# Unique characters in password - good or bad? **URL:** \ **Category:** Community Building\ **Created:** [2017年十二月4日 03:23 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305 "2017-12-04T03:23:41Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![schungx](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/schungx/32/70989_2.png) [@schungx](https://meta.discourse.org/u/schungx)\ **Post date:** [2017年十二月4日 03:23 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/1 "2017-12-04T03:23:41Z")
When using Discourse as a private repository of sensitive/confidential information, we care about password security. My question is: is enforcing unique characters in passwords a good practice or bad? The Internet seems to have a consensus that: - Longer passwords are better, although technically speaking it _reduces_ the search space. However, the trade-off seems to be accepted by most due to the fact that - Passwords combining different character groups are better, although, again, technically speaking it _reduces_ the search space. But again, humans are lazy and won’t use wierd/uppercase if they don’t have to. - A min number (usually at least 5 recommended) of unique characters are better. This is less certain. My question concerns this. I am thinking that forcing unique characters may actually _decrease_ security because: 1. Not many people will use strings of the same characters in passwords… for example, they’ll tend to type `12345` or `qwert` instead of `00000`. 2. Limiting the ability to repeat characters _SIGNIFICANTLY_ reduces the search space. Forgot where I read it, but I read it somewhere that it reduces the search space by more than half. Any thoughts by security experts on this? ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年十二月4日 03:32 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/2 "2017-12-04T03:32:44Z")
Read the blog entry I wrote about this it covers everything you are asking in excruciating detail. ---
**Author:** ![schungx](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/schungx/32/70989_2.png) [@schungx](https://meta.discourse.org/u/schungx)\ **Post date:** [2017年十二月4日 03:46 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/3 "2017-12-04T03:46:11Z")
A link will help here… 😅 ---
**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\ **Post date:** [2017年十二月4日 04:04 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/4 "2017-12-04T04:04:35Z")
[Your Password is Too Damn Short](https://blog.codinghorror.com/your-password-is-too-damn-short/) and [Password Rules Are Bullshit](https://blog.codinghorror.com/password-rules-are-bullshit/) ---
**Author:** ![mcwumbly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mcwumbly/32/103861_2.png) [@mcwumbly](https://meta.discourse.org/u/mcwumbly)\ **Post date:** [2017年十二月4日 04:17 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/5 "2017-12-04T04:17:48Z")
Here’s another good one: > **[Passwords Evolved: Authentication Guidance for the Modern Era](https://www.troyhunt.com/passwords-evolved-authentication-guidance-for-the-modern-era/)** > > In the beginning, things were simple: you had two strings (a username and a > password) and if someone knew both of them, they could log in. Easy. > > But the ecosystem in which they were used was simple too, for example in MIT's > Time-Sharing Computer... ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年十二月4日 05:15 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/6 "2017-12-04T05:15:50Z")
Yes thank you, and the final part of that 3-part series: [Hacker, Hack Thyself](https://blog.codinghorror.com/hacker-hack-thyself/) ---
**Author:** ![schungx](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/schungx/32/70989_2.png) [@schungx](https://meta.discourse.org/u/schungx)\ **Post date:** [2017年十二月4日 05:44 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/7 "2017-12-04T05:44:32Z")
In general, not much advise on how _much_ entropy is good for a password. It is understood that _no_ entropy (i.e. all same letters) is _bad_ (for ASCII). What about entropy of _one_? Meaning at least _two_ different characters? I’ll argue that no entropy for ASCII letters is bad, but no entropy for Unicode characters? Emoji? That cannot be too bad, right? ---
**Author:** ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)\ **Post date:** [2017年十二月4日 06:18 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/8 "2017-12-04T06:18:35Z")
Entropy is just an expression of how many guesses it’ll take to brute-force a password. How much you need is dependent on the threat model (online vs offline attack, rate limiting and hashes, and a bunch of other things). Without knowing your threat model, it’s impossible to give a recommendation as to how much entropy is “good enough”. Also, password entropy is, at best, a fairly hand-wavey measurement. It’s not a mathematical science. In many ways, there’s only two types of passwords: those that are in the attacker’s list of passwords to try, and secure passwords. All possible short strings will be in there, and a whole pile of “known” longer passwords. Everything else is OK to use. ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2017年十二月4日 06:45 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/9 "2017-12-04T06:45:48Z")
> [@mpalmer](#): > > password entropy is, at best, a fairly hand-wavey measurement. Totally, this password has tons of entropy. abcdefghaijklmnopqrstuv ---
