search

cloud-gov / cg-site

The cloud.gov website
https://cloud.gov
Other
59 stars 121 forks source link

Avoid easily-confused characters in generated user-facing credentials #1184

Closed pharten closed 5 years ago

pharten commented 6 years ago

When you send passwords for logins, do not use lowercase l,1, or uppercase O,0 at all.

pburkholder commented 6 years ago

Hi Paul,

Sorry to hear that this caused issues for you. Which password set/reset process caused you a problem? We have several.

Thanks,

Peter

pharten commented 6 years ago

Peter,

From the quickstart page (https://cloud.gov/quickstart/), I was running “cf login -a https://api.fr.cloud.gov -sso” and was prompted for a password. I went to https://login.fr.cloud.gov/passcode and was prompted to put in my smart card and enter my ID. When I did this, I was given a password that contained a straight line between two capital letters. My first interpretation was that it was a lowercase L “l”. That was not excepted. My second interpretation was an uppercase i “I”. That did work.

In some cases, a cut-and-paste of passwords is allowed, and in other cases, it is not.

Thanks,

Paul

Paul Harten, PhD Computational Environmental Scientist Emerging Chemistry and Engineering Branch Land and Materials Management Division National Risk Management Research Laboratory US EPA Office of Research and Development 26 West Martin Luther King Drive, MS 443 Cincinnati, Ohio 45268 513-569-7045

http://www2.epa.gov/chemical-research/program-assisting-replacement-industrial-solvents-paris-iii

From: Peter Burkholder (@pburkholder) [mailto:notifications@github.com] Sent: Wednesday, January 10, 2018 11:13 AM To: 18F/cg-site cg-site@noreply.github.com Cc: Harten, Paul Harten.Paul@epa.gov; Author author@noreply.github.com Subject: Re: [18F/cg-site] password problems (#1184)

Hi Paul,

Sorry to hear that this caused issues for you. Which password set/reset process caused you a problem? We have several.

Thanks,

Peter

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://github.com/18F/cg-site/issues/1184#issuecomment-356651074, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AADFXQk1kpzzx4KbWvdaXxtxviorCDfJks5tJOGfgaJpZM4RZii6.

pburkholder commented 6 years ago

Paul,

Thanks for the detailed description. We have assumed (incorrectly) that copy/paste would work for our users. Let me look into a fix for this.

Cheers, Peter