3 ms·
re: case insensitive .. I've heard of a bank with a similar problem, I don't recall which, where the reason was legacy compatibility with touch-tone phones. Th
by soneil 9y ago
re: case insensitive .. I've heard of a bank with a similar problem, I don't recall which, where the reason was legacy compatibility with touch-tone phones. The password was normalized to something you could key in on a phone.
This isn't an excuse, just a poorly-remembered anecdote as to how backwards some of these systems are.
- askvictor 9y agoI can actually see a case for case-insensitive password provided that other security measures are in place, and that there is an entropy requirement somewhere. I doubt that is the actual reason why those banks have it implemented, but it could certainly be argued that people will remember their passwords better if case is not an issue; and lets face it, most remember-able passwords will either be all of one case, or have the first letter capitalised. Goes back to the saying "Security at the expense of usability comes at the expense of security". This argument is based on the assumption of passwords needing to be remembered, which is certainly debatable from a security POV, but it a very common use pattern by humans.