6 ms·

The author refers to "Handle common user mistakes" - by displaying a message "your caps lock is on". Personally I love the Facebook approach. Facebook just acc

The author refers to "Handle common user mistakes" - by displaying a message "your caps lock is on". Personally I love the Facebook approach. Facebook just accepts passwords with caps lock inverted, so you never have the problem in the first place. No need to display a message to the user. Link: http://www.zdnet.com/article/facebook-passwords-are-not-case-sensitive-update/ http://www.zdnet.com/article/facebook-passwords-are-not-case...

onion2k 12y ago
That's a good approach for usability but it does halve the keyspace for anyone attempting a brute force attack. It might not be appropriate everywhere.
- ZoFreX 12y ago
  Halving isn't really a big issue, when we're talking about something that normally talk about in exponents.
  - deleted 12y ago
    [deleted]
- lost_my_pwd 12y ago
  Not if, when caps lock is detected, the case is inverted before submitting.
  - Rinum 12y ago
    I purposefully create passwords with caps lock on, what then?
    - jephir 12y ago
      > I purposefully create passwords with caps lock on, what then? I think he means doing it on the server, i.e. checking the password as-is, if that doesn't work, then check it with case inverted.
    - mark-r 12y ago
      The best way to handle this is not to modify the entered password, or to reject it, but rather to just display the message. If it stands out enough you should notice it and make the corrective action yourself. In your case no corrective action would be necessary.
  - sp332 12y ago
    It does "halve" the keyspace, by removing one bit of entropy from your password. This is assuming you only use letters in your password and not numbers or other symbols not affected by capslock.
    - deleted 12y ago
      [deleted]
    - bnegreve 12y ago
      Well, it's a bit tricky. Two inverted passwords still have different hashs. From that perspective, two inverted passwords are not equivalent and therefore the entropy is not decreased. This is important because if you want to decode a hashed password using a rainbow table for example, you still have to hash the entire keyspace, not just half of it. Edit @sp332: Exactly. That was my point.
      - sp332 12y ago
        If you're doing an online attack, you can submit half as many passwords. I guess it's just as hard for an offline attack where you're cracking the database of hashes.
- RossM 12y ago
  It might be nice to do it client-side. var caps = null; passwordField.onkeypress = function(e) { if (caps !== false) { var s = String.fromCharCode(e.keyCode || e.which); caps = s.toUpperCase() == s && !e.shiftKey; } }; loginForm.onsubmit = function(e) { if (caps) { passwordField.value = invertCase(passwordField.value); } };
  - jenscow 12y ago
    What if they used caps-lock on purpose?
  - iso8859-1 12y ago
    No. Now you won't be able to log in if you signed up without JavaScript, or if you paste your password into the form field.
- ChrisLomont 12y ago
  It cuts it vastly more than in half. For n character alphabetic values, it reduces the keyspace from 52^n to 26^n.
  - stouset 12y ago
    That would be for case-insensitive matching, not matching on the case being inverted.
  - wzsddtc 12y ago
    For the 2 matching cases, it only reduces to 51^n
  - 0942v8653 12y ago
    That's only if it works with Mac-style caps lock.
nmc 12y ago
This "Facebook approach" almost certainly requires you to have, at least once, access to your users' non-hashed passwords. Which is widely regarded as bad security practice because your users' passwords can be compromised by an attacker getting read-only access. [EDIT] Well, good thing I used "almost", since I was wrong: of course, case-inverting the password and hashing the result could also be done client-side, silly me! [EDIT'] Answers pointing out that you always have access to non-hashed passwords, and I believe this is wrong. When the user submits their password, it SHOULD be hashed client-side and only the hash SHOULD be sent to you.
- maaarghk 12y ago
  You do have access to their non-hashed password. When they type it into your form and press enter. You just invert the case and check it against the hash again.
  - k__ 12y ago
    Why not including the lowercase into the hash-algorithm?
    - MartinCron 12y ago
      A hashing algorithm specifically for passwords that would hash to the same thing based on inverted caps lock or other deterministic user errors (white space at the edges, maybe)? That sounds like a great idea.
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- kibwen 12y ago
  Assuming that you run your own login service like Facebook does, you always have access to your user's passwords at least once because at some point you have to take the raw password and hash it. Facebook just creates two variations of the user's password and stores the hashes for all three of them.
epochwolf 12y ago
One snag, on Macs capslock works differently. It doesn't invert when you press shift. Shift + A with capslock on will still result in an uppercase A.
- shawabawa3 12y ago
  I'm not sure about facebook but I believe blizzard (WoW/Diablo/etc) ignores case completely in all passwords
  - pcnc 12y ago
    Blizzard also has an upper limit of 16 for the length of the password.
  - Glide 12y ago
    What? I know I have to put in upper case for my password for WoW. They also have authenticators before a lot of other people had them. And please use one if you do. Battle.net accounts are targets.
    - jimminy 12y ago
      >What? I know I have to put in upper case for my password for WoW You don't have to do that, my password has capitals, but after I found out the shift the alphas to only one case I stopped typing the caps.
    - d_k_f 12y ago
      Unless they changed their entire auth mechanism, it's definitely case insensitive. IIRC, the client encrypts the password using some variant of SRP6 plus some additional magic, but the last time I dabbled in wow emulation was quite some time ago. EDIT Here's a link to a moderator confirmation: http://eu.battle.net/wow/en/forum/topic/2679778775#3 http://eu.battle.net/wow/en/forum/topic/2679778775#3
Strilanc 12y ago
Giving the attacker two ciphertexts, where their plaintexts are related by a simple function, sounds like the sort of thing that breaks cryptosystems. So I hope they're canonicalizing the password casing instead of storing the hash of both possibilities.
- jamessb 12y ago
  Why would they need to store the hash of both possibilities? They can simply invert the case of what the user types before hashing it - ie. compare both hash(enteredPassword) and hash(invertCase(enteredPassword)) to the hash in the database and see if either match.
  - jimktrains2 12y ago
    They could also just ignore case: hash(upper(password)) so there is only ever one hash (that happens to map to multiple input passwords) instead of multiple hashes relating to a single password each.
    - quakkels 12y ago
      I suspect that Facebook still wants to know that some letters have a different case than other letters. If They just converted all letters to uppercase then that information would be lost.
      - wlesieutre 12y ago
        Do you know how they handle caps lock on Macs then? When caps lock is on, it types in caps even with shift.
        iso8859-1 12y ago
        Who says they can't check 3 times? Original, caps inverted and uppercase? This would make sense. You could even make it try neighboring keys on common key layouts. If the hash has enough bits of security then good passwords will still not break.

