Gmail password first character is case insensitive on mobile device

Re:Gmail password first character is case insensitive on mob... by brigandish on Saturday October 09, 2021 @12:13PM (#28811050)

> The comparison is between the original hashed password and the hashes made at auth-time.

Didn't I write that this shouldn't be done via the clause? I haven't edited my comment either so it should still be there and I see it is.

> the pseudo sql doesn’t select anything

It should select the hash(es) and bring them back to the app for comparison.

> The name of the original is “pass” but since it wouldn’t make sense to compare a plaintext string to a hash another logical assumption is that “pass” is a hash.

It doesn't matter whether it's a password or a hash, the form of the SQL statement is going to cause trouble and should be the other way round.

> Maybe these generous assumptions about someone’s pseudo code are unwarranted?

Perhaps you meant to reply to someone else?

[ Parent | on HN ]

Re:Gmail password first character is case insensitive on mob... by adolph on Saturday October 09, 2021 @04:56PM (#28813232)

> It should select the hash(es) and bring them back to the app for comparison.

Agreed 100%. Calculating three hashes and sending them to sql for comparison—maybe index lookup—seems backward to me.

[ Parent | on HN ]