**Author:** ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)\ **Post date:** [2017年十二月4日 06:54 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/10 "2017-12-04T06:54:50Z")
I imagine it would not be that difficult to use recursive levenstein distance from knowns. A constant battle that my tinfoil hat self might think is intentional so everyone will be not only willing but anxious to give their personal visible and audible data over. 🤔 In more ways than one, password security reminds me of captchas. ie. the best that can be hoped for is a best guess compromise that’s flexible enough to adapt as needed. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年十二月4日 06:56 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/11 "2017-12-04T06:56:07Z")
You do know Discourse checks all new user passwords against the 10 million most common repeated passwords, yes? And prevents them from being used? That covers pretty much all the cases you are describing. The only hole in that strategy was covered in one of the blog posts I linked: native languages differ. ---
**Author:** ![schungx](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/schungx/32/70989_2.png) [@schungx](https://meta.discourse.org/u/schungx)\ **Post date:** [2017年十二月4日 07:19 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/12 "2017-12-04T07:19:33Z")
> [@codinghorror](#): > > against the 10 million most common repeated passwords, It says 10,000 most common passwords in the settings. Does this mean it is 10 million _repeated_ passwords extra? ---
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [2017年十二月4日 07:23 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/13 "2017-12-04T07:23:21Z")
I think it was 10 thousand, we would need a different strategy for a 10 million password block. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年十二月4日 07:30 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/14 "2017-12-04T07:30:47Z")
It is many many millions, all the common password lists merged together. The reason the list isn’t very big is because of this graph.. which was in the above blog posts. ![image](https://global.discourse-cdn.com/meta/original/3X/d/4/d4c68b4130c70ce66c976f94f7deb6a9987fc1d2.png) I will leave understanding that, as an exercise for the reader.. Really, read those blog posts closely @schungx. You’re making me repeat myself over and over here for no good reason. All the info you need is there. ---
**Author:** ![schungx](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/schungx/32/70989_2.png) [@schungx](https://meta.discourse.org/u/schungx)\ **Post date:** [2017年十二月4日 07:44 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/15 "2017-12-04T07:44:21Z")
> [@codinghorror](#): > > Really, read those blog posts closely @schungx. You’re making me repeat myself over and over here for no good reason. All the info you need is there. Well, that probably means that you have not been very clear about what you claim as 10 million. What you really mean is: - Discourse checks against the 10,000 (as per setting) most common passwords that are \>= 10 characters in length (default setting in Discourse) - The 9,990,000 passwords \< 10 characters long are not checked because it is assumed that the minimum password length is 10. - It is caveat emptor if I set minimum password length \< 10! ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2017年十二月4日 07:45 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/16 "2017-12-04T07:45:35Z")
Sort of, you need to read the blog posts closely. Study them like a textbook. There are years of work behind those posts. ---
**Author:** ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)\ **Post date:** [2017年十二月4日 11:40 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/17 "2017-12-04T11:40:31Z")
@codinghorror Those 3 (actual lifesaving articles) Made me change passwords almost everywhere including Bank, Social and Email Accounts with Immediate effect! … Thanks a Ton for saving the day. ---
**Author:** ![terraboss](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/terraboss/32/381157_2.png) [@terraboss](https://meta.discourse.org/u/terraboss)\ **Post date:** [2017年十二月4日 11:54 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/18 "2017-12-04T11:54:58Z")
I hope, someday it will be possible to get rid off all of these ugly passwords. Maybe due offering client auth certificates and giving the users a privioing profile for mobile devices, if needed. ---
**Author:** ![Johani](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/johani/32/176920_2.png) [@Johani](https://meta.discourse.org/u/Johani)\ **Post date:** [2017年十二月4日 12:00 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/19 "2017-12-04T12:00:27Z")
Not entirely related but… I use [Google Authenticator](https://support.google.com/accounts/answer/1066447?co=GENIE.Platform%3DAndroid&hl=en) and it does exactly that. When you login you need to enter a 4 digit pin generated by the Google Authenticator app on your phone (code expires every 60 seconds) It’s sort of like one of those bank devices they give you to log in to internet banking. Still a very limited idea in theory but a great idea nonetheless. ---
**Author:** ![terraboss](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/terraboss/32/381157_2.png) [@terraboss](https://meta.discourse.org/u/terraboss)\ **Post date:** [2017年十二月4日 12:09 UTC](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305/20 "2017-12-04T12:09:54Z")
> [@lll](#): > > I use Google Authenticator and it does exactly that. Overall a good compromise with one exception: I don’t like to trust third-parties - especially Google, Facebook, etc - in property security solutions. I don’t like to install extra (black boxed) apps for very limited use cases. [下一頁](https://meta.discourse.org/t/unique-characters-in-password-good-or-bad/75305.md?page=2)