4 ms·
I suspect that Facebook still wants to know that some letters have a different case than other letters. If They just converted all letters to uppercase then tha
by quakkels 12y ago
I suspect that Facebook still wants to know that some letters have a different case than other letters. If They just converted all letters to uppercase then that information would be lost.
- wlesieutre 12y agoDo you know how they handle caps lock on Macs then? When caps lock is on, it types in caps even with shift.
- iso8859-1 12y agoWho says they can't check 3 times? Original, caps inverted and uppercase? This would make sense. You could even make it try neighboring keys on common key layouts. If the hash has enough bits of security then good passwords will still not break.
- ciderpunx 12y agoSure, I think that this means that the try the normal case and the flipped case. > ie. compare both hash(enteredPassword) and hash(invertCase(enteredPassword)) to the hash in the database and see if either match Here's an example in bash: $ echo PasSwoRd | tr 'A-Za-z' 'a-zA-Z' pASsWOrD In the database store one variant $ echo PasSwoRd | tr 'A-Za-z' 'a-zA-Z' | sha256sum > db Then you can test both on input $ echo PasSwoRd | sha256sum > sum1 $ echo PasSwoRd | tr 'A-Za-z' 'a-zA-Z' | sha256sum > sum2 $ diff -q db sum1 Files db and sum1 differ # i.e. LOGIN FAILS $ diff -q db sum2 $ # i.e. LOGIN SUCCEEDS The problem with the caps lock behaviour on Macs is harder. You definitely don't want to force to uppercase!