For about the 4,000th time in the last five years, I tried to
sign up for a new Web service, but it wouldn't accept my
proposed password. Apparently, the site operators decided that
passwords should contain only letters and numbers. Aarrrrgh!
This isn't the first time I've seen this idiocy, and it won't be
the last. But it should be. Guidelines on how to construct a
strong password almost uniformly recommend using a mixture of
upper and lower case letters, numbers, and symbols. Tools for
generating passwords (for example, strongpasswordgenerator.com)
encourage the use of symbols. There's even a mathematical
formula that precisely calibrates how much more unguessable
symbols make a password. So why don't sites support symbols in
passwords? It makes no sense. The strongest case against
limited-character passwords isn't technical. It's not about
"information entropy." It's about human factors and behaviors.
Human factors dominate the success (or failure) of all
information systems, including password systems. Hu