Passwords are handled differently in the MCB than in the default IdP code

[Paul Hethmon]

I’m not sure if I introduced the “feature” or not into the MCB, but I would certainly argue for stripping any trailing or leading white space from passwords. Internal spaces, sure. I’ve never had a problem because I didn’t support leading/trailing whitespace. I’ve had a lot of problems if I did support it.

I had a case one time where a user with a one time password hardware token could never successfully login. We would have the user read us the token password over the phone and it would work for us every single time. Finally went to their office and watched them. The lady would type her OTP and then hit the space bar before submitting the form.

Paul


> On Jul 16, 2015, at 3:29 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> No worries.  I wish we could upgrade to IdP3 this summer but it has to wait until at least the Spring semester. We can update our password portal to make sure that there are no whitespace characters at the end of the passphrases.
> 
> Yes, I just thought it deserved comment / consensus, it's kind of a big deal. OTOH I guess there's the standard argument about saving users from themselves and it will save as many users as it helps.
> 
> If people really thought it was the right thing to do, I'll overrule myself and make it an option, but it didn't seem like a good idea when I wrote that code. Of course, one can always do it in Javascript too.

-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com