Why You May Want to Avoid Non-ASCII Characters in Your Passwords

Over at our newly minted Gawker Tech blog, Gawker Media CTO Tom Plunkett explains how passwords using non-ASCII characters (like © or Д) cause security problems. Essentially, on our backend (and potentially at some other sites across the internet), non-ASCII characters are interchangeable. An eagle-eyed reader noted that:

…after creating an account with the password ‘ДДДДДДДД’, I was able to successfully log in by typing ‘簡簡簡簡簡簡簡簡,’ as well as ‘ႤႤႤႤႤႤႤႤ’, ‘©©©©©©©©’. It turns out that any string of exactly 8 characters whose unicode code point is >= 128 will be accepted.

So what does that mean for you?

It does not affect most of our users – If you are not using non-Latin characters for your password, there is nothing to do (see wikipedia for more information on the characters that are not affected – US-ASCII). If you do use characters that are non-Latin, you should reset your password to ensure it is updated to fully support these special characters.

Tom also notes that, to help address the problem, “when a person logs in with a non-ascii char in password, we prompt them to reset.” Read up for more details over at Gawker Tech.
Send an email to Adam Pash, the author of this post, at http://lifehacker.com/5721610/why-you-should-avoid-non+ascii-characters-in-your-passwords?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+lifehacker%2Ffull+%28Lifehacker%29/mailto:tips+adam@lifehacker.com?subject=http://lifehacker.com/5721610/why-you-should-avoid-non+ascii-characters-in-your-passwords.

More Here

Courtesy:http://prasannah.wordpress.com/2011/01/04/why-you-may-want-to-avoid-non-ascii-characters-in-your-passwords/