Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is space a valid component of a password or not? I am trying to save recent 10 passwords in one string in database and need to find a good delimiter for them. I think space maybe a good candidate. What do you think?

share|improve this question

migrated from serverfault.com Mar 26 '11 at 0:05

This question came from our site for professional system and network administrators.

closed as not constructive by Simon Sheehan, 8088, Nifle, Sathya Nov 4 '11 at 7:47

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
As @Bart said - HASH the password. Read this to help explain why: security.blogoverflow.com/2011/11/… –  Rory Alsop Nov 2 '11 at 10:08
add comment

3 Answers

It depends on your password policy. I know quite some sites/systems where the space is a valid character for a password. To be on the safe side you could check for spaces within the password and escape those.

Oh, and as a short update: Try to repair the database design. As you have a 1:n relationship, you should save each password separately and connect every entry to the according user.

share|improve this answer
add comment

Spaces are normally valid. I'd be wary of any delimiter, as it's a form of security through obscurity that someone won't crack it or accidentally stumble on it in the future and you'll have to figure out the bug.

I'd use a separate entry for each one.

You don't mention what application this is...if you're making the application, you could try doing something to enforce your own policy that would scrub out and sanitize the entry, or you would more sensibly hash the password (you generally don't want actual passwords saved) and the hash wouldn't have the password in it. Then I suppose you could use whatever delimiter you want as long as it isn't part of the hash namespace of characters.

share|improve this answer
2  
+1 for hashing the password –  Bryan Feb 22 '10 at 13:51
2  
+2 for hashing. Hashing w/ hex encoding has the advantage that your only going to get 0123456789ABCDEF, and you can use anything that's not those to delimit the password. (And has the added security advantage that it's more difficult to recover a password from your stolen database) –  Jason Feb 22 '10 at 14:26
    
The hash idea is good IF the password doesn't have to be stored in plaintext. Although I also guess that it is meant as a "recent passwords" history, "student" didn't mention the actual purpose of storing the passwords. –  DaDaDom Feb 22 '10 at 14:33
    
@DaDaDom: Even if recent history of passwords, you just take their inputted password, hash it, compare to what's in the history of hashes...if the hashes match, it's been recently used. Story plaintext passwords is normally a bad idea. –  Bart Silverstrim Feb 22 '10 at 15:10
3  
DON'T STORE UNENCRYPTED PASSWORDS IN YOUR DATABASE. –  Ken Liu Feb 22 '10 at 15:40
show 3 more comments

You can't rely on space, as it is a valid password character on most systems, especially now that pass-phrases are the new passwords.

Depending upon what/how you are doing this, you might be able to use a char with ASCII 0x00, another character not normally found on a keyboard or what about unicode?

Personally, I wouldn't attempt to concatenate them into a single string, I'd probably store a entry for each password.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.