News for hackers. Stuff that matters.

A comment on Sites with dumb password rules. Parent comment

Re:Sites with dumb password rules by intrepidlemon on Thursday September 05, 2019 @05:26PM (#20890773)
Not necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower() on the input before calculating the hash.
[ Parent | on HN ]
Re:Sites with dumb password rules by outworlder on Thursday September 05, 2019 @05:30PM (#20890805)
You are right. But then it boggles my mind even more that one would go through the extra effort.
[ Parent | on HN ]
Re:Sites with dumb password rules by LorenPechtel on Thursday September 05, 2019 @07:27PM (#20891564)
Why? I've done it before. This was an in-house program with little in the way of security implications. Forcing the case on the password greatly cut down the number of problems.

Since then I have seen a better solution: Try the password, if it fails try it with the case flipped. If that works it's a caps-lock error, they know the password, accept it.

[ Parent | on HN ]
Re:Sites with dumb password rules by learnstats2 on Thursday September 05, 2019 @05:57PM (#20891010)
I haven't checked lately, but I understood that Facebook passwords are case-insensitive.
[ Parent | on HN ]
Re:Sites with dumb password rules by RandallBrown on Thursday September 05, 2019 @08:56PM (#20892069)
They're not case insensitive, but they do allow for some casing mistakes.

Flipped case (caps lock) or first character case is wrong (mobile input field) were both allowed. Not sure about now. The article I found about it was from 2014.

[ Parent | on HN ]
Re:Sites with dumb password rules by ineedasername on Thursday September 05, 2019 @09:54PM (#20892348)
That seems bad, like philosophically it feels like a password and only that exact password should work. But rationally I can't see too much of a problem with this.
[ Parent | on HN ]
Re:Sites with dumb password rules by davchana on Friday September 06, 2019 @01:44AM (#20893367)
No, not case-insensitive. They are case-sensitive. Atleast in 2012 Facebook accepted PassWord1 & pASSwORD1 (Case Reversed) passwords.

Stackoverflow Meta Question here:

https://webapps.stackexchange.com/questions/26301/facebook-a...

My Question (the reason why I know):

https://stackoverflow.com/questions/10718236/how-to-alter-th...

[ Parent | on HN ]
Re:Sites with dumb password rules by jdashg on Thursday September 05, 2019 @06:36PM (#20891276)
IIRC Wells Fargo passwords used to be /partially/ insensitive. Like, just the first half was to_lower.
[ Parent | on HN ]