I experienced something similar with a government-certified "secure locker" web app my company is using to transfer paychecks and other documents to employees.

I experienced something similar with a government-certified "secure locker" web app my company is using to transfer paychecks and other documents to employees. After a few complaints to HR about changing provider (who must've forwarded the complaints to the "web locker" firm), they switched to case-sensitive match. Except now all the existing user's password had to be input in lowercase, since they were converting passwords to lowercase before storing them in plaintext!