook only adds the space if there is a space after the word. For example, if you double-click the password below you'll get a space:

The password is here

But if you double-click the password below you won't get a space:

This is the password

So make sure the password is the last word on its line in the email, and the problem should go away.

Improve this answer
12
  • 27
    I don't think that any characters should be illegal for a password. It pretty much guarantees that you will introduce a usability issue if you do for someone. It also just encourages people to use "easy" passwords.
    – phinetune
    Commented Jun 9, 2011 at 3:06
  • 1
    @RoboShop spaces in passwords make them more secure as it will take a lot more time to crack them.
    – Lode
    Commented Jun 9, 2011 at 5:25
  • 9
    If you trim spaces (at beginning and end) when people sign up and when they sign in, nobody will notice.
    – Lode
    Commented Jun 9, 2011 at 5:26
  • 7
    @RoboShop: Suppose I have a a few different passwords, each for a certain security priority (e.g. One for banking, one for forums, etc.). If you reject any characters, you might reject one of my standard passwords, which irritates me and encourages me to pick something weak (that I still won't remember). I hate using sites/software that put arbitrary restrictions on passwords.
    – Steve S
    Commented Jun 9, 2011 at 14:27
  • 3
    @Bennett McElwee -- In my opinion, you MUST trim leading and trailing spaces, either at the client or at the server. Otherwise some users will be mighty pissed. Internal spaces are fine, of course, but there must be a printable graphic at either end.
    – Pete Wilson
    Commented Jun 9, 2011 at 16:45
7
  1. Try password they entered without trimming.
  2. If it fails, and it has spaces, silently try it with trimming.

This allows people to use spaces if they wish, but doesn't punish people for accidentally including them.

We used to have a password entry where spaces were not trimmed. We've found that even if you don't send password emails, you still get errors like this there because people write their passwords down in text files, and then cut & paste them. Should they do that? Probably not, but you can't change that.

Improve this answer
1
  • I almost agree with this. But then again it's up to the user to remember exactly what they typed. And seeing as password re-use runs rampant, it should not be a real issue for most people. But still, it's an interesting idea.
    – Tim Meers
    Commented Jun 10, 2011 at 21:02
5

Specifically to your question, you could define the requirement that passwords do not contain spaces at the beginning or the end, but still allow spaces in the middle. This would enable you to trim the supplied password (left trim, right trim), but still enable users to submit pass-phrases.

On a more general note, if it is within your ability to change, you might consider not sending passwords in an email. Other recovery techniques including security questions, password hints (defined by the user of course), or reset links would allow the user to recover/reset their password without actually sending them the password itself. This would eliminate the need for the user to copy-paste the password, and it might benefit the overall security of your system.

Improve this answer
1
  • I have the reset password as a link in the email as well. This is just kind of in case they want to know the temp password, which a case could be made that there is no need for that...
    – RoboShop
    Commented Jun 9, 2011 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.