Tuesday, 22 December 2009

The Curse of the Single Quote

« Obama names Howard Schmidt Chief of Cybersecurity | Main | Some secure memory sticks may not be all that secure... »

Speaking from personal experience, having Tsipenyuk as a last name can be inconvenient due to pronunciation and spelling errors, but the last name O'Neil can cost you an identity. I came to realize this when I got married and, being convinced by many around me, exchanged my complicated scary-looking Ukrainian last name for this simple and straightforward Irish one. Turns out, my problems were just beginning.

I will skip over describing the pain and frustration of filling out millions of request forms asking to change the last name on millions of the accounts from one to another, and making millions of photocopies of the marriage certificate to send along with the forms as a proof. I won't start a discussion on why changing your last name on a credit card account is significantly less painful than doing the same for an airline frequent miles account. I will proceed straight to the really good stuff.

  • The Social Security office simply dropped the single quote from my last name even though my request form clearly contained one. When I inquired about it, the response was that their system automatically does this and treats O'Neil and ONeil the same.
  • TD Ameritrade and Wells Fargo sites (as well as many others) don't allow single quotes in their passwords.
  • The zenTrack project management and bug tracking software escapes single quotes, but does so incorrectly, leaving backslashes for display.

The list goes on--these are just a few examples of what I keep running into. I am sure some of you see what I'm getting at. Clearly, all of the mentioned inconveniences are caused by the fact that single quote is a special character that needs to be correctly handled by software behind all these institutions. Some institutions choose to deal with the problem by simply not allowing special characters, others attempt to escape them. Still others--remain vulnerable. It boggles my mind that this one character causes so much pain and makes it necessary for me to remember what version of my last name I should use at which point. Why is there still no standard way of dealing with this problem? Why is everyone still doing their own thing?

It shouldn't be a surprise to you that my advice to the software developers writing code for these institutions is to create standards that allow them to be consistent and correct in their handling of names as "special" as O'Neil. I still hope that one day the standard everyone adheres to will exist, and then I will be an O'Neil at all times. Until then we'll keep running into problems similar to this one.

Posted by yoneil at 11:45 AM in Fortify

 

[Trackback URL for this entry]

Comment: Doug at Tue, 12 Jan 5:06 PM

TD Ameritrade and Wells Fargo sites (as well as many others) don't allow single quotes in their passwords.


Katerina, I will try to remember that you use your surname in your banking passwords. Thanks!

Doug

Your comment:

 
Generate another code
SCode

Please enter the code as seen in the image above to post your comment.
 
 

Live Comment Preview: