3 ms·
> When passwords are case insensitive I'm always skeptical that they are storing passwords in plain text. or maybe they always to_lowercase all the passwords b
by iopq 10y ago
> When passwords are case insensitive I'm always skeptical that they are storing passwords in plain text.
or maybe they always to_lowercase all the passwords before hashing them
- detaro 10y agoThat's exactly what the next line in the parent comment says.
- iopq 10y agoBut it makes the whole comment pointless, how does it add to the suspicion?
- eximius 10y agoNo it doesn't, case insensitive passwords have nearly half of the entropy. It's less bad than plaintext password storage but only barely.
- iopq 10y agoMost passwords don't have capital letters unless forced by stupid password rules. This only makes it so accidental capital letters don't prevent you from logging in.
- mark-r 10y agoMaking a case-insensitive password checker is trivial if the passwords are being compared in plain text, but requires a bit of forethought if you do it with hashed passwords. In particular it's impossible to add this feature after the fact if you already have hashed mixed case passwords in your database. So the likelihood that passwords are unhashed goes way up.