4 ms·
Note the title is wrong but the linked response from Facebook describes what they actually do quite succinctly. So if you're coming straight to the comments, do
by zaroth 10y ago
Note the title is wrong but the linked response from Facebook describes what they actually do quite succinctly. So if you're coming straight to the comments, do take the 15 seconds to click through and read it!
You don't have to wonder if it "seems like going to far" because you can calculate almost exactly the reduction in the search space / entropy.
But don't just go based on the theoretical key space reduction. You have to look at the kinds of passwords that people actually choose and see if an online attack which gets on the order of 10 tries against a password before an account is locked would actually be marginally more effective because each submission is technically trying 4 passwords instead of 1?
The reality is the 4 additional tries that Facebook is giving you for free are not passwords that would be in the attacker dictionary in an attack which is allowed only 10-100 tries.
Whereas the 4 tries are probably at around 1% of the time, in other words billions of logins per year, result in a valid login for a user who knows the right password but simply failed to type it correctly.
Another key point to consider is if you give users these 4 extra tries for free on each submit, you cut down drastically (power law on the types of errors that users make) on the number of failed login attempts overall. When this happens you can now reduce the account locking threshold without catching a larger percentage of your real users in the "your account has been locked" trap. This results in a significant net improvement for security against online attack.
- tgb 10y agoSeems very reasonable to me. Similarly, I just had a friend comment that they like that Facebook tells them when they try to log in with an old password. But technically that makes it less secure for people who reuse passwords (ie everyone, to a first order approximation).
- blueplanet200 10y agoI'm pretty sure the title is accurate. Facebook isn't giving an additional "try" by storing the password with caps lock. It instead reduces the search space by 26 characters. Take for an example a password someone might have - 'AaaAaAaaAAaaaaaAaaAaAaaaAAaAaAaAAaaAAaAaAaAaaAaa' If an attacker knew it consisted of only [A, a] at random it would take 2^50 guesses. But now it only takes a single guess, just all A's. It's a toy example, but Facebook definitely isn't just giving four extra guesses for free.
- zaroth 10y agoI'm sorry, this is incorrect. Facebook does not store additional hashes. If the provided string does not match, they also try the following 3 variations; 1) String with case inverted -- effectively undo capslock 2) String with first character lowercased, if it was uppercase 3) String with last character removed So your example, a single guess of all 'A's would not match. You can try it yourself if you like! EDIT: So it's actually 3 extra tries, not 4 extra tries.
- blueplanet200 10y ago> String with case inverted -- effectively undo capslock Well don't I feel stupid. Didn't realize undo capslock meant inverting the casing. Doh.
- SolarNet 10y agoThe post you were replying to even said: > Note the title is wrong but the linked response from Facebook describes what they actually do quite succinctly. And you still responded with this. Come on.