List of characters for "avoid ambiguous characters"

snairolf · August 15, 2020, 3:45pm

Is there a list of characters that is not used when the avoid ambiguous characters option is enabled?

RobertT · August 15, 2020, 3:57pm

a-z Ambiguous: l
A-Z Ambiguous: IO
0-9 Ambiguous: 01

Source: jslib/src/services/passwordGeneration.service.ts

memeNPC · November 16, 2020, 2:57pm

Hey,

Sorry I’m a bit late to the party. I was wondering in which case anyone would actually use “avoid ambiguous characters”, I mean the passwords generated by Bitwarden are not meant to be remembered anyway nor to be typed by hand (most of the time you copy/paste the password).

Could somebody explain?

Thanks

mathieuk · January 16, 2021, 4:28am

I’ve found there are some instances where passwords cannot be pasted. The two that come to mind are (1) systems I don’t own, and (2) limited-functionality environments (such as the Windows installer, or text-only systems like Linux’s tty1, tty2, …, tty6).

I can also imagine a use for non-Internet-connected systems, and for passwords someone might need to write down, such as a wifi password or an e-transfer password.

(I’m not a Bitwarden user, so if any of this doesn’t apply, I apologize.)

smd · July 4, 2021, 9:20pm

Perhaps this description applies…

github.com/SpiderOak/Encryptr

Avoid ambiguous characters in generated passwords

opened 01:13PM - 20 Dec 16 UTC

knutzk

I found a couple of issues related to the randomString password generator of the… app, but haven't found this one. Unfortunately, the font that is used for the app makes some of the characters indistinguishable, e.g. capital i and lowercase l. This is not a problem for strings such as names or labels, but it can be quite confusing for passwords. If users set passwords themselves, they can simply avoid those characters, but it would be nice if the generated passwords did not contain any ambiguous characters or characters that are hard to distinguish. A non-exhaustive list: - capital i, lowercase l, (the number 1), vertical bar | - capital o, the number 0 As far as I can see, this would only be a little change in the list of used characters in Encryptr/src/app.js I'd be happy to hear your opinions about this!

It basically says avoid mixing ‘0’ zero with ‘O’ capital O, or I with i,l, ot L etc…

Do you get the picture? If so please upvote +1 my answer.

ali_naseri · July 10, 2022, 7:28am

nice explaination.

Xevion · September 29, 2024, 8:57pm

Sorry for the bump, but in case anyone else was looking into this and found the now-dead link from @RobertT above, I wanted to provide new links.

While he linked good source code, I think the Bitwarden SDK is easier to understand:

github.com

bitwarden/sdk/blob/42b536a1af65e3877e811c1420fa93055261ce32/crates/bitwarden-generators/src/password.rs#L71-L73


      
          const UPPER_CHARS_AMBIGUOUS: &[char] = &['I', 'O'];
          const LOWER_CHARS_AMBIGUOUS: &[char] = &['l'];
          const NUMBER_CHARS_AMBIGUOUS: &[char] = &['0', '1'];

Also, it’s Rust, which is infinitely superior! /s

RobertT’s link intended to show this: jslib/src/services/passwordGeneration.service.ts at 7d49902eea45275d50c949beec32b3ab5b7db725 · bitwarden/jslib · GitHub

These links shouldn’t die, as they are linked to a specific moment in the repository history.

Nail1684 · September 29, 2024, 9:17pm

As these are “official” lists… I personally also find ambiguos (at least according to my personal handwriting…)

the letter ‘C’ and the opening round bracket ‘(’
the small letter ‘j’ and the special character ‘;’