5 ms·
Not true, they most likely convert all characters to a certain case before they hash it, so even if you entered PASSworD123 they convert to password123 and then
by stanmancan 9y ago
Not true, they most likely convert all characters to a certain case before they hash it, so even if you entered PASSworD123 they convert to password123 and then hash.
I believe I read that Facebook stores a few commonly mistyped versions of everyone's password. Actual password, typed as if caps lock was on, things like that.
- mark-r 9y agoSure, it's possible to do it that way. But if I were taking bets, I know where I'd put my money.
- criddell 9y agoThat's a good point. I'm pretty sure my bank is storing the password because they also limit it to some (small) number of characters. I'm guessing it's because the web interface is just passing it on to some ancient back-end system.
- JadeNB 9y ago> I'm pretty sure my bank is storing the password because they also limit it to some (small) number of characters. I love how it's always the banks with these ridiculous password practices. I'm really glad that it's not some site where the password is protecting important information.
- Buge 9y agoThat reduces password entropy and makes the hashes easier to crack.
- stanmancan 9y agoI didn't say it's a good idea, it's awful, just pointing it out though.
- cm2187 9y agoWell, does it? Even if you crack it you don't have the correct casing. So you don't have the original password. Of course doesn't help if every other website converts to lower case too. But if you use bcrypt you can partially compensate by using a higher work factor.
- OJFord 9y ago> Well, does it? Even if you crack it you don't have the correct casing. The 'correct casing' is any member of the set of all permutations of cases. So you both do, don't, and do not care.