21 ms·
Gmail password first character is case insensitive on mobile device
- qwerty1793 5y agoSimilarly there are many sites that allow you to log in using `your password` or `your password`.swapcase() (for example, Password123 or pASSWORD123). Automatically trying a variant only costs a single bit of entropy and can greatly reduce login issues
- jikbd 5y agoI remember this being the case on Facebook?
- egeozcan 5y agoIt was possible to login with the reverse of your password (as in password.split().reverse().join('')).
- piaste 5y agoWhat was the reasoning? Unlike case or typos, you wouldn't accidentally type a password backwards.
- deleted 5y ago[deleted]
- williamdclt 5y agoI could imagine having the left arrow key accidentally pressed (or stuck), but that's pretty niche
- input_sh 5y agoThis is in no way an educated guess, but it could be something about dealing with right-to-left language support?
- p49k 5y agoFor a long time, in some browsers/OSes there was a bug (or perhaps an archaic feature that was accidentally triggered) where the cursor in an input could get stuck and cause all new characters to be inserted to the left; I'm assuming it's related to that.
- Jenk 5y agoNotably this was a bug on the input for _setting_ your password, so if you think you've set Password123, you might have actually set 321drowassP, so even after fixing the bug it would still bite many users.
- Aachen 5y agoThis is the first I've heard of it, and as a Linux user I feel like it's the kind of thing I'd either know about or experienced first-hand. What kind of system would do that? And "for a long time", like, you can't ever login anywhere, it's kind of obvious and breaking functionality badly, how can this exist for more than a single release if at all?
- p49k 5y agoTo be clear, it’s intermittent. Perhaps one in 500 times an input is focused, it exhibits this behavior. I have experienced this so many times over my life with so many different hardware/software configurations, and I have to assume others have as well. It hasn’t happened in years but could explain why the “fix” described in the parent post was implemented.
- foepys 5y agoThis doesn't always work by the way. When you venture outside of ASCII, it's quite often uppercase(lowercase(x)) ≠ uppercase(x) and/or the other way around. The German letter ß gets uppercased to SS instead of ẞ by most libraries in a neutral/generic culture. ẞ on the other hand gets lowercased to ß. This happens because there wasn't an official ẞ in German until recently but the uppercasing/lowercasing standard was already written for ß.
- McMiniBurger 5y agobut don't password fields only recognize ascii? it seems i just can't type korean to password fields
- jeroenhd 5y agoMost competent websites I know accept general UTF8 characters like emoji perfectly fine. There are a lot of crappier websites that don't even have proper unicode support for usernames or profile descriptions out there, though, so your mileage may vary. As far as I know, there's nothing preventing a password field from containing any valid unicode string. The problem may be IME support or servers stuck in ASCII, but the textbox itself will just work.
- tsimionescu 5y agoEven surprisingly big names are surprisingly bad at this. Don't know recently, but Hotmail/Outlook used to have a rule of only using letters, numbers, and a handful of symbols, also limiting you to at most 16 characters or something. You couldn't even type a space!
- jeroenhd 5y agoHonestly, that stuff only proves that big name websites aren't necessarily competent. PayPal used to let you register an account with a password longer than the maximum password length used in the authentication code, for example, essentially allowing you to set a password you could never use with your account again. Being worth billions doesn't mean you've got all the basics down, it just means you've tricked many people into giving you their business. Even good websites that will accept any valid password string will sometimes cut off the last part of a long password because their hashing algorithm throws that data away. Bcrypt, for example, supports a maximum input length between 50 and 72 bytes, depending on the library you use to hash your passwords. That's bytes, not characters! More primitive systems used to have problems with non-alfanumerical passwords and once those algorithms have been unleashed upon the unsuspecting public, you need to support them in your login flow for years to come.
- darkhorn 5y agoThis is very English alphabet centric view. > only costs a single bit What if the password includes İ. The swapcase would be i. And the again its swapcase would be İ. And swapcase of I is ı. And swapcase of ı is I. Right? Well, it should depend on what language you use. Or should it? Also I think this was in Github; they ask uppercase and I enter Ğ and Github doesn't recognize it as uppercase letter.
