4 ms·

While obviously Facebook will be storing this as hash(normal), hash(upper(normal)), and hash(lower(normal)), there's an interesting security benefit to storing

While obviously Facebook will be storing this as hash(normal), hash(upper(normal)), and hash(lower(normal)), there's an interesting security benefit to storing this in 3 columns, 'password1', 'password2' and 'password3'. The trick then is to randomise which hash gets stored in which column, i.e., password1 doesn't always correspond to hash(normal). The slight benefit of this being that if your database is leaked, then the attacker won't have his/her brute forcing job made easier by knowing that the password3 hash only contains lowercase alphanumeric characters. Edit: Apparently I suck at reading, it's not upper() and lower(). Woops :). Well, if any other sites do store upper() and lower() variations, I wonder if they use this idea?

losvedir 14y ago
It doesn't really provide much extra security. The factor of 3 slow-down it provides (having to check against three columns instead of one) is a small constant factor in the exponential task of brute-forcing.
rplnt 14y ago
I don't think they store three hashes though. Just the original one and they check against that. Only if that fails they proceed to verify other variants. There are only two - first letter uppercase (presumably for stupid phones) and inverse password (for caps lock on PCs). Both of these variants are reversible (i.e. you can revert the change to get original the password).