Home

Lower Case "L"

I'm a new user to LastPass and I am still using the free version until I am satisfied with the features of the product. I was pleased to see the feature that identifies all the weak or repetitive passwords that I use and spent sometime yesterday updating my passwords using the automatic password generator. One of the passwords I updated was the password for my email.

Since then, I spent about 3 hours trying to figure out what was wrong with my email logon today as I could not get my email software to connect with my email. The message I kept getting was that I had a wrong ID or password... and yet I knew the password I was manually entering was correct. Well, I thought it was.

It turned out that the problem was that I thought a lower case "L" was the number "1." Since then I have looked carefully at the way these two characters are displayed by LastPass and the difference is so subtle as to be indistinguishable.

May I suggest that you eliminate the lower case "L" and the number "1" from the automatic password generator system? I'm not suggesting you eliminate the characters but rather that LastPass not automatically generate these two characters that are all but impossible to tell apart.

I realize that this suggestion may go into the waste basket, but I can assure you that I will never let LastPass generate a password containing either of these characters again.

Best wishes,
Bill

Find more posts tagged with

Comments

JONS1

"wlc568" wrote:

How would one conclude that "easy to read" eliminates ambiguous characters?

I agree with this point. In earlier versions of LP, this option used to be 'Avoid ambiguous characters', but then it was changed to make 'easy to read'. The only way I knew 'easy to read' meant 'avoid ambiguous' was because I was using LP before they made the change. For a new user, 'easy to read' is not at all indicative that it's to avoid ambiguous characters. I just installed the 4.31.0 update and I'm pleased to see that 'easy to read' has reverted to 'avoid ambiguous characters'.

When I first started using LP I wasn't yet aware of the 'avoid ambiguous characters' option, and a number of the early auto-generated passwords that I used for my accounts incorporated capital 'i', lowercase 'L', zero (0) and capital letter 'O', so it turned into a nightmare for me when I eventually needed to read out my passwords to family members to enable them to login to my accounts. One non-tech savvy sister in particular became very enraged by the trial-and-error approach with what were very long passwords of garbled code. When generating passwords, 'Avoid ambiguous characters' should be enabled for new users by default (maybe it is now, I don't now).

benbland

Got to agree with this thread. I had to walk around the office yesterday and supervise everyone entering our new WiFi password because of ambiguous characters (such as 'O' and 'l'). This is a long-solved problem in other places, simply by using an unambiguous font. I don't know any of these fonts' names but they include a zero with a diagonal line through it, a lower-case L with a little 'foot', etc. You don't need colours for this.

Right, I'm off to spend the rest of the day trying to get Jamiroquai's 'With a Little L' song out of my head...

steve110

"randyrock" wrote:
How about using a font that is easily read. I believe that this approach has been used by a few (billion) software creators on the net.

Or having an option to display passwords in any font of your choosing, and even to display it extra large?

Take a look: [url=https://www.iphoneincanada.ca/news/accessibility-features-in-1password-ios:qtjx6dyq]Accessibility Features in (a competing product)[/url:qtjx6dyq]

randyrock

How about using a font that is easily read. I believe that this approach has been used by a few (billion) software creators on the net.

steve110

"cbrillow" wrote:
Maybe it would be cool if LastPass automagically created the color scheme - that could be convenient!

That's exactly how 1Password handles it. You let it generate a password (or enter your own), and it automagically shows the characters in the appropriate color. (Sorry I didn't make that clear.)

(I wish this forum supported images; I'd upload a screenshot.)

There's no shame in copying a good feature from a competitor, so long as it's not protected intellectual property. If 1Password doesn't own that feature, LastPass should copy it! And if 1Password does own it, LastPass should figure out a non-infringing way of adding similar functionality.

cbrillow

In theory, but:
* The LastPass app doesn't let you pick a font, and
* Sometimes more than 2 characters look alike.

