5 ms·

Ignoring the security implications for a moment, this is a very nice UX enhancement, I do imagine that it would eliminate the vast majority of the invalid passw

Ignoring the security implications for a moment, this is a very nice UX enhancement, I do imagine that it would eliminate the vast majority of the invalid password attempts thus making people's experience much better. Now, the question is, just how much security are you losing by allowing this? Assuming the passwords are stored correctly my guess would be that passwords that are considered secure already would only be marginally less secure because of this, however non secure passwords (common ones) are a hell of a lot less secure but only in a relative context, they're still just as insecure as the original insecure password. I'm not sure I articulated this properly so if I didn't let me know.

TazeTSchnitzel 14y ago
I'd say half the possible combinations are gone, minus one. I don't think that's too bad. And I agree it's a great UX enhancement. I've been frustrated many times entering usernames and passwords with my phone defaulting to capitalising the first letter. Now if only they'd strip # from the end of posts again (on UK keyboards at least it's right next to the return key, so many posts end up looking like this#
- kijin 14y ago
  > half the possible combinations are gone, minus one So, slightly more than one bit of entropy lost?
  - deleted 14y ago
    [deleted]
peeters 14y ago
Most insecure passwords don't use mixed case anyhow (dictionary lower-case words), so I fail to see how this is making them much less secure. In fact in terms of relative impact, this has a much greater impact on "secure" passwords (in this case, I mean ones that are a random jumbled set of mixed case letters and numbers). That's only really because it significantly reduces the range of the first character.
mistercow 14y ago
I would also argue that the security implications of this are largely positive. It removes less than two bits of entropy even from a randomly generated password, but it means that users reset their passwords less often, and I would guess that when users reset a "forgotten" password, they usually choose something weaker (and thus more memorable).
- deleted 14y ago
  [deleted]
27182818284 14y ago
Does Facebook ask to prove yourself with another form of auth if you're logging in from an unusual place? I want to say it does, but I can't recall for sure.

TazeTSchnitzel 14y ago

I'd say half the possible combinations are gone, minus one. I don't think that's too bad. And I agree it's a great UX enhancement. I've been frustrated many times entering usernames and passwords with my phone defaulting to capitalising the first letter. Now if only they'd strip # from the end of posts again (on UK keyboards at least it's right next to the return key, so many posts end up looking like this#

kijin 14y ago
> half the possible combinations are gone, minus one So, slightly more than one bit of entropy lost?
- deleted 14y ago
  [deleted]

peeters 14y ago

Most insecure passwords don't use mixed case anyhow (dictionary lower-case words), so I fail to see how this is making them much less secure. In fact in terms of relative impact, this has a much greater impact on "secure" passwords (in this case, I mean ones that are a random jumbled set of mixed case letters and numbers). That's only really because it significantly reduces the range of the first character.

mistercow 14y ago

I would also argue that the security implications of this are largely positive. It removes less than two bits of entropy even from a randomly generated password, but it means that users reset their passwords less often, and I would guess that when users reset a "forgotten" password, they usually choose something weaker (and thus more memorable).

deleted 14y ago
[deleted]

27182818284 14y ago

Does Facebook ask to prove yourself with another form of auth if you're logging in from an unusual place? I want to say it does, but I can't recall for sure.