10 ms·

This is a well-understood feature. Facebook does the same thing[0]. Quote: Facebook actually accepts three forms of your password: * Your original password.

This is a well-understood feature. Facebook does the same thing[0]. Quote: Facebook actually accepts three forms of your password: * Your original password. * Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word. * Your original password with the case reversed, for those with a caps lock key on. [0]: https://www.zdnet.com/article/facebook-passwords-are-not-case-sensitive-update/ https://www.zdnet.com/article/facebook-passwords-are-not-cas...

jhgb 5y ago
It seems to me that the third case could easily be subsumed by first transforming the text by inserting a "change case" token in front of any character with a different case than the previous character. In such a representation the original text and the "caps-locked" text are indistinguishable.
- attheicearcade 5y ago
  And then when management decides they don't want this feature anymore, you're stuck with it.
qwerty1793 5y ago
That may have been the case in 2011 when that article was written, but I have just tested this now and my facebook does not accept my password with the case reversed by having the caps lock key on.
- josalhor 5y ago
  They may have changed it, but it was certainly working in 2017: https://news.ycombinator.com/item?id=13426544 https://news.ycombinator.com/item?id=13426544
- scoopr 5y ago
  iirc, on mac capslock works like (caps OR shift) and on windows its (caps XOR shift), that is, on mac, with capslock on its always cap, but on windows its just a toggle.
hahajk 5y ago
Is this implemented by Facebook holding 3 hashes of your password? It doesn’t save your actual password clear text (or encrypted clear text), does it? A related question: when a password system tells me I need to change my password, and it has to differ by 3 letters from my previous password, is that system storing my password text rather than the hash of the password? Is that safe?
- joaomacp 5y ago
  It can all be done client-side: the client can try (un)capitalizing the letters after the original password fails
  - freemint 5y ago
    This would be bad for rate limiting though.
    - jacurtis 5y ago
      Note that the client would only need to do this on a failed attempt. So if i typed "Password" on mobile. The client would first send the request as "Password". If that succeeds, then no worries. If it fails, then the client could send a second request by reversing the case of the first letter. In this case, it would send a second request for "password". At most, it is 2 login requests per password. Many other commenters here are incorrectly stating that 3 requests would be necessary, but this is untrue. A letter can only have 2 possible cases (uppercase or lowercase). So the client sends the originally typed one, and if that fails, then it flips the case of that first letter. That is the only alternative. There is not a third option. A well-built login form would restrict users after 3-5 login attempts anyway and require a password-reset process. So that is 6-10 client requests to the backend (n * 2). That shouldn't be hitting any sort of rate limit.
      - ipaddr 5y ago
        Why would you need the client to send the request over and over when you control the backend?
snthd 5y ago
Facebook doesn't even require you get your login email address 100% right.
- farazzz 5y ago
  Yeah, I noticed this since I have two accounts with emails that are one character apart, and I was unable to log into one of my accounts because of this feature…
- spicybright 5y ago
  Really?
  - caymanjim 5y ago
    They might do the same stupid thing Gmail does, and ignore certain characters. My Gmail is "first.m.last@gmail.com", but I constantly get mail from idiots who don't know their own email address, and use my "firstmlast@gmail.com" to sign up for things. This problem would go away entirely if Gmail didn't do this. Facebook might do similar things to make it "easier" to login, even though there are security implications.
    - dado3212 5y ago
      That’s by design though, the .‘s are optional. You can add more even. Also plus routing: first.m.last+whatever@gmail.com also routes to the same email.
      - lostlogin 5y ago
        Well, I’ve learned something, thanks. “ Gmail doesn't recognize periods as characters in addresses -- we just ignore them. For example, you could tell people your address was hikingfan@gmail.com, hiking.fan@gmail.com or hi.kin.g.fan@gmail.com. (We understand that there has been some confusion about this in the past, but to settle it once and for all, you can indeed receive mail at all the variations with dots.)” https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html?m=1 https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...

jhgb 5y ago

It seems to me that the third case could easily be subsumed by first transforming the text by inserting a "change case" token in front of any character with a different case than the previous character. In such a representation the original text and the "caps-locked" text are indistinguishable.

attheicearcade 5y ago
And then when management decides they don't want this feature anymore, you're stuck with it.

qwerty1793 5y ago

That may have been the case in 2011 when that article was written, but I have just tested this now and my facebook does not accept my password with the case reversed by having the caps lock key on.

josalhor 5y ago
They may have changed it, but it was certainly working in 2017: https://news.ycombinator.com/item?id=13426544 https://news.ycombinator.com/item?id=13426544
scoopr 5y ago
iirc, on mac capslock works like (caps OR shift) and on windows its (caps XOR shift), that is, on mac, with capslock on its always cap, but on windows its just a toggle.

hahajk 5y ago

Is this implemented by Facebook holding 3 hashes of your password? It doesn’t save your actual password clear text (or encrypted clear text), does it? A related question: when a password system tells me I need to change my password, and it has to differ by 3 letters from my previous password, is that system storing my password text rather than the hash of the password? Is that safe?

joaomacp 5y ago
It can all be done client-side: the client can try (un)capitalizing the letters after the original password fails
- freemint 5y ago
  This would be bad for rate limiting though.
  - jacurtis 5y ago
    Note that the client would only need to do this on a failed attempt. So if i typed "Password" on mobile. The client would first send the request as "Password". If that succeeds, then no worries. If it fails, then the client could send a second request by reversing the case of the first letter. In this case, it would send a second request for "password". At most, it is 2 login requests per password. Many other commenters here are incorrectly stating that 3 requests would be necessary, but this is untrue. A letter can only have 2 possible cases (uppercase or lowercase). So the client sends the originally typed one, and if that fails, then it flips the case of that first letter. That is the only alternative. There is not a third option. A well-built login form would restrict users after 3-5 login attempts anyway and require a password-reset process. So that is 6-10 client requests to the backend (n * 2). That shouldn't be hitting any sort of rate limit.
    - ipaddr 5y ago
      Why would you need the client to send the request over and over when you control the backend?

snthd 5y ago

Facebook doesn't even require you get your login email address 100% right.

farazzz 5y ago
Yeah, I noticed this since I have two accounts with emails that are one character apart, and I was unable to log into one of my accounts because of this feature…
spicybright 5y ago
Really?
- caymanjim 5y ago
  They might do the same stupid thing Gmail does, and ignore certain characters. My Gmail is "first.m.last@gmail.com", but I constantly get mail from idiots who don't know their own email address, and use my "firstmlast@gmail.com" to sign up for things. This problem would go away entirely if Gmail didn't do this. Facebook might do similar things to make it "easier" to login, even though there are security implications.
  - dado3212 5y ago
    That’s by design though, the .‘s are optional. You can add more even. Also plus routing: first.m.last+whatever@gmail.com also routes to the same email.
    - lostlogin 5y ago
      Well, I’ve learned something, thanks. “ Gmail doesn't recognize periods as characters in addresses -- we just ignore them. For example, you could tell people your address was hikingfan@gmail.com, hiking.fan@gmail.com or hi.kin.g.fan@gmail.com. (We understand that there has been some confusion about this in the past, but to settle it once and for all, you can indeed receive mail at all the variations with dots.)” https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html?m=1 https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...