[adamrmcd]

Unless you're manually injecting 0x08 into a database record, isn't it your keyboard that interprets your backspace into the UI layer. There's no way to type a backspace without literally pressing backspace :)

Regarding the null, if it's C based, theoretically your password just stops there. All other chars after that would be ignored.

Now I wonder, what would other non-C languages do if they see 0x00 in a string?

[wizofaus]

A password entry control doesn't have to interpret backspace the same way a regular text input control does (obviously meaning you'd need an alternative method of correcting typos). The 08 character can still be part of the control's "text" property that is ultimately hashed/stored etc. As for nulls, languages not based on C handle them fine but you'd have to be very careful they never got passed to an OS-level function, which nearly always treat them as terminators.

[toast0]

> There's no way to type a backspace without literally pressing backspace :)

ctrl-H usually works.