- vfistri2 5y agodoesn't that mean they are storing plain text/reversible encrypted passwords? I have gmail and facebook accounts way before mobile was invented, if they've added that feature for mobile imho it means password was stored in plain text or with 2 way encryption
- drchickensalad 5y agoYou just store multiple hashes, and don't support it retroactively
- cryptofistMonk 5y agoYou don't even need to store multiple hashes, just check both versions of the submitted password against the one stored hash
- rfw300 5y agoNot at all, you just compute hashes for all of the acceptable forms of the password up front and store those hashes.
- cryptofistMonk 5y agoNot necessarily, it could simply be checking both versions of the password against the hash
- csnweb 5y agoNo, you can just change the password you receive and test several versions against the hash. So you stored your password with a lower first character in 2011 and now you enter it with a captilized first character. They can just hash it like you sent it to them but on top they can also first lowercase it and then hash it and that will then match the hash from the password you used when signing up.
- kaba0 5y agoNo, they most definitely just transform the text to all the acceptable versions, do the encryption and compare it with the encrypted stored one.
- martincmartin 5y agoI just want a phone number input box that will strip dashes for me. Many go to the effort of having an error message pop up that says "no dashes or parentheses allowed." So they went to the effort of writing special case code to notice and handle this ... by giving instructions to the person, instead of the computer.
- jpswade 5y agoThere's a school of thought in interface design that you shouldn't change what the user inputs, as it can be a jarring experience for regular users.
- LudwigNagasena 5y agoWhat’s jarring is that a field for phone numbers can’t parse dashes and spaces.
- martincmartin 5y agoBut the changing isn't user visible. To the user, the phone number is the string "(416) 555-1270". If you want to store it differently in your database go ahead. But to the user, the phone number has dashes. In fact, on my phone, when I type in just the digits, my phone inserts the parens and dashes. Presumably, users consider this easier to read, and dare I say, more canonical. So, many applications can't handle phone number input in the exact form they display it to the user.
- lelandfe 5y ago> I just want a phone number input box that will strip dashes for me. So you don't actually want the input box to strip dashes, right? It sounds like you want more sites to accept dashes.
- martincmartin 5y agoVery true. I wasn't very precise in my original comment.
- chris_l 5y agoSo they hash both versions of the password? Or how does this work?
- cotillion 5y agoThey probably just do two password checks.
- chris_l 5y agoThat's what I meant... hash both versions when logging in.
- OJFord 5y agoAh, it's a bit ambiguous though: not GP, but I read you as meaning do they store both versions' hash and check against either. Actually I realise GP is equally ambiguous. But I read that as (and my own assumption would be) frontend retries with the variation, backend verifies against the same only one stored.
- mnahkies 5y agoYeah we did it this way on an app I worked on in the past, try the verbatim input and then a couple of minor variations in casing if it didn't work. I've also found that for email fields you need to be careful to normalize the input (trim, casing) as safari had a habit of autocorrecting the first character to be a capital
- alin23 5y agoIt’s very nice that you do that! I find apps that don’t trim the whitespace for the email field so annoying in terms of UX. I usually use a Text Replacement shortcut to fill in my emails (e.g. “gml” fills in my GMail address, “cld” my iCloud address etc.) and that always inserts a space after the email and I have to manually fiddle with the cursor to delete it.
- Levitz 5y ago
- sammy2244 5y agoHijacking this thread to say Batlle.net/Blizzard passwords are case insensitive altogether
- w7 5y agoThis is because blizzard uses a cryptographically secure, non-disclosing, challenge and response protocol called SRP6 to authenticate users, rather than a password hash database. The password is not stored server side, but the client is able to prove it knew the original password based on its relation to a private/public key pair generated as part of the authentication scheme.
- deleted 5y ago[deleted]
- siegfried-en 5y agoThis has been like this for at least a couple years now. Struck me as bit odd in the beginning but it doesn't really improve the chances of brute forcing too much (which is hard on Google login anyways). And potentially saves so much time and server resources
- michaelmior 5y agoWhy do you suggest it saves time and server resources? Because people are likely to miscaptialize the first character of their password?
