What are the security implications (if any) of allowing any password? -

as ars , many others have pointed out, large organizations extensive, presumably intelligent departments employ rules password creation not in best interest of security.

sometimes though, still hard understand why applications restrict characters allow others, , why other applications have rules contrast other applications. of makes me feel missing something.

i have been taught never trust raw input user, feels wrong allow input user , not validate it, conflicted. in case feel there strong argument allowing user enter anything, , not validate (because there no need).

for illustrative reasons, take following hypothetical user registration system:

a hypothetical user registration system

1. a user navigates form registering account website.
2. among other inputs, user prompted password. user told may enter desired password. there no rules. can absolutely string of characters.
3. upon receiving submitted form (or request, legitimate or malicious), server not validate password field: hashes whatever given.
4. the hash stored in database use later.

for instance, in php:

password_hash($_post['password'], password_default); 

if there any, security implications of system?

is there kind of specially-crafted request can possible submit cause unintended consequences in system? if so, please provide examples.

would server-side languages susceptible attacks this, others not? ones?

again, system illustrative. please not argue merits or downfalls system may have in terms of security of users' passwords themselves, security implications may have on system itself.

the common reason preventing characters developers don't know how correctly handle passwords in whatever language working in, , rather learn so, try limit data accept (often incorrectly). alternately, rely on third party components handle passwords incorrectly , believe powerless fix this. (this described in article link.)

if code precisely describe, no fancy javascript in middle touching input, no middleware unpacking data structures, no logging systems writing passwords, no writing raw passwords database, no sql queries built strings might include password, no unhashed passwords in database, no incorrectly encoded strings in urls, etc., yeah, it's great. it's perfect (i'd rather apply hashing before posting server, there arguments there either way).

in modern applications, developers slap of things mentioned in last paragraph, , apply layer of hope , prayer , scramble patch when publishes exploit. in last paragraph horrible, , common.

so if see restrictions on characters acceptable, means password handling system either built poorly or developers don't trust it. common, restrictions common.