Can I modify the Password Generator's default so that it skips the special characters?

Question

Lucas1948 Author

Level 1

104 points

Can I modify the Password Generator's default so that it skips the special characters?

I really do appreciate Safari's password generator, but some web sites don't like the passwords that it creates. For example, a banking site today told me it's time to change my password. The password generator popped up and did its thing, but the web site didn't accept it. The generated password "doesn't meet our standards."

Well, this web site told me that new passwords must have "at least one letter and one number." The generated password certainly met those rules. What the site failed to mention is that they DO NOT ALLOW so-called special characters. The minus sign (or hyphen ... whatever) is a special character, and the hyphen seems to be a standard part of every newly-generated password. It took me several tries and a lot of frustration before I finally hit on the problem.

My question: Can I modify the password generator's default so that it skips the special characters? Or is this behavior baked into the generator's DNA?

[Re-Titled by Moderator]

MacBook Pro 13″, macOS 12.4

Posted on Jul 19, 2022 1:11 PM

Reply

Answer 1

Top-ranking reply

Chattanoogan

Level 7

25,652 points

Jul 19, 2022 2:36 PM in response to Lucas1948

"... By default, passwords generated by iOS and iPadOS are 20 characters long. They contain one digit, one uppercase character, two hyphens, and 16 lowercase characters. These generated passwords are strong, containing 71 bits of entropy ... "

" ... To help ensure that generated passwords are compatible with the relevant services, apps and websites can provide rules. Developers provide these rules using UITextInputPasswordRules or the passwordrules attribute on their input elements. Devices then generate the strongest password they can that fulfills these rules ... "

Source: Automatic strong passwords - Apple Support

Reply

Answer 2

Jul 19, 2022 1:19 PM in response to Lucas1948

That’s a very valid question …

It’s my understanding that a website developer can actually specify the password requirements to the “generator” via the API …

… although I suspect many developers just accept the default behavior and let their users sort it out.

As to what’s default … more sleuthing is needed.

Reply

Answer 3

Jul 19, 2022 2:30 PM in response to Lucas1948

US NIST Special Publication 800-63B states the bank is not following best security practices, if you’d like to use a different tactic.

https://pages.nist.gov/800-63-3/sp800-63b.html

Reply

Answer 4

Jul 19, 2022 3:06 PM in response to Chattanoogan

Chattanoogan wrote:

GREAT reference !!!

Thanks for providing.

De nada.

Server-side, I use the 10,000 most common passwords list to check for weak or compromised password issues at submission. This is data available from existing server and password breaches.

Also available are password breach notification services such as the one Apple runs for itself (iPhone/iPad: Settings > Passwords > Security Recommendations, also available on macOS) or available at services including haveibeenpwned.com. This check is very helpful around cases of password re-use, particularly after one of the uses has itself been breached, as the username (usually an email) and password pair are now widely known, and will soon be tested at logins all over the ‘net.

But… Password composition rules… not so much.

Reply

Answer 5

Jul 19, 2022 2:40 PM in response to MrHoffman

GREAT reference !!!

Thanks for providing.

Reply

Answer 6

Lucas1948 Author

Level 1

104 points

Jul 19, 2022 7:30 PM in response to Lucas1948

This thread got a lot more interesting than I ever expected! Thank you all for extensive and useful references.

Reply

Can I modify the Password Generator's default so that it skips the special characters?

Similar questions