# Use of ambiguous letters in security codes **URL:** \ **Category:** The BBQ Pit\ **Created:** [June 24, 2022, 6:01pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773 "2022-06-24T18:01:44Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![DCnDC](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dcndc/32/2842_2.png) [@DCnDC](https://boards.straightdope.com/u/DCnDC)\ **Post date:** [June 24, 2022, 6:01pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/1 "2022-06-24T18:01:44Z")
Fuck [Login.gov](http://Login.gov) and their goddamn alphanumeric 2-factor security codes. You give me a fucking code full of Bs and Vs and zeros and Os and then you lock me out for putting in the wrong code too many times?!?!?! FUCK YOU. What the fuck is wrong with just numbers? It expires in 10 minutes anyways, the letters aren’t making it any more secure, it’s just making it more confusing. Fuck whoever the moron is who decided that alphanumeric codes were a good idea for temporary 2-factor security codes. Nobody else does this, everyone else just uses numbers and IT’S FINE. ---
**Author:** ![Roger\_That](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/roger_that/32/8505_2.png) [@Roger\_That](https://boards.straightdope.com/u/Roger_That)\ **Post date:** [June 24, 2022, 6:19pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/2 "2022-06-24T18:19:02Z")
Future generations (i.e., in about 20 years) will laugh hysterically at us and our moronic security codes. ---
**Author:** ![Munch](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/munch/32/5281_2.png) [@Munch](https://boards.straightdope.com/u/Munch)\ **Post date:** [June 24, 2022, 6:21pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/3 "2022-06-24T18:21:29Z")
At my previous job I had to enter VINs a lot. Seemed they found a sadistic glee in overusing 5s and Ss, which are even more fun when printed out on dot matrix printers. ---
**Author:** ![Gatopescado](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gatopescado/32/5711_2.png) [@Gatopescado](https://boards.straightdope.com/u/Gatopescado)\ **Post date:** [June 24, 2022, 6:24pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/4 "2022-06-24T18:24:10Z")
> [@Roger\_That](#): > > Future generations (i.e., in about 20 years) will laugh hysterically at us… About _EVERYTHING_ going on today! ---
**Author:** ![thelurkinghorror](https://avatars.discourse-cdn.com/v4/letter/t/7c8e57/32.png) [@thelurkinghorror](https://boards.straightdope.com/u/thelurkinghorror)\ **Post date:** [June 24, 2022, 6:39pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/5 "2022-06-24T18:39:56Z")
Agreed to 2FA. Especially since it’s nonsensical. My bank doesn’t make me do it, but Workday makes you redo for every device weekly, and the worst damage someone can do is look at my paycheck. Also annoying is GMail that is starting to force people to 1) have smart phones, 2) make it hard for people to share an account as you need to have one person ready to confirm in a 15 minute window. For passwords, the LastPass app very conveniently color codes letters black, numbers red, and symbols blue. More people should do this. For security codes, many are CAPTCHA tests designed to check if you’re human. It’s really designed to a) be _possible_ for humans to read, but more difficult for machine learning or other machine methods. There’s also Google’s reCAPTCHA version, which changed scope with “generations” but usually designed to both provide security and decipher old text across many human observers. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [June 24, 2022, 10:30pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/6 "2022-06-24T22:30:24Z")
There are some people who order personalized license plates for their cars like X00O0O0 ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [June 24, 2022, 11:13pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/7 "2022-06-24T23:13:20Z")
I play a game called Lost Ark. (It’s a trashy Korean MMO game heavy on pay to win, but it’s pretty and has fun combat so I play it, dammit.) Anyway, they love to troll their players big time with intentional frustration. One of the achievements in the game (not an actual quest or anything, just something optional that gives you points that can earn you a reward) is to make this chemical formula. You have to go to one person, buy these crystals, then go to a different person and trade those crystals in for certain quantities of chemicals. The chemicals are given names that are INTENTIONALLY a pain in the ass, like “ **IX-IlIl121lIIlI1** ”. Keep in mind, that is a mix of lower-case Ls, upper-case Is. and 1s. It looks even worse in the game screen menus, where there is only the tiniest difference between the characters. And the chemicals will only have one or two characters different from each other. I wasted a lot of in-game money accidentally trading for the wrong chemical, which you can’t sell back or otherwise use, and trying again. When I figured out what they were doing I had to laugh. Those assholes. They were pranking the players on purpose. In retrospect it’s pretty damn funny. But my point is, these game developers know this pain and decided to use it for their game. ---
**Author:** ![cochrane](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cochrane/32/10441_2.png) [@cochrane](https://boards.straightdope.com/u/cochrane)\ **Post date:** [June 24, 2022, 11:37pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/8 "2022-06-24T23:37:09Z")
> [@Munch](#): > > At my previous job I had to enter VINs a lot. Seemed they found a sadistic glee in overusing 5s and Ss, which are even more fun when printed out on dot matrix printers. Question: Is that an “S” or a “5”? [![](https://img.youtube.com/vi/lOFSuRe7mcs/maxresdefault.jpg "Too Many Robot Tests? - GEICO Insurance") ](https://www.youtube.com/watch?v=lOFSuRe7mcs) ---
**Author:** ![ThelmaLou](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thelmalou/32/390_2.png) [@ThelmaLou](https://boards.straightdope.com/u/ThelmaLou)\ **Post date:** [June 24, 2022, 11:41pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/9 "2022-06-24T23:41:55Z")
I heartily endorse this pitting! Logging in to [MyPay.gov](http://MyPay.gov) is a freaking nightmare! ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [June 24, 2022, 11:57pm UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/10 "2022-06-24T23:57:53Z")