- StevenWaterman 5y agoOn mobile, the keyboard will auto-capitalise the first letter sometimes
- sigmaprimus 5y agoI have recieved a few notifications of login attempts from Windows 8 phones. I wonder if there is other security allowances for these devices making them the ideal platform for launching attacks. PS. You can see this for yourself, just leave a negative review for Staples Canada on google and your account will be attacked from somewhere inside Vietnam via windows phone.
- dhruvrrp 5y agoThis reminds me of an intern project in my friends company where they stored all hashes a few hamming distance from the password, so even with typos you would get logged in. Iirc it had a cool demo, but was never used in production.
- thaumasiotes 5y ago> they stored all hashes a few hamming distance from the password This doesn't scale well with password length.
- ourmandave 5y agoSo many sites require "at least one uppercase letter" and a "special character" and people use the same password for everything. I wonder how many passwords have the first letter uppercase because that's easy to remember. And then a trailing "!" because it's the first one you see. Not that I would ever do that.
- frosted-flakes 5y agoI just stick an "A!" on the end of my otherwise complex password to satisfy these stupid rules. The worst is when they don't even allow spaces.
- cdubzzz 5y agoI recently had to (for work) create an account on website with a password “strength” indicator and the following limitations: - At least one upper case - At least one lower case - At least one number, but not as the first character and no two numbers in a row - No special characters - Maximum characters: 8 There was a minimum too but I can’t recall what it was. Hopefully 7 for maximum security. My randomly generated password from my password manager got a “medium” on their strength scale.
- JeffRosenberg 5y agoI recently had to create accounts for work benefits at TWO different sites that had user name complexity requirements, and actually rated the strength of my user name! That's something I had never seen before, and it seems pretty misguided. The worst of these also had a 20 character password limit (at least it wasn't 8!), along with several of these nonsense requirements that limit repeated characters. I couldn't manage to generate a password they would accept. Eventually I realized that not only did they allow only certain specific special characters, but their password length validation was wrong and would only accept 19 characters because they were testing for <= 20.
- Ginden 5y agoThe worst rule that I have seen was that you can't have the same character next to each other. So "Pasword1234#" was "strong" password, but "ha_ivrkbs(i5HzJzee%Ii3jsk#7jaot" was considered weak - note "ee" in the middle of string.
- johnnyApplePRNG 5y agoProbably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my logic "aBCD" should work. But if your password was "abcd", then "Abcd" should not work.
- deleted 5y ago[deleted]
- st3fan 5y agoThat is a text field feature, not a keyboard feature. Google controls all the text fields for gmail. Both in the web version and in their native apps.
- johnnyApplePRNG 5y agoIt is indeed [0], but there's about 14% of the browser world who can't benefit from it yet [1]. [0] https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/autocapitalize https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att... [1] https://caniuse.com/mdn-api_htmlelement_autocapitalize https://caniuse.com/mdn-api_htmlelement_autocapitalize
- philo23 5y agoRealistically this is only going to affect people on mobile devices, which looks like it'd bring that down to about 6.5%
- johnnyApplePRNG 5y agoWith over 1.5 billion active users... 6.5% is still a very large number of people! Also.. not sure what safari/iOS did in their early years with keyboard password entry capitalization... but if they did auto capitalize... since Apple is so good at saving profile info across new installs/os updates... I imagine there would be a large portion of old apple users with perma-capitalized passwords out there as well.
- Gigachad 5y agoThis doesn’t seem particularly alarming. Googles account security is above and beyond the rest of the web right now. I doubt a single attack has been made realistic by this feature.
- vort3 5y agoTheir account security is so good, I'm not able to log in to my own account even when I know the exact username/password, and I hate it.
- Gigachad 5y agoFor what reason? Lost 2FA access? Triggered some kind of attack detection system?
