4 ms·
But this is less secure than storing the properly hashed password. This would reduce the space of all passwords to upper case letters (plus whatever symbols and
by WA 12y ago
But this is less secure than storing the properly hashed password. This would reduce the space of all passwords to upper case letters (plus whatever symbols and numbers are allowed) only.
- eterm 12y agoIt is however the approach battleNet (Blizzard - World of Warcraft) take, their password is completely case insensitive.
- jimktrains2 12y agoYeah, I'm being downvoted for pointing out the method some places use. It's terrible to have anything but a minimum length requirement IMHO. Making it password insensitive is nice for users, but does make the resultant search space much smaller (to the point that I don't think the convince for users trumps, especially given the UI can inform them if they have caps lock on to begin with).
- WA 12y agoWhich is weird, too. I wrote an email once to Blizzard, asking why they also have a maxlength for the password. This doesn't mean anything, but it could be an indicator for password = VARCHAR(16). Makes no sense whatsoever to restrict the length of a password, especially in such a large network. Never got a reply though.