Hey,
I am considering using the following rules for a casual website.
that's all. My question is, beside white space, is there other symbol that I should consider as "illegal"? Please keep in mind that it is a casual website so I don't need any password policy that is very restricted.
Thanks,
You should let your users have whatever password they like. Maybe enforce a minimum length, but nothing else. You're sanitizing this before it hits your database anyway, right?
Why would you want illegal characters? As long as it doesn't break any parts of your system (which it shouldn't), there's no real reason to reject it.
I would go from the other way around: don't reject invalid characters (you might forget to reject some) - instead check that every character is an allowed character.
Hopefully you are not storing passwords in your database. You should be storing the hash of the password only.
So, if you are creating a hash out of the password, why have any illegal characters?
You may want to enforce a minimum password length, just for their own protection.
Even if you do restrict characters, why would you consider white space an illegal character? Many users create "pass phrases" to secure their passwords.
Why do you want to limit passwords to 20 characters? A minimum encourages users to select harder to guess phrases, but why limit it?
Same goes for limiting the characters which can be used. Why restrict it at all?
Despite your website being casual, it is bad practice to store passwords in plaintext form. At the very least, concatenate some salt (such as the username plus some constant string for your site), and store the SHA-1 hash of it. Since users tend to use the same passwords at multiple sites, this provides a nice measure of protection against cross site hacking should your site's passwords be hijacked.
How about getting out of the password business and using Open ID like SO uses?
Most sites either require 6+ characters, or have no minimum limit. While 6 is not very secure, it probably doesn't matter too much since it's a casual website. You should probably allow passwords as short as 6 characters, to make the users happier if they want shorter passwords.
I see no reason to disallow any particular characters. A lot of sites only allow alphanumeric characters, but I don't know why. Just make sure that the characters won't interfere with the website source code, and you should be fine.
Don't do that. 8 characters is way too long for a casual site, and users are fickle. Any requirement whatsoever that you place on password complexity will lose you users.
Unless you're a bank, you shouldn't be enforcing password complexity of any sort. If a user wants the letter 'a' as his password, let him go for it. When he finds that some malicious entity is shortening urls in his name (or whatever your site does), he can deal with it and possibly learn a good lesson.
The important thing to remember is that it's not your problem, and you can only piss people off by enforcing complexity.