4 ms·
Not if, when caps lock is detected, the case is inverted before submitting.
by lost_my_pwd 12y ago
Not if, when caps lock is detected, the case is inverted before submitting.
- Rinum 12y agoI purposefully create passwords with caps lock on, what then?
- jephir 12y ago> I purposefully create passwords with caps lock on, what then? I think he means doing it on the server, i.e. checking the password as-is, if that doesn't work, then check it with case inverted.
- mark-r 12y agoThe best way to handle this is not to modify the entered password, or to reject it, but rather to just display the message. If it stands out enough you should notice it and make the corrective action yourself. In your case no corrective action would be necessary.
- sp332 12y agoIt does "halve" the keyspace, by removing one bit of entropy from your password. This is assuming you only use letters in your password and not numbers or other symbols not affected by capslock.
- deleted 12y ago[deleted]
- bnegreve 12y agoWell, it's a bit tricky. Two inverted passwords still have different hashs. From that perspective, two inverted passwords are not equivalent and therefore the entropy is not decreased. This is important because if you want to decode a hashed password using a rainbow table for example, you still have to hash the entire keyspace, not just half of it. Edit @sp332: Exactly. That was my point.
- sp332 12y agoIf you're doing an online attack, you can submit half as many passwords. I guess it's just as hard for an offline attack where you're cracking the database of hashes.