- vort3 5y agoDue to my work I travel a lot (and by that I mean that I can be in new city every day). I don't want to give google my phone number or my other email, so my account is not tied to anything, the only factor is the password. Turns out if you try to log in from new device from new location (I guess your account is tied to IP from which it was created), just password alone isn't enough to log in. And there's no alternative way to prove that account actually belongs to me. I understand that most services try to provide you with good security, but I hate it when everything is overcomplicated and everyone tells me what to do. No, I don't want to give you my phone number. Yes, I know I won't be able to recover my password, I don't need that. Yes, I actually want my password to be this long. No, I don't want you to block login attempts from new locations. Believe it or not, people do travel and want to log in from more than 1 city. It's none of your business if I want to give my password to my friend and let him login, just stop this please. Let me choose whatever password I want without any backup emails, phone numbers, and let everyone who knows the password log in. Is it too much to ask? Why is it even allowed to let users create accounts without providing a phone number, but then not letting those same users to log in because their accounts are not tied to any phone number? How does it make any sense?
- CGamesPlay 5y agoIt's because early mobile keyboards would default to automatically capitalize the first character at the start of an input, and apparently did this behavior to password fields as well. Facebook has also had this password behavior for at least 10 years.
- josalhor 5y agoThis is a well-understood feature. Facebook does the same thing[0]. Quote: Facebook actually accepts three forms of your password: * Your original password. * Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word. * Your original password with the case reversed, for those with a caps lock key on. [0]: https://www.zdnet.com/article/facebook-passwords-are-not-case-sensitive-update/ https://www.zdnet.com/article/facebook-passwords-are-not-cas...
- jhgb 5y agoIt seems to me that the third case could easily be subsumed by first transforming the text by inserting a "change case" token in front of any character with a different case than the previous character. In such a representation the original text and the "caps-locked" text are indistinguishable.
- attheicearcade 5y agoAnd then when management decides they don't want this feature anymore, you're stuck with it.
- qwerty1793 5y agoThat may have been the case in 2011 when that article was written, but I have just tested this now and my facebook does not accept my password with the case reversed by having the caps lock key on.
- josalhor 5y agoThey may have changed it, but it was certainly working in 2017: https://news.ycombinator.com/item?id=13426544 https://news.ycombinator.com/item?id=13426544
- scoopr 5y agoiirc, on mac capslock works like (caps OR shift) and on windows its (caps XOR shift), that is, on mac, with capslock on its always cap, but on windows its just a toggle.
- deleted 5y ago[deleted]
- mindvirus 5y agoThat's a nice feature. It got me thinking - imagine wanting to let users log in with a single character typo in their password, could you do this without storing hashes of all edit distance 1 passwords?
- csnweb 5y agoYou could brute force all possible changes but that could take quite a while for longer passwords, you probably don't want to do that in production on every login.
- kaba0 5y agoYou could do the reverse and try every typo of the input in plain text on the username’s encrypted password.
- tzs 5y ago(I just work up and my brain is not yet fully functional, so what follows is probably totally stupid) Notation: "||" means string concatenation. Let password P = P1 || P2, where len(P1) + len(P2) = len(P) and |len(P1) - len(P2)| <= 1. Let H1 = hash(P1), H2 = hash(P2), where hash() is a cryptographic hash function that produces at least as many bits as the longest allowed password and satisfies whatever slowness and memory use requirements that you have for a password hash. To store a password, store P ⊕ H1 and P ⊕ H2. To check a password candidate C received at login, let C = C1 || C2 using the same splitting rule as used for P above, and compute C ⊕ hash(C1) and C ⊕ hash(C2). A login is successful if either P ⊕ H1 or P ⊕ H2 is within edit distance 1 of either C ⊕ hash(C1) or C ⊕ hash(C2). (I've omitted salt from the above for simplicity. Replace the hash with a salted hash if you want salt).
- tracatra 5y agoI was briefly an intern in a company in which the only part of the password that was checked were the first four characters. I don'y know whether it was due to using PIN numbers in the past or they just wanted people to feel safe but not call IT constantly about the account not working... I wonder whether they're still doing that...
