6 ms·
Facebook does sort of the same thing: http://www.zdnet.com/blog/facebook/facebook-passwords-are-not-case-sensitive-update/3612 http://www.zdnet.com/blog/facebo
by karlshea 14y ago
Facebook does sort of the same thing:
http://www.zdnet.com/blog/facebook/facebook-passwords-are-not-case-sensitive-update/3612 http://www.zdnet.com/blog/facebook/facebook-passwords-are-no...
Yes, it's possibly less secure. But for both Facebook and all of the Blizzard games there are other options if you are concerned.
- chetan51 14y agoMakes sense.
- tylermenezes 14y agoFacebook's is a little better - you can't disregard case entirely. Blizzard just cut the search space by a lot. Then again, it would be pretty difficult to brute force a password in Battle.net, to be honest. I'm assuming they'd lock out the account after just a handful of tries.
- elithrar 14y ago> Then again, it would be pretty difficult to brute force a password in Battle.net, to be honest. I'm assuming they'd lock out the account after just a handful of tries. Correct. ~5 failed attempts forces you to use your authenticator code, and if you don't have one, you need to use their reset form and a captcha.
- chaud 14y agoThe game clients will lock an account out after ~20 or 30 attempts and I assume the website will do the same. No one is going to brute force an account.
- duaneb 14y agoYea, until someone steals their hashes.
- TWAndrews 14y agoAll your hashes are belong to us
- willvarfar 14y agoBut there are plenty of password stretching algorithms like bcrypt. A very reduced keyspace, but we all knew people's password choices are poor anyway right?
- rmc 14y agoWhich is easier said than done. Honestly if someone can do that, you have bigger problems to worry about.
- nostromo 14y agoRelated, but different in an important way. If your password is aBc, you can log in to Facebook using aBc (original), AbC (windows caps lock), and ABc (first cap) only. For a regular password, this is just slightly less secure. Being case insensitive entirely is quite a bit less secure (abc, abC, aBc, aBC, Abc, AbC, ABc, ABC).
- Twisol 14y agoI wonder how they do that. If they store the password hashed, wouldn't they have to normalize it two/three different ways and store a hash for each?
- tonyedgecombe 14y agoOr perhaps they aren't storing it hashed ...
- scg 14y agoNo, they only need to store a single hashed password. For authentication they can just try out the other 2 transformations above and see if any of them matches what's on file.
- dewiz 14y agothereis no multiple transformations, they just lcase every pwd input before hashing. the stored hash is a the hash of the lcase pwd.
- deleted 14y ago[deleted]
- duaneb 14y agoFacebook doesn't restrict length of password, though - at least not to the same extent.
- woadwarrior01 14y agoThis story was on HN (albeit from a different source) a couple of weeks ago. https://news.ycombinator.com/item?id=3920918 https://news.ycombinator.com/item?id=3920918