onion2k 12y ago

That's a good approach for usability but it does halve the keyspace for anyone attempting a brute force attack. It might not be appropriate everywhere.

ZoFreX 12y ago
Halving isn't really a big issue, when we're talking about something that normally talk about in exponents.
- deleted 12y ago
  [deleted]
lost_my_pwd 12y ago
Not if, when caps lock is detected, the case is inverted before submitting.
- Rinum 12y ago
  I purposefully create passwords with caps lock on, what then?
  - jephir 12y ago
    > I purposefully create passwords with caps lock on, what then? I think he means doing it on the server, i.e. checking the password as-is, if that doesn't work, then check it with case inverted.
  - mark-r 12y ago
    The best way to handle this is not to modify the entered password, or to reject it, but rather to just display the message. If it stands out enough you should notice it and make the corrective action yourself. In your case no corrective action would be necessary.
- sp332 12y ago
  It does "halve" the keyspace, by removing one bit of entropy from your password. This is assuming you only use letters in your password and not numbers or other symbols not affected by capslock.
  - deleted 12y ago
    [deleted]
  - bnegreve 12y ago
    Well, it's a bit tricky. Two inverted passwords still have different hashs. From that perspective, two inverted passwords are not equivalent and therefore the entropy is not decreased. This is important because if you want to decode a hashed password using a rainbow table for example, you still have to hash the entire keyspace, not just half of it. Edit @sp332: Exactly. That was my point.
    - sp332 12y ago
      If you're doing an online attack, you can submit half as many passwords. I guess it's just as hard for an offline attack where you're cracking the database of hashes.
RossM 12y ago
It might be nice to do it client-side. var caps = null; passwordField.onkeypress = function(e) { if (caps !== false) { var s = String.fromCharCode(e.keyCode || e.which); caps = s.toUpperCase() == s && !e.shiftKey; } }; loginForm.onsubmit = function(e) { if (caps) { passwordField.value = invertCase(passwordField.value); } };
- jenscow 12y ago
  What if they used caps-lock on purpose?
- iso8859-1 12y ago
  No. Now you won't be able to log in if you signed up without JavaScript, or if you paste your password into the form field.
ChrisLomont 12y ago
It cuts it vastly more than in half. For n character alphabetic values, it reduces the keyspace from 52^n to 26^n.
- stouset 12y ago
  That would be for case-insensitive matching, not matching on the case being inverted.
- wzsddtc 12y ago
  For the 2 matching cases, it only reduces to 51^n
- 0942v8653 12y ago
  That's only if it works with Mac-style caps lock.

