10 ms·
"the hashed passwords seem to have been changed to all lowercase before storage". I have no words to describe how idiotic this is. How do people come up with th
by coldcode 10y ago
"the hashed passwords seem to have been changed to all lowercase before storage". I have no words to describe how idiotic this is. How do people come up with this and still get paid?
- Fluid_Mechanics 10y agoI don't think they're recruiting top talent...
- 0xmohit 10y agoMaybe they don't look out for talent on HN unlike Pornhub [0] :) [0] https://news.ycombinator.com/item?id=12846537 https://news.ycombinator.com/item?id=12846537
- riffraff 10y agoI guess this was done to allow inputting a slightly wrong password? I seem to recall facebook allowed login for a pass "fooBar" with "FooBar" (phone input capitalize first letter) and "FOObAR" (caps lock pressed). Still seems stupid to me, but if you care a lot more about letting people in than about their security it might make sense.
- timbowhite 10y agoChase's online banking login is case insensitive (for both username and password). Frightening that a bank cares less about security than letting people in.
- manyxcxi 10y agoI get the case insensitivity on the username though. You don't want grandma trying to remember if it was SweaterKnits@aol.com or sweaterKnits@aol.com as they resolve to the same thing. If not using the email, then he same thing applies, and I don't want the hassle of my tech support trying to resolve the difference over the phone.
- soVeryTired 10y agoI don't know how things are in the states, but a lot of banks in the UK ask you to input randomly selected characters from your password rather than asking for the whole thing. This suggests they're storing the passwords in the clear. The financial times wrote an article about it recently: https://www.ft.com/content/33503e4a-8f95-11e6-a72e-b428cb934b78 https://www.ft.com/content/33503e4a-8f95-11e6-a72e-b428cb934...
- msangi 10y agoI'm sure that is also preventing lots of people from using randomly generated passwords. I do, and it's not fun when I get asked to type in the 12th, 13th and 15th character.
- nicoburns 10y agoThis is because a lot of banks Internet banking systems evolved from their phone banking systems. The random digits thing was so that someone couldn'the guess your code when you said it out loud over the phone.
- syntheticnature 10y agoYes, when I wound up with Fidelity for a 401(k) I found their system was designed around being able to "enter your password on your phone" -- using the number keys, i.e. b3G -> 234. I can only hope that version is at least stored as a hash...
- djf1 10y agoThe worst feeling is getting halfway through keying out your password on the number keys when the Fidelity robot tells you that's not the right password. I just say operator now until they transfer me to a human.
- syntheticnature 10y agoI apparently am "good" enough to never have had that happen, though I don't call very often. That's horrific, since it implies that it is stored as plaintext, "optimistically" as "plain-number-text."
- grimmdude 10y agoI don't think that's correct, the password field is case sensitive for me.
- dawnerd 10y agoAs mine is too. Just tried it and it said incorrect. Maybe it's some set of old legacy users? But that wouldn't make sense since I'm migrated in from WaMu
- erikbye 10y agoMy bank used to do this as well.
- 0xmohit 10y agoChase's online banking login is case insensitive ... So is the case with Citi.
- emodendroket 10y agoIn general Chase has a reputation for being much more careful and thoughtful about security than others (and in fact their password policy is somewhat better than some other financial institutions I've done business with). But still, I agree, that sucks. e: There is a pretty good discussion of this here https://www.reddit.com/r/personalfinance/comments/2m81uj/tip_if_you_have_chasecom_accounts_be_sure_to_have/ https://www.reddit.com/r/personalfinance/comments/2m81uj/tip...
- dogma1138 10y agoThis is common with banks due to legacy systems that don't have case sensitivity. It's also not unheard of for them to strip all non alphanumeric characters so P@ssw0rd2016! is normalized to pssw0rd2016
- syntheticnature 10y agoThe last time I was made to change my Chase password, I made it maximal length at the time (32 characters). However, it turned out their login page had an off-by-one error in the login page Javascript, such that it wouldn't let you type 32 characters in the field. I worked around it via using the browser debugging tools to fix the bug, then decided on a 30-character password as an additional margin of safety. They said they'd look into it, never heard back about it.
- Godel_unicode 10y agoFinding off-by-one errors in production code is a hobby of mine, but it's also pretty horrifying how often they're security-relevant.
- CamperBob2 10y agoYou're lucky they didn't send a SWAT team to your door for "hacking."
- deleted 10y ago[deleted]
- Godel_unicode 10y agoThis is not true (at least for passwords on Android).
- userbinator 10y agoFrightening that a bank cares less about security than letting people in. On the other hand, they are probably far more alert to detecting and stopping bruteforcing attempts. It's a similar situation with certain 4-digit PINs for smartcards; that may seem trivial to bruteforce, but you only get 3-5 tries before the system considers you to be attacking it and permanently locks you out even if you try to enter the correct one afterwards.