> [@DCnDC](#): > > What the fuck is wrong with just numbers? Nothing, in fact whoever is not using just numbers probably failed computer science. Cf. [RFC 4226 - HOTP: An HMAC-Based One-Time Password Algorithm](https://datatracker.ietf.org/doc/html/rfc4226) Note one of the _ **requirements** _ is that the value be easily read and entered by the user. The example given is a 6- to 8-digit code. ---
**Author:** ![DeadTreasSecretaries](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deadtreassecretaries/32/4817_2.png) [@DeadTreasSecretaries](https://boards.straightdope.com/u/DeadTreasSecretaries)\ **Post date:** [June 25, 2022, 12:28am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/11 "2022-06-25T00:28:11Z")
> **[Password Strength](https://xkcd.com/936/)** > > To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize. ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [June 25, 2022, 12:29am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/12 "2022-06-25T00:29:08Z")
When I generate passwords for users, I had it to them on a card that has something like Your password is: `1BclI09O` | | | | | --- | --- | --- | | `1` | 1 | One | | `l` | lowercase l | lima | | `I` | uppercase I | India | | `O` | uppercase O | Oscar | | `0` | 0 | Zero | So not only in a font where they look different in the first place, but then with a decoder ring just in case people don’t know the dot (or slash) means the circle thing is a zero. I mean, I’m just one guy, who started doing that because it’s how I want to be treated, and yet these big companies and governments can’t do it. I guess it didn’t have to go to a committee, and get approval from the CIO, I just did it. One big thing that bugs me about the government is NIST saying scheduled password changes are bad, and then NIH forcing ERA commons passwords to change a few times per year. (I guess ERA commons now uses [login.gov](http://login.gov), so maybe it’s finally changed). ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [June 25, 2022, 12:39am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/13 "2022-06-25T00:39:27Z")
My employer’s password requirements got so tedious that my current password refers to the rules as “nuts” plus a string of numbers, the last of which increases by one when it’s time to change again. ---
**Author:** ![scudsucker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scudsucker/32/14101_2.png) [@scudsucker](https://boards.straightdope.com/u/scudsucker)\ **Post date:** [June 25, 2022, 12:48am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/14 "2022-06-25T00:48:10Z")
When I worked in a similar field (short URLs, which granted are less likely to mislead, because they are themselves a URL) we purposely avoided misleading characters, but more so, the chances that our short URL would contain bad words that would inevitably lead to bad publicity. A faked example (broken link, too): http: [//my.co/suck5](https://my.co/suck5) We did this for 12 languages, as well. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [June 25, 2022, 1:08am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/15 "2022-06-25T01:08:52Z")
> [@Senegoid](#): > > There are some people who order personalized license plates for their cars like X00O0O0 Joke’s on them, because I’m pretty sure the DMV treats 0 and O as the same character for look-up and uniqueness purposes, and likewise 1 and I. Maybe it’s different in more populous states, but around here, you never see O (as in Oscar) or I (as in India) as letters, aside from on vanity plates. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [June 25, 2022, 1:20am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/16 "2022-06-25T01:20:09Z")
> [@Chronos](#): > > Joke’s on them, because I’m pretty sure the DMV treats 0 and O as the same character for look-up and uniqueness purposes This is California. ISTM I’ve seen this mentioned too, somewhere. > [@echoreply](#): > > When I generate passwords for users, I had it to them on a card . . . 30-some years ago, I used to generate “temporary” passwords for new users. (“Temporary” only in the sense that I gave them a document with the password and instructions for changing it, and advising them to do so.) I wrote a trivial program that generated a whole page of random 8-character passwords, using only lower-case letters and digits chosen from an alphabet in which I had excluded all ambiguous characters. ---
**Author:** ![lobotomyboy63](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobotomyboy63/32/2900_2.png) [@lobotomyboy63](https://boards.straightdope.com/u/lobotomyboy63)\ **Post date:** [June 25, 2022, 2:06am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/17 "2022-06-25T02:06:15Z")
I’m surprised when I see that ambiguity on license plates. In Texas, partly due to my failing vision on the plate and partly because of the font, sometimes K looks like X. ISTM that the important thing is that a policeman be able to write it down as the suspect flees. ---
**Author:** ![Robot\_Arm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/robot_arm/32/18280_2.png) [@Robot\_Arm](https://boards.straightdope.com/u/Robot_Arm)\ **Post date:** [June 25, 2022, 2:45am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/18 "2022-06-25T02:45:27Z")
> [@DCnDC](#): > > You give me a fucking code full of Bs and Vs and zeros and Os and then you lock me out for putting in the wrong code too many times?!?!?! Is there some font where a B looks like a V? ---
**Author:** ![DCnDC](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dcndc/32/2842_2.png) [@DCnDC](https://boards.straightdope.com/u/DCnDC)\ **Post date:** [June 25, 2022, 2:52am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/19 "2022-06-25T02:52:45Z")
I’m getting it over a VOIP phone. ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [June 25, 2022, 4:19am UTC](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773/20 "2022-06-25T04:19:57Z")
At my work, I have an employee account and an administrator account (for when I need admin privileges doing IT work). Our admin passwords need to be at least 16 characters long. I just type a brief song lyric, with spaces between words. It is so easy to remember yet pretty hard to brute force. [Next page](https://boards.straightdope.com/t/use-of-ambiguous-letters-in-security-codes/966773.md?page=2)