4 ms·
> Are there hash algorithms which are upper and lower case agnostic? Or should I assume that they store a hash of both the original password form and a lower ca
by alexkus 13y ago
> Are there hash algorithms which are upper and lower case agnostic? Or should I assume that they store a hash of both the original password form and a lower cased version?
The hash may not be case insensitive, but I've seen plenty of code in and around password handling code that forces all letters to be lower/upper case prior to hashing.
(There's rarely ever any explanation as to why, nor anyone still around who admits to writing that code.)
- kencausey 13y agoOf course, I don't know why I didn't simply assume that whenever the password is handled it is lower cased. Confession: I worked on a website where this was done both for usernames and passwords (about a decade ago). The justification at the time was that the users could not be expected to understand the difference between upper and lower case letters (or something to that effect). I suppose that justification continues to play well.
- bmelton 13y agoI usually lowercase usernames before storing them in the DB, which saves a lot of mental effort later on -- specifically, where usernames are used as keys (like "website.com/users/username/"), but I've always chosen to preserve case on passwords as a security measure (being able to tell somebody your password without actually telling them your password is valuable, if only in extremely rare situations). It's odd to me that someone like a bank would choose the other way.