- rmc 10y agoYou can do what Facebook does without storing the passwords as lower case. If someone tries to log in, and the password doesn't match, then just transform it that way and try again.
- golergka 10y agoIf you're saving the hash of original PassWORD, then transforming the erronously entered pASSword to lower case will still produce a different hash from tge one you have saved. It will only work if you save a hash of lower case password.
- qb45 10y agoYou can also do O(2^n) brute-force like a dumbass. Not sure if this is what GP meant. Maybe Facebook only accepts wrong case on the first position (simple to implement) or maybe GP just doesn't know what they do.
- thaumasiotes 10y ago> If you're saving the hash of original PassWORD, then transforming the erronously entered pASSword to lower case will still produce a different hash from t[h]e one you have saved. This is true, but it's not a response to your parent comment, > You can do what Facebook does without storing the passwords as lower case. If someone tries to log in, and the password doesn't match, then just transform it that way and try again. 1. Store the hash of "PassWORD". 2. Receive erroneous "pASSword", hash it, find the hash isn't right. 3. Reverse the case of the bad input to get "PassWORD", hash that, find it matches. At no point was it necessary to store the hash of "password".
- golergka 10y agoOh, you mean only the transformation of inverting the case. But I believe that originally we were talking about any mistakes with case, not only inversion.
- ced_vdb 10y agoWhy wouldn't they transform it before registration and login ? That way they don't have to check multiple passwords. I guess I'm missing smtg.
- FullMtlAlcoholc 10y agoThere really is a shortage of quality developers. A bit off topic, but I believe that's why there are so many devs bemoaning the growth of the JS ecosystem...you may have to know actual Computer Science instead of just one tool.
- jonaf 10y agoI'm not sure I understood your comment. I agree there's a shortage of quality developers, but sometimes that's a result of an influx of newcomers. Maybe you can elaborate on this connection (or lack thereof) between CS and JS? I honestly couldn't tell from your comment if you were speaking in a positive or negative light.
- CoryG89 10y agoI think an influx of newcomers might be a symptom of a shortage of quality developers rather than a cause. I suspect the cause would be more to do with an increase in demand in the job market and unfilled jobs, which encourages a lower bar when it comes to hiring.
- rco8786 10y agoNever miss a moment for a random Js snipe
- andybak 10y agoWhatever issues people have with the js tooling ecosystem "Dammit. It requires me to have a computer science background" doesn't strike me as a common one.
- underlingus 10y agoEh, the JS ecosystem's growth certainly isn't something I'd categorize as "scientific."
- 77pt77 10y agoHow do you jump from a small available pool of quality developers to JS problems?! I really don't like the JS ecosystem but this is totally unwarranted.
- nawitus 10y agoBattle.net does the same: https://www.reddit.com/r/wow/comments/3hbqcl/psa_battlenet_passwords_are_not_case_sensitive/?st=ivgu8afu&sh=e7074aa3 https://www.reddit.com/r/wow/comments/3hbqcl/psa_battlenet_p...
- wlll 10y agoIn reality a lot of people don't see any difference between "Password123", "password123" or "PASSWORD123". I was once talking to a bank and had to give char n of my password and I said something like "Uppercase E" and the rep on the other end of the phone actually scoffed at me "Capitals don't make any difference in passwords" and clearly thought I was an idiot. I am in two minds wether a service used by non technical people should allow for case insensitive passwords, it'd be interesting to see what the difference in support load, customer satisfaction and churn would be for both case sensitive and case insensitive passwords, and also enforcing minimum complexity.
- adanto6840 10y agoThat bank sounds to have bigger issues: perhaps obvious, it's very likely that they were storing the password as plaintext -- since they were able to ask you for a specific character and verify that your answer was correct. Scary. Have also never heard of a bank that actually asked for a password, substring or not, at least aside from being asked for a 'Phone PIN' or similar lesser/non-critical to authentication piece of information.
- brazzledazzle 10y agoIt's possible that they create the character entry when you set your password and the bank/operator only has access to that particular character in plain text.
- 77pt77 10y agoIn my experience banks store pins in plaintext way to often. The uppercase being indifferent is a first for me but I've had those people tell me that performing copy paste into the password input somehow changed the authentication procedure. He again acted as if I was a complete idiot for suggesting that that made no sense.
- joe463369 10y agoIf your bank is compromised to the point that your password - plaintext or otherwise - has been discovered, can things get much worse?
