4 ms·
How can they get away with not storing at least a second hash? I don't see how an all-caps password can be matched to an any cased password, unless you only st
by sandropadin 10y ago
How can they get away with not storing at least a second hash? I don't see how an all-caps password can be matched to an any cased password, unless you only store the hash to the all-caps password.
- guan 10y agoI think what was meant was that they don’t store a second hash in order to allow chopping off a character at the end. I agree with you that they would need to store extra hashes for allowing all-caps and some of the other cases.
- 3131s 10y agoNo extra hashes needed for an all caps version or inverted case version of a password, just perform those transformations on the user input, hash, and compare the result to the single stored hash.
- deleted 10y ago[deleted]
- wrs 10y agoIt's not all-caps, it's typed with caps-lock down (i.e., case inverted).
- sandropadin 10y agoThanks! Case inverted makes sense. They can invert the case before hashing and submitting. If any of the four hashes match the stored hash, they get in.
- wlesieutre 10y agoNote that this behavior is OS specific. Windows will invert case (shift gives lowercase), while macOS will be all-caps (shift doesn't do anything). Frankly I can't remember the Windows approach ever being useful to me, and more often than not it bites me in the ass because I habitually hit something like shift-i to type "I" and end up with a lowercase i instead.
- NamTaf 10y agoDrafters (the guys who draw engineering drawings) love it because you very rarely but just enough have to type lowercase letters (such as units, like 3mm) whilst all other text must be in capitals. Thus, you just use shift to shift it to lowercase for those rare moments and no other times.