3 ms·
I'm pretty sure the title is accurate. Facebook isn't giving an additional "try" by storing the password with caps lock. It instead reduces the search space by
by blueplanet200 10y ago
I'm pretty sure the title is accurate.
Facebook isn't giving an additional "try" by storing the password with caps lock. It instead reduces the search space by 26 characters.
Take for an example a password someone might have -
'AaaAaAaaAAaaaaaAaaAaAaaaAAaAaAaAAaaAAaAaAaAaaAaa'
If an attacker knew it consisted of only [A, a] at random it would take 2^50 guesses. But now it only takes a single guess, just all A's. It's a toy example, but Facebook definitely isn't just giving four extra guesses for free.
- zaroth 10y agoI'm sorry, this is incorrect. Facebook does not store additional hashes. If the provided string does not match, they also try the following 3 variations; 1) String with case inverted -- effectively undo capslock 2) String with first character lowercased, if it was uppercase 3) String with last character removed So your example, a single guess of all 'A's would not match. You can try it yourself if you like! EDIT: So it's actually 3 extra tries, not 4 extra tries.
- blueplanet200 10y ago> String with case inverted -- effectively undo capslock Well don't I feel stupid. Didn't realize undo capslock meant inverting the casing. Doh.
- SolarNet 10y agoThe post you were replying to even said: > Note the title is wrong but the linked response from Facebook describes what they actually do quite succinctly. And you still responded with this. Come on.