- DonHopkins 5y agoI posted this earlier: https://news.ycombinator.com/item?id=21862160 https://news.ycombinator.com/item?id=21862160 There's a much more evil prank than that: A user was having a really bizarre problem: They could log in when they were sitting down in a seat in front of the keyboard, but when they were standing in front of the keyboard, their password didn't work! The problem happened every time, so they called for support, who finally figured it out after watching them demonstrate the problem many times: It turned out that some joker had rearranged the numbers keys on the keyboard, so they were ordered "0123456789" instead of "1234567890". And the user's password had a digit in it. When the user was sitting down comfortably in front of the keyboard, they looked at the screen while they touch-typed their password, and were able to log in. But when they were standing in front of the computer, they looked at the keyboard and pressed the numbers they saw, which were wrong!
- twistedpair 5y agoEver call Fidelity phone support and hear "enter your password on the keypad"? That means collapsing ~62 chars into 10 char options, a massive space reduction. Then there's the fact that many banking sites (BofA, IIRC) only used the first 8 char of your password anyway.
- robbmorganf 5y agoYikes, I didn't know that. Seems like I need to make my fidelity password 6 times longer. Does this also mean they probably store passwords in clear text? Because there's no way to normalize the numeric passwords back to letters and symbols.
- avidiax 5y agoIt doesn't mean that they store in cleartext, but they may as well. They can generate the phone password on the client side and send both passwords to be salted, hashed, and stored separately. That much seems OK. But the salted+hashed phone password is incredibly weak. It can be brute forced readily unless it is very long. From the brute forced phone password, the regular password can be brute forced as well, since the digits of the phone password tremendously constrain the characters of the regular password. It's very much like the Hollywood hacking where the hackers progressively lock digits of your password and eventually discover the whole thing.
- bink 5y agoI'm not sure if this is still true, but at one point you could even use the all numeric version on their website.
- ufmace 5y agoThis doesn't bother me that much, but what really grinds my gears is how many sites won't let you log in with the correct username and password. I don't care enough about the account to want to set up 2FA, and I'd rather preserve a bit more privacy by not sharing my real phone number or another email address. Some sites seem to insist, and I think it's more about advertising and anti-spam than actual security. Yahoo seems to be big on this these days. I had an old Yahoo account that I don't use much, but every time I try to log in, they seem to change around exactly what pseudo-2FA they want. Now they won't even let me try to type my password. Good grief, guess I'll just write off that account.
- Terretta 5y agoOr the ones that had silently truncated your password (e.g. JetBlue truncating to length 10) in every input and login box so the stored password isn’t what you think it is. Then one day stopped doing truncating … but only in some boxes, not others.
- revicon 5y agoI think there have been so many password breaches that most sites feel that passwords alone are insufficient for security purposes. Most users reuse passwords and if sites don't enforce 2FA they open themselves up to batch account compromises via script kiddies trying all combos found in the username/password dumps found on various haxor forums. This is especially true for sites that provide email accounts for users on sites like yahoo which are the 2FA for many other sites a user has accounts on. Gaining access to a yahoo user's email account could allow someone to reset all their passwords on any 3rd account they used that email address for when they signed up.
- grepfru_it 5y agoFor a very long time, Chase bank public websites only accepted the first 8 characters of your password. Anything else was silently dropped. If you used Chase for any loans, credit cards, or banking, you were forced to change your password around 2016ish, this is when they finally resolved this problem. Why? Mainframes. Bank of America, internally, required you to have two passwords, a Windows and a UNIX password. The UNIX password was only 8 characters due to , you guessed it, mainframes. I don't know if this was ever resolved.
- mrb 5y agoAs an ex-Googler in the Information Security Engineering team who has looked at our implementation of password authentication, I confirm this is a feature, not a bug. (Some old mobile devices auto-capitalize of the first character typed in a text field.) That said, I can't remember of the top of my head if we just ignored the case altogether or if the logic was more restrictive (eg. if first char is uppercase, also allow its lowercase version.) Last time I looked at the code was 6 years ago. Pretty sure this is a detail documented somewhere public-facing
- danschumann 5y agoWhen the login page helps you brute force your own account... What if.. in the RARE case, a hacker guessed wrong, but was helped by google to get into your account?
- adultSwim 5y agoI cannot wait until we are rid of passwords. I'm sick of begging my computer to let me use it. Let's just use 2FA and cut out the password.
- kseifried 5y agoThis is a classic case of http://spellchecksquatting.com/ http://spellchecksquatting.com/