4 ms·

I tried entering mis-spellings of my current facebook password, and facebook gave me nothing other than telling me that it was incorrect. I'm pretty sure that s

I tried entering mis-spellings of my current facebook password, and facebook gave me nothing other than telling me that it was incorrect. I'm pretty sure that something as huge as FB wouldn't be storing passwords in plain-text. They definitely keep a hash of your previous (n=?) passwords, though.

moocowduckquack 13y ago
As far as I am aware if you have the caps lock on, it doesn't care, so caps inverted passwords still work. I'm not sure about other variations.
- tommoor 13y ago
  Of course, this doesn't require plain text storage of the password.
  - moocowduckquack 13y ago
    True, I was just pointing out that they do allow for some basic spelling errors.
    - Dylan16807 13y ago
      That doesn't count as a spelling error. It only adds one bit of entropy. What matters is if they have anything that lets you hit the wrong key.
- eloisius 13y ago
  That's a lot easier than telling you about minor typos in your password. You just store two hashes: one of the password and one of its inverted case.
  - Dylan16807 13y ago
    Why would you store two versions? Just hash the password you were given twice.
    - eloisius 13y ago
      That's what I said: hash both the password and it's case-inversion. Did you mean something else?
      - refucktoring 13y ago
        I think: hash the original version only, then when trying to log in, try both case-as-is and then flipped case
        eloisius 13y ago
        Ah. Duh.
  - deleted 13y ago
    [deleted]
- gte910h 13y ago
  Capslock, normal, and first letter capitalized (iphone mode)
refucktoring 13y ago
I was talking about this kind of message that I have seen now and again: http://2.bp.blogspot.com/-plZIT-fl38U/TmDPRms52ZI/AAAAAAAAAJw/xLR9vVJKhLI/s400/lol+xD.jpg http://2.bp.blogspot.com/-plZIT-fl38U/TmDPRms52ZI/AAAAAAAAAJ... Maybe the assumption that they're storing plaintext isn't that solid, perhaps they're hashing a few variations, or trying uppercase -> lowercase conversion at login time.

moocowduckquack 13y ago

As far as I am aware if you have the caps lock on, it doesn't care, so caps inverted passwords still work. I'm not sure about other variations.

tommoor 13y ago
Of course, this doesn't require plain text storage of the password.
- moocowduckquack 13y ago
  True, I was just pointing out that they do allow for some basic spelling errors.
  - Dylan16807 13y ago
    That doesn't count as a spelling error. It only adds one bit of entropy. What matters is if they have anything that lets you hit the wrong key.
eloisius 13y ago
That's a lot easier than telling you about minor typos in your password. You just store two hashes: one of the password and one of its inverted case.
- Dylan16807 13y ago
  Why would you store two versions? Just hash the password you were given twice.
  - eloisius 13y ago
    That's what I said: hash both the password and it's case-inversion. Did you mean something else?
    - refucktoring 13y ago
      I think: hash the original version only, then when trying to log in, try both case-as-is and then flipped case
      - eloisius 13y ago
        Ah. Duh.
- deleted 13y ago
  [deleted]
gte910h 13y ago
Capslock, normal, and first letter capitalized (iphone mode)

refucktoring 13y ago

I was talking about this kind of message that I have seen now and again: http://2.bp.blogspot.com/-plZIT-fl38U/TmDPRms52ZI/AAAAAAAAAJw/xLR9vVJKhLI/s400/lol+xD.jpg http://2.bp.blogspot.com/-plZIT-fl38U/TmDPRms52ZI/AAAAAAAAAJ... Maybe the assumption that they're storing plaintext isn't that solid, perhaps they're hashing a few variations, or trying uppercase -> lowercase conversion at login time.