secone

Shoot. They are pretty open about the fact that their passwords are case insensitive. I had always hoped this was some clever implementation using multiple hashes upon password creation.

Or tolower() everywhere.

If it's true that they're able to read it back though, then why would they bother?