Hacker News Reader

The problem is that it requires you to store multiple hashes while case normalization doesn't.

At least they do not strip special characters out of the password.

Actually, I don't think there's a need to store multiple hashes.

Here's one idea: Let's say the user's password is P. The user enters some password P' with a typo. The authentication check is "does H(T_k(P')) == H(P)" for some set of transformations {T_1, T_2, ..., T_n}. Each transformation T_i hypothesizes that the user made a specific mistake. (e.g., T_1 is the caps lock is on so we need to flip the case of all the characters)

That caps lock case is a good one, but I don't really see other realistic instances where you wouldn't just say "username or password is incorrect".

A few other cases: transcription errors (i.e., mistaking 1 for l), wrong case of the first character of the password, extraneous character at the end of a password, etc.

The paper I linked to actually does a good job motivating specific classes of typos by looking at real typos from Dropbox users.

No, you can just store the original hash and try two times when matching.

Reply on news.ycombinator.com