News for hackers. Stuff that matters.
Re:The “Chad” bug by ars on Thursday December 31, 2015 @01:09AM (#10816463)
> The input the user puts into the password prompt should by taken exactly as is

I would however suggest trimming trailing spaces.

Also, for a nicer user experience try the password twice: As is, and with case reversed. This lets people login even with capslock on and has little impact on security (i.e. don't be case insensitive! just case reversed.)

Re:The “Chad” bug by tempestn on Thursday December 31, 2015 @03:33AM (#10816821)
I see the reasoning behind trimming trailing spaces, but it could cause at least as many problems as it solves. Plenty of people use automatically generated passwords, and while hopefully most auto-generators don't include spaces, I expect some might. Better might be to warn the user if their password has a trailing space.
Re:The “Chad” bug by relearn on Thursday December 31, 2015 @09:56AM (#10817766)
Could you not trim spaces upon attempted login as well to make this a non-issue?

I do like the idea of warning the user upon creation.

Re:The “Chad” bug by tempestn on Thursday December 31, 2015 @03:28PM (#10819514)
Good idea; I agree that that's better.
Re:The “Chad” bug by nothrabannosir on Thursday December 31, 2015 @05:51AM (#10817118)
Is there any password generator in this reality which does that? Serious question. More than zero?
Re:The “Chad” bug by tempestn on Thursday December 31, 2015 @03:30PM (#10819519)
Probably not a serious one, but a lot of people write their own little scripts and utilities to do this. So definitely more than zero. Perhaps not a significant number, but I'd still be concerned about changing a user's entered password without letting them know. relearn's solution is a good one though.
Re:The “Chad” bug by serge2k on Thursday December 31, 2015 @05:00PM (#10819934)
I would guess the number of people who accidently enter "password " is far greater than the number of people who have "p " as their password. Plus, for the people who do deliberately input spaces they will just have a weaker password, not issues logging in.
Re:The “Chad” bug by M2Ys4U on Thursday December 31, 2015 @06:34AM (#10817208)
I can see how that could fail horribly when you have arbitrary Unicode data.

For instance, the German sharp s (ß) has an asymmetrical casemapping.

From the Unicode standard[0]:

>The German sharp s character has several complications in case mapping. Not only does its uppercase mapping expand in length, but its default case-pairings are asymmetrical. The default case mapping operations follow standard German orthography, which uses the string “SS” as the regular uppercase mapping for U+00DF ß latin small letter sharp s. In contrast, the alternate, single character uppercase form, U+1E9E latin capital letter sharp s, is intended for typographical representations of signage and uppercase titles, and in other environments where users require the sharp s to be preserved in uppercase. Overall, such usage is uncommon. Thus, when using the default Unicode casing operations, capital sharp s will lowercase to small sharp s, but not vice versa: small sharp s uppercases to “SS”, as shown in Figure 5-16. A tailored casing operation is needed in circumstances requiring small sharp s to uppercase to capital sharp s.

[0] http://www.unicode.org/versions/Unicode7.0.0/ch05.pdf#G21180

Re:The “Chad” bug by ars on Thursday December 31, 2015 @12:35PM (#10818610)
> For instance, the German sharp s (ß) has an asymmetrical casemapping.

As they say "so don't do that".

This is about capslock, not lettercase in general. Only switch characters that change with capslock on the keyboard.

And even if the mapping is not perfect - so what? The worst that will happen is nothing.

Re:The “Chad” bug by pavel_lishin on Thursday December 31, 2015 @10:46AM (#10818016)
Why would that fail horribly?