3 ms·

Not necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower

Not necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower() on the input before calculating the hash.

outworlder 7y ago
You are right. But then it boggles my mind even more that one would go through the extra effort.
- LorenPechtel 7y ago
  Why? I've done it before. This was an in-house program with little in the way of security implications. Forcing the case on the password greatly cut down the number of problems. Since then I have seen a better solution: Try the password, if it fails try it with the case flipped. If that works it's a caps-lock error, they know the password, accept it.
learnstats2 7y ago
I haven't checked lately, but I understood that Facebook passwords are case-insensitive.
- jdashg 7y ago
  IIRC Wells Fargo passwords used to be /partially/ insensitive. Like, just the first half was to_lower.
- RandallBrown 7y ago
  They're not case insensitive, but they do allow for some casing mistakes. Flipped case (caps lock) or first character case is wrong (mobile input field) were both allowed. Not sure about now. The article I found about it was from 2014.
  - ineedasername 7y ago
    That seems bad, like philosophically it feels like a password and only that exact password should work. But rationally I can't see too much of a problem with this.
- davchana 7y ago
  No, not case-insensitive. They are case-sensitive. Atleast in 2012 Facebook accepted PassWord1 & pASSwORD1 (Case Reversed) passwords. Stackoverflow Meta Question here: https://webapps.stackexchange.com/questions/26301/facebook-accepts-more-than-one-password https://webapps.stackexchange.com/questions/26301/facebook-a... My Question (the reason why I know): https://stackoverflow.com/questions/10718236/how-to-alter-the-case-of-a-string-in-php-passw5ord-to-passw5ord https://stackoverflow.com/questions/10718236/how-to-alter-th...

outworlder 7y ago

You are right. But then it boggles my mind even more that one would go through the extra effort.

LorenPechtel 7y ago
Why? I've done it before. This was an in-house program with little in the way of security implications. Forcing the case on the password greatly cut down the number of problems. Since then I have seen a better solution: Try the password, if it fails try it with the case flipped. If that works it's a caps-lock error, they know the password, accept it.

learnstats2 7y ago

I haven't checked lately, but I understood that Facebook passwords are case-insensitive.

jdashg 7y ago
IIRC Wells Fargo passwords used to be /partially/ insensitive. Like, just the first half was to_lower.
RandallBrown 7y ago
They're not case insensitive, but they do allow for some casing mistakes. Flipped case (caps lock) or first character case is wrong (mobile input field) were both allowed. Not sure about now. The article I found about it was from 2014.
- ineedasername 7y ago
  That seems bad, like philosophically it feels like a password and only that exact password should work. But rationally I can't see too much of a problem with this.
davchana 7y ago
No, not case-insensitive. They are case-sensitive. Atleast in 2012 Facebook accepted PassWord1 & pASSwORD1 (Case Reversed) passwords. Stackoverflow Meta Question here: https://webapps.stackexchange.com/questions/26301/facebook-accepts-more-than-one-password https://webapps.stackexchange.com/questions/26301/facebook-a... My Question (the reason why I know): https://stackoverflow.com/questions/10718236/how-to-alter-the-case-of-a-string-in-php-passw5ord-to-passw5ord https://stackoverflow.com/questions/10718236/how-to-alter-th...