I agree with both of your above comments, and that your color scheme appears to be a suitable solution, although it's more trouble than I'd want to go to to create a password. Maybe it would be cool if LastPass automagically created the color scheme - that could be convenient!

I should explain that my comment wasn't so much Lastpass-specific, rather it was simple readability on the screen, where you do have a choice of fonts to use in a browser. (also a separate, perhaps unnecessary step) In fact, if you again note what I wrote, it wasn't even a password that contained my example -- it was a username. My comment was only a general reflection on how ambiguous characters can sometimes go unnoticed in one font, and painfully obvious in a different one. I made that mistake in this one instance, and have avoided a repeat occurrence, When I have to share that username, I caution the other person to copy/paste the username, rather than typing it to avoid confusion.

Cheers!

steve110

"cbrillow" wrote:
t this is somewhat dependent on the screen font in use to display the characters. Some fonts better distinguish between the two than others...

In theory, but:

* The LastPass app doesn't let you pick a font, and* Sometimes more than 2 characters look alike. Consider these four: The digit 1, the lower-case L, the upper-case i, and the vertical bar symbol: 1, l, I, |

I just tested every font on my system, and for almost every font, two or three of those characters are visually indistinguishable.

But use different colors, and they are easily identifiable: 1, l, I, |

So a password like this: mL1Qjvul5^IG$|94 becomes a password like this: mL1Qjvul5^IG$|94

All four of those confusing characters appear, and yet it's easy to see that the first is a digit, because it's blue like the other digits. And the 2nd and 3rd are letters (all green). (The lower-case L and upper-case i are clearlu different in most fonts), and the final is a clearly vertical bar, because it's red like the other symbols.

cbrillow

I've run into this issue, after unfortunately creating a login ID for a site (that I don't want to change....) that includes a lower-case L followed by the number 1. The two look very much alike, but this is somewhat dependent on the screen font in use to display the characters. Some fonts better distinguish between the two than others...

wlc568

Great idea, Steve. I wonder if colors would help remove ambiguity?

duhh.

I gotta tell you, LastPass' intransigent point of view on this is beyond understanding. But like I said earlier: "uncle." This is my last comment on the subject.

steve110

I have the same issue.

I only use LastPass at work, but at home I use 1Password, which uses different colors for letters, digits, and symbols, so they are easily distinguished.

Assuming that idea isn't patented, there's no reason why LastPass can't adopt the same idea.

wlc568

"uncle"

FlyingHawk

"wlc568" wrote:
How would one conclude that "easy to read" eliminates ambiguous characters?

Seems very clear to me. Perhaps you can recommend a better phrasing.

"wlc568" wrote:
My recommendation is really quite simple: Since there are apparently more issues with ambiguity than the problem I encountered, eliminate them all and save the end user the experience I had. What's so difficult about solving the problem at the root? Without encountering the difficulty, how would anyone expect it to occur?

This would be an unacceptable solution.
People normally expect password generators to use full range of characters possible. If LP removes characters by default, it'd be perceived as weak or even dishonest or unnecessary fiddling, and may bring bad press. You can bet people would be angry and demand full range of characters the moment the news goes out.

wlc568

First, I want to be clear: I appreciate your response but...

How would one conclude that "easy to read" eliminates ambiguous characters?

Furthermore, in my copy of LastPass, under Advanced Options, my choices are: Import, Export, Deleted Items, History, Credit Monitoring, Bookmarklets, One Time Passwords, Open All Favorites, Manage Indentities, Generate Secure Password.

My recommendation is really quite simple: Since there are apparently more issues with ambiguity than the problem I encountered, eliminate them all and save the end user the experience I had. What's so difficult about solving the problem at the root? Without encountering the difficulty, how would anyone expect it to occur?

Perhaps you have a more effective recommendation.

jpenny84

There's already an option in the password generator to remove ambiguous characters. Just select "easy to read" from the advanced options.

Quick Links

Join the conversation!

If you found this discussion useful, why not register/sign-in? It only takes a minute to share your feedback, ask a question, or vote for a new feature!