5 ms·
You can do what Facebook does without storing the passwords as lower case. If someone tries to log in, and the password doesn't match, then just transform it th
by rmc 10y ago
You can do what Facebook does without storing the passwords as lower case. If someone tries to log in, and the password doesn't match, then just transform it that way and try again.
- golergka 10y agoIf you're saving the hash of original PassWORD, then transforming the erronously entered pASSword to lower case will still produce a different hash from tge one you have saved. It will only work if you save a hash of lower case password.
- qb45 10y agoYou can also do O(2^n) brute-force like a dumbass. Not sure if this is what GP meant. Maybe Facebook only accepts wrong case on the first position (simple to implement) or maybe GP just doesn't know what they do.
- thaumasiotes 10y ago> If you're saving the hash of original PassWORD, then transforming the erronously entered pASSword to lower case will still produce a different hash from t[h]e one you have saved. This is true, but it's not a response to your parent comment, > You can do what Facebook does without storing the passwords as lower case. If someone tries to log in, and the password doesn't match, then just transform it that way and try again. 1. Store the hash of "PassWORD". 2. Receive erroneous "pASSword", hash it, find the hash isn't right. 3. Reverse the case of the bad input to get "PassWORD", hash that, find it matches. At no point was it necessary to store the hash of "password".
- golergka 10y agoOh, you mean only the transformation of inverting the case. But I believe that originally we were talking about any mistakes with case, not only inversion.
- ced_vdb 10y agoWhy wouldn't they transform it before registration and login ? That way they don't have to check multiple passwords. I guess I'm missing smtg.