4 ms·
The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text. For instance, case-insens
by outworlder 7y ago
The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text.
For instance, case-insensitive passwords.
EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name).
Why can't it have spaces? Hashes don't care about this. Smells awfully like some string manipulation going on.
Why is it limited to 20 characters? Odds are that they are using VARCHAR(20) or variants. Hashes also don't care about this.
None of this is proof, but it smells really bad.
- intrepidlemon 7y agoNot necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower() on the input before calculating the hash.
- outworlder 7y agoYou are right. But then it boggles my mind even more that one would go through the extra effort.
- LorenPechtel 7y agoWhy? I've done it before. This was an in-house program with little in the way of security implications. Forcing the case on the password greatly cut down the number of problems. Since then I have seen a better solution: Try the password, if it fails try it with the case flipped. If that works it's a caps-lock error, they know the password, accept it.
- learnstats2 7y agoI haven't checked lately, but I understood that Facebook passwords are case-insensitive.
- jdashg 7y agoIIRC Wells Fargo passwords used to be /partially/ insensitive. Like, just the first half was to_lower.
- RandallBrown 7y agoThey're not case insensitive, but they do allow for some casing mistakes. Flipped case (caps lock) or first character case is wrong (mobile input field) were both allowed. Not sure about now. The article I found about it was from 2014.
- ineedasername 7y agoThat seems bad, like philosophically it feels like a password and only that exact password should work. But rationally I can't see too much of a problem with this.
- davchana 7y agoNo, not case-insensitive. They are case-sensitive. Atleast in 2012 Facebook accepted PassWord1 & pASSwORD1 (Case Reversed) passwords. Stackoverflow Meta Question here: https://webapps.stackexchange.com/questions/26301/facebook-accepts-more-than-one-password https://webapps.stackexchange.com/questions/26301/facebook-a... My Question (the reason why I know): https://stackoverflow.com/questions/10718236/how-to-alter-the-case-of-a-string-in-php-passw5ord-to-passw5ord https://stackoverflow.com/questions/10718236/how-to-alter-th...
- ypeter 7y agoYou can't be sure, they could lowercase all passwords (so during registration and after logging in) after they are entered.
- anderskaseorg 7y agoThey could be doing argon2(lowercase(password)). But you're right, it's unlikely that they're doing the wrong thing in the right way.
- seaish 7y agoThe one that actually tells you they store plaintext passwords is when it can't be close to previous passwords.
- dfox 7y agoYou can also implement that by just bruteforcing the previous hash with variants of the new password. IIRC Windows since 2000 implement these kinds of checks in exactly this way.
- eru 7y agoThey are some ingenious ways to make that judgement without storing plaintext passwords. But you are right, that none of those companies do that.
- iamnotacrook 7y ago"For instance, case-insensitive passwords." "Why can't it have spaces?" They don't want to deal with angry customers who are "definitely entering the correct password but it's not letting me in".