- kpdyer 10y agoI agree that password-typo tolerance may seem like a horrible idea on the surface. The "str to lower" approach is an especially aggressive way to increase usability. However, there's recent work [0] from Cornell that explores the security-usability tradeoff when correcting password typos. It turns out that accepting specific classes of typos (e.g., caps lock on: if password is "Password" then allow "pASSWORD") can increase usability with minimal security impact. [0] https://www.cs.cornell.edu/~rahul/projects/pwtypos.html https://www.cs.cornell.edu/~rahul/projects/pwtypos.html
- dogma1138 10y agoThe problem is that it requires you to store multiple hashes while case normalization doesn't. At least they do not strip special characters out of the password.
- praptak 10y agoNo, you can just store the original hash and try two times when matching.
- kpdyer 10y agoActually, I don't think there's a need to store multiple hashes. Here's one idea: Let's say the user's password is P. The user enters some password P' with a typo. The authentication check is "does H(T_k(P')) == H(P)" for some set of transformations {T_1, T_2, ..., T_n}. Each transformation T_i hypothesizes that the user made a specific mistake. (e.g., T_1 is the caps lock is on so we need to flip the case of all the characters)
- brobinson 10y agoCharles Schwab surprisingly does this, too.
- tonto 10y agoThey were really bad at one point, and only used the first 8 chars. Might be more now iirc
- cheiVia0 10y agoTo their credit, they do offer sending you a free security token.
- gotthemwmds 10y agoReally? I haven't seen one and I've had six figures in brokerage/checking/savings for a decade. I know someone who worked at their datacenter a while ago and, well, heh. Also, do they support e-statements for savings accounts yet? I swear it is the only piece of mail I get now a days. Overall though they are a great bank with a magic fee-less debit card and human beings who answer the phone 24/7. And they don't seem too evil, but I haven't turned over many rocks.
- cheiVia0 10y agoYep, if you go here: http://www.schwab.com/public/schwab/nn/legal_compliance/schwabsafe http://www.schwab.com/public/schwab/nn/legal_compliance/schw... and expand the "Be strategic with login credentials and passwords" section, it says: > Consider getting a free security token, too, which can make every login even more secure. Just call us at 800-435-4000.
- kimshibal 10y agocheap developers from third world countries
- StavrosK 10y agoThe casual racism was superfluous, I think.
- hueving 10y agoNot racism. At least learn the correct terms before slinging accusations.
- StavrosK 10y agoIf the notion that people from third-world countries can't be good developers isn't racism, pray enlighten me on what it is?
- throwaway1892 10y agoDiscrimination based on place of living?
- awqrre 10y agoIf they don't require uppercase characters in the password, it is not so idiotic... specially if they have rules that make up for it.
- femto113 10y agoThis attitude ignores the fact that risk comes in multiple forms. While lowercasing the passwords increases the guess-ability of the password when attempting to log in to this site it actually reduces the value of the password in a breach of this sort, since it may not be usable verbatim on other sites even if the user typed it the same way. As this sort of breach is now quite common I think many "best practices" for password security that date back to the design of unix logins are arguably no longer best. For example if we just used CRC24 to hash passwords it would be nearly impossible to recover them from the hashes, but at a practical level would be comparably secure on the front end: it would take 1000s of guesses to find a working collision, which is easily preventable at the front gate by locking the account after a small number of bad guesses; but it would be far more secure on the backend, since any CRC24 code could derive from millions of possibilities.
- russdill 10y agoYou seem to be describing a non-standard way of salting hashes, and in the case of modifying the case, an extremely poor way of doing it. Please don't do that.
- hueving 10y agoNot changing the salting. Changing the hashing algorithm.
- femto113 10y agoThis is intended as a thought experiment, not a concrete design for how to properly store passwords. In fact CRC24 doesn't really burn as much information as I assumed, e.g. on the top 100,000 passwords it only generates about 300 collisions (so over 99% still generate unique hashes). If one was really going to go in this direction a specialized hash that is deliberately collision prone across password-like strings is probably needed.
- rhizome 10y agoby that token I'd imagine ALLCAPSing would overlap many fewer passwords that have been reused for other sites.
- haudouken 10y agoChase bank does this.
- FilthyAnalyst 10y agoTDAmeritrade passwords aren't case sensitive. It's only money I guess.
- rickyc091 10y agoPassword rules... * Must be 7-15 characters * Must have at least one letter * Must have at least one number * No special characters ¯\_(ツ)_/¯
- DrScump 10y agoSaying that they don't require mixed case passwords to be chosen is not the same thing as saying they are "not case sensitive" (e.g. accepting "youare86ed" as valid for matching "YouAre86ed")
- lmm 10y agoIt's a good idea. The amount of security gained by distinguishing between upper/lower case is minimal, particularly compared to the support cost. Increase the minimum password length by a character or two to compensate if you're really worried.
- cxseven 10y agoAll the other comments seem to be misinterpreting this as "the passwords were changed to lowercase before hashing and storage", which is entirely different. Lowercasing after hashing increases the likelihood of a collision, but it won't necessarily have anything to do with the upper/lowercasing of the actual password.