3 ms·
I think FB does this? Though it's a little bit different when it's an intentional tradeoff decision vs. just being bad at software. In FB's case with billions
by fossuser 6y ago
I think FB does this?
Though it's a little bit different when it's an intentional tradeoff decision vs. just being bad at software.
In FB's case with billions of non-technical users the tradeoff is probably valid.
- vel0city 6y agoFB does case-inversion of the password. If at first the password hashes don't match, it inverts the case (not all upper or all lower, but passWORD <-> PASSword) to solve if the capslock is on or not.
- fossuser 6y agoAh - that is what I remembering, thanks for the clarification.
- r00fus 6y agoThey should do the CAPSLOCK variant (ie, passWORD -> PASSWORD). Why would inversion even make sense? If I type passWORD with all caps, and shift the last 4, it does PASSWORD, not inverted.
- vel0city 6y agoIf I type passWORD with capslock on, I get PASSword when I apply the identical shift pattern (I literally just did this in this box!). This way if I have capslock on when typing my password, but I got the shift pattern the same, it'll still go but it doesn't wipe out my case changing patterns in terms of password security. I'm pretty sure this behavior of capslock is pretty common across most platforms, I can't think of a platform it didn't do this on. It worked just now on a few distros of Linux and Windows, I don't own a Mac so I cannot test that for you. What platform does shift not invert the case to lowercase if capslock is on?