2 ms·
Case-insensitive password comparison in a very bad idea because it strips a lot of entropy from the password pool.
by spiffytech 9y ago
Case-insensitive password comparison in a very bad idea because it strips a lot of entropy from the password pool.
- drdaeman 9y agoMy bad, I meant not really case-insensitive but flipped case, to account for possible Caps Lock state. I.e. for "Hunter2" you also accept "hUNTER2" (but "HuNTeR2" is still not valid). Facebook does this. This is only a single bit compromise, and if there are a lot of users affected, benefits may overweigh the slight security downgrade.