2 ms·
Actually, that's intended behavior. https://security.stackexchange.com/a/68014/47800 https://security.stackexchange.com/a/68014/47800
by inetknght 9y ago
Actually, that's intended behavior.
https://security.stackexchange.com/a/68014/47800 https://security.stackexchange.com/a/68014/47800
- oneeyedpigeon 9y agoThat's fascinating. Couldn't they just detect the caps lock being on and warn the user instead?
- inetknght 9y agoThat certainly makes more sense for desktop users. But remember the UX dark pattern for mobile touch screen devices: default is to capitalize the first letter of every sentence. On particularly old devices even in password fields have this. No caps-lock key on many of those keyboards. And, no warning that the shift key has been single-key or perma-pressed.
- thisacctforreal 9y agoThey can accomplish that feature using 3 separate hashes for various common mistakes, and it will still accept the normal case, but what GP is describing is that only a lowercase version of the password will work for account deletion.
- ynniv 9y agoIt's most likely that they're using lower(password) everywhere, except someone forgot to use that on the account deletion page and no one noticed.
- steaknsteak 9y agoHow convenient that they forgot to use it on the one action they never want you to perform