News for hackers. Stuff that matters.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by Udo on Friday May 25, 2012 @03:46AM (#4022430)
I agree completely. It is not a bug. From my experience, technically inept users confuse upper and lower case all the time - and the result is they file an incident report because their "password stopped working". The same applies to leading or trailing spaces, they should be stripped.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by sixcorners on Friday May 25, 2012 @05:26AM (#4022722)
We should also automatically correct the spelling of the word used as the password. /s
Re:Diablo 3 bug report: "Passwords not case-sensitive." by jackalope on Friday May 25, 2012 @07:08AM (#4022970)
No. Usually, when I create a password I'm asked to verify it in the next text field. When I visit the login page and enter the exact same characters, I expect it to work. I shouldn't have to guess at my own password because some clever developer's algorithm decides that I made a mistake.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by xaro on Friday May 25, 2012 @07:48AM (#4023074)
You don't need to guess it, if it's implemented the correct way, the signup and the login process will have the same rules and you won't notice.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by nsxwolf on Friday May 25, 2012 @09:55AM (#4023454)
I'm fairly certain you are both jesting.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by Pechtel on Friday May 25, 2012 @11:06AM (#4023773)
I've implemented this very thing for the same reason--it cuts down on user errors. The real answer to password security is length, not putting odd stuff in the passwords that makes people forget them.

There's nothing you need to guess, the logic is in the password encoder and thus will apply both when you set it and when you use it.

Re:Diablo 3 bug report: "Passwords not case-sensitive." by jackalope on Friday May 25, 2012 @12:29PM (#4024203)
Stripping characters reduces length, so you are making passwords less secure by your own criteria.

As for the scenario I described, I experienced it myself in a system that silently stripped spaces from any position in the verification process, storing a different password than the one I typed in, without any warning. My password wouldn't work in the login and I figured it out by examining the password verification code.

I don't understand why it's controversial to simply accept and store a user's password verbatim. Any other approach risks introducing new security issues, from reduced entropy to password clashes. Misguided policy decisions are famous for weakening encryption schemes, like that of the Enigma machine in WWII.