Re: spaces in passwords

[Michael D'Errico <[e-mail]>]

> What about spaces in passwords?  They don't work.  I'd like to see that fixed.

I guess it depends on how PASS is implemented by the server.  I just read every
character (except leading spaces) after PASS up to the CR LF and use that as
the password.  I agree that a better (or at least more precise) definition of
what is valid syntax for a password is needed.  (This is also true for a name
in the USER command.)

> A simple escape convention would do it:
>
> pass foo\ bar

This seems like a reasonable convention, but it would require modifying all
existing servers and clients, something that is just not practical.

Instead, if we require that there be exactly one space between the PASS and
the password, then there should be no problem even with passwords that have
leading space.

A robust server implementation when confronted with a PASS command such as

	PASS   foo bar

could try "  foo bar" first, then " foo bar", and finally "foo bar", looking
for a valid password match.  This approach weakens passwords that begin with
spaces though....


Michael D'Errico
[e-mail]