nmc 12y ago

This "Facebook approach" almost certainly requires you to have, at least once, access to your users' non-hashed passwords. Which is widely regarded as bad security practice because your users' passwords can be compromised by an attacker getting read-only access. [EDIT] Well, good thing I used "almost", since I was wrong: of course, case-inverting the password and hashing the result could also be done client-side, silly me! [EDIT'] Answers pointing out that you always have access to non-hashed passwords, and I believe this is wrong. When the user submits their password, it SHOULD be hashed client-side and only the hash SHOULD be sent to you.

maaarghk 12y ago
You do have access to their non-hashed password. When they type it into your form and press enter. You just invert the case and check it against the hash again.
- k__ 12y ago
  Why not including the lowercase into the hash-algorithm?
  - MartinCron 12y ago
    A hashing algorithm specifically for passwords that would hash to the same thing based on inverted caps lock or other deterministic user errors (white space at the edges, maybe)? That sounds like a great idea.
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
kibwen 12y ago
Assuming that you run your own login service like Facebook does, you always have access to your user's passwords at least once because at some point you have to take the raw password and hash it. Facebook just creates two variations of the user's password and stores the hashes for all three of them.

epochwolf 12y ago

One snag, on Macs capslock works differently. It doesn't invert when you press shift. Shift + A with capslock on will still result in an uppercase A.

shawabawa3 12y ago
I'm not sure about facebook but I believe blizzard (WoW/Diablo/etc) ignores case completely in all passwords
- pcnc 12y ago
  Blizzard also has an upper limit of 16 for the length of the password.
- Glide 12y ago
  What? I know I have to put in upper case for my password for WoW. They also have authenticators before a lot of other people had them. And please use one if you do. Battle.net accounts are targets.
  - jimminy 12y ago
    >What? I know I have to put in upper case for my password for WoW You don't have to do that, my password has capitals, but after I found out the shift the alphas to only one case I stopped typing the caps.
  - d_k_f 12y ago
    Unless they changed their entire auth mechanism, it's definitely case insensitive. IIRC, the client encrypts the password using some variant of SRP6 plus some additional magic, but the last time I dabbled in wow emulation was quite some time ago. EDIT Here's a link to a moderator confirmation: http://eu.battle.net/wow/en/forum/topic/2679778775#3 http://eu.battle.net/wow/en/forum/topic/2679778775#3

Strilanc 12y ago

Giving the attacker two ciphertexts, where their plaintexts are related by a simple function, sounds like the sort of thing that breaks cryptosystems. So I hope they're canonicalizing the password casing instead of storing the hash of both possibilities.

jamessb 12y ago
Why would they need to store the hash of both possibilities? They can simply invert the case of what the user types before hashing it - ie. compare both hash(enteredPassword) and hash(invertCase(enteredPassword)) to the hash in the database and see if either match.
- jimktrains2 12y ago
  They could also just ignore case: hash(upper(password)) so there is only ever one hash (that happens to map to multiple input passwords) instead of multiple hashes relating to a single password each.
  - quakkels 12y ago
    I suspect that Facebook still wants to know that some letters have a different case than other letters. If They just converted all letters to uppercase then that information would be lost.
    - wlesieutre 12y ago
      Do you know how they handle caps lock on Macs then? When caps lock is on, it types in caps even with shift.
      - iso8859-1 12y ago
        Who says they can't check 3 times? Original, caps inverted and uppercase? This would make sense. You could even make it try neighboring keys on common key layouts. If the hash has enough bits of security then good passwords will still not break.