Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Sylvia Else Newsgroups: comp.misc Subject: Re: Ebay hacked Date: Mon, 26 May 2014 17:07:05 +1000 Lines: 32 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net KDrdizzJForhL2acjtHVFgapOwDsUGYjU3DXbxGMLEFE8jpWOe Cancel-Lock: sha1:HIGJuRMhxgKvKl4o9m+1M2baTJk= User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 In-Reply-To: Xref: csiph.com comp.misc:3197 On 26/05/2014 4:57 PM, Lewis wrote: > In message > Sylvia Else wrote: >> On 25/05/2014 2:53 AM, Rich wrote: > >>> >>> "Spaces and certain symbols (< >[ ]//) are not allowed in password." >>> >>> A properly designed password storage (using a hashing function such as >>> bcrypt or scrypt) does not care what symbols are in the password. >>> >>> Caring about specific symbols in the password implies they are not >>> following proper password storage models. >>> > >> I wonder where the restriction is enforced - both on the client and at >> the server, or just in the client? How many here would be surprised if >> it were the latter? > > Are you suggesting that web browsers don't allow certain characters in > text input fields? I've never encountered that in any browser. > No. But Javascript can be used to impose such a restriction, though it obviously doesn't prevent the user from modifying the script so as to send a supposedly prohibited character to the server. I'd like to think that no developer would be so naive as to rely on client side validation, but if I did think so, the evidence would show me to be wrong. Sylvia