12 ms·
I agree that password-typo tolerance may seem like a horrible idea on the surface. The "str to lower" approach is an especially aggressive way to increase usabi
by kpdyer 10y ago
I agree that password-typo tolerance may seem like a horrible idea on the surface. The "str to lower" approach is an especially aggressive way to increase usability.
However, there's recent work [0] from Cornell that explores the security-usability tradeoff when correcting password typos. It turns out that accepting specific classes of typos (e.g., caps lock on: if password is "Password" then allow "pASSWORD") can increase usability with minimal security impact.
[0] https://www.cs.cornell.edu/~rahul/projects/pwtypos.html https://www.cs.cornell.edu/~rahul/projects/pwtypos.html
- dogma1138 10y agoThe problem is that it requires you to store multiple hashes while case normalization doesn't. At least they do not strip special characters out of the password.
- praptak 10y agoNo, you can just store the original hash and try two times when matching.
- kpdyer 10y agoActually, I don't think there's a need to store multiple hashes. Here's one idea: Let's say the user's password is P. The user enters some password P' with a typo. The authentication check is "does H(T_k(P')) == H(P)" for some set of transformations {T_1, T_2, ..., T_n}. Each transformation T_i hypothesizes that the user made a specific mistake. (e.g., T_1 is the caps lock is on so we need to flip the case of all the characters)
- Cyph0n 10y agoThat caps lock case is a good one, but I don't really see other realistic instances where you wouldn't just say "username or password is incorrect".
- kpdyer 10y agoA few other cases: transcription errors (i.e., mistaking 1 for l), wrong case of the first character of the password, extraneous character at the end of a password, etc. The paper I linked to actually does a good job motivating specific classes of typos by looking at real typos from Dropbox users.
- nsgi 10y agoOr you could just show a message if the caps lock is on.
- kpdyer 10y agoThat's a good idea but it doesn't work for other common typos: wrong case of only the first character, an extraneous character at the end of the password, etc.
- alasdair_ 10y agoHow do you detect if caps lock is on with JavaScript in the browser?
- alasdair_ 10y agoHow do you detect if caps lock is on with JavaScript in the browser?
- solatic 10y agoCase insensitivity is pretty Anglocentric. Much more interesting would be keyboard layout insensitivity. As an Israeli developer, if my password is, say, asdf, then from a usability viewpoint it would do me wonders if שדגכ would also be accepted, as I'll be writing something in Hebrew, switch to a different page, click a link that brings me to a login page where my username is saved, whoops just entered my password on the Hebrew layout by accident. Reporting caps lock usage and not also keyboard layout usage is a pretty bad usability hole IMO.
- eropple 10y agoI've been out of the web game for a while - does the browser report what your keyboard layout is?
- DCoder 10y agoBrowser language preferences, yes. Keyboard layout, no. For one thing, layout names vary between OSes, for another, custom keyboard layouts are a thing... However, you can try and read individual keypress events and see which printable characters are generated for which key codes.
- gumby 10y agoFWIW on my iphone I use the English layout (qwertyuiop) for all roman-alphabet languages I use, since spelling correction language is connected to the declared "language" (a strange yet sensible overloading).
- hammock 10y ago>if password is "Password" then allow "pASSWORD" Facebook does this, in case you weren't aware.
- r00fus 10y agoI thought case insensitivity was only for the first character?
- PwdRsch 10y agoThey do try changing the capitalization of only the first character, but also invert the capitalization of all the characters in the supplied password. http://www.zdnet.com/article/facebook-passwords-are-not-case-sensitive-update/ http://www.zdnet.com/article/facebook-passwords-are-not-case...
- abluecloud 10y agoeugh. really? If true, I'd imagine they do it to appease mobile users.
- bigiain 10y agoAt Facebook's scale, I'd bet someone has research and evidence of 7 digit per year reductions in support costs by making capslock (or forgotten capitalisation) problems "go away"...
- Godel_unicode 10y agoWhy would you imagine that? In my experience, it's much harder to turn on caps lock by accident on mobile.
- gruturo 10y agoThe first character is often auto-capitalized in many input fields by your mobile browser. If a field is properly declared to be a password field (<input type="password" name="pwd">) of course ideally this wouldn't happen (plus, the characters get masked with stars, and hopefully what you type doesn't end up in your autocorrect dictionary, etc etc) - but it's full of shitty browsers out there.
- darkhorn 10y agoToo bad that web sites are very English centric. They ask for upper case, I enter Ö, they don't recognize it as upper case.
- Nullabillity 10y agoYup. Also fun when trying to get paid from Google Play. "Please enter your name exactly like on your bank statement", then refuses since my bank statement name contains an ö...
- toothbrush 10y agoTime to dredge up this one: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
- aduitsis 10y agoThat's nothing! My name in Greek has a letter with a double accent. Perfectly valid of course. But many (Greek) sites will reply that this NOT a Greek letter :)