Hacker News Reader

Comment by sp332 | Hacker News Reader

They don't store separate hashes. If the password is wrong, they just flip the case of the input and try again. They do a similar thing with changing passwords, see this comment https://security.stackexchange.com/questions/53481/does-face...

View on HN

How can they get away with not storing at least a second hash? I don't see how an all-caps password can be matched to an any cased password, unless you only store the hash to the all-caps password.

It's not all-caps, it's typed with caps-lock down (i.e., case inverted).

Note that this behavior is OS specific. Windows will invert case (shift gives lowercase), while macOS will be all-caps (shift doesn't do anything).

Frankly I can't remember the Windows approach ever being useful to me, and more often than not it bites me in the ass because I habitually hit something like shift-i to type "I" and end up with a lowercase i instead.

Drafters (the guys who draw engineering drawings) love it because you very rarely but just enough have to type lowercase letters (such as units, like 3mm) whilst all other text must be in capitals. Thus, you just use shift to shift it to lowercase for those rare moments and no other times.

Thanks! Case inverted makes sense. They can invert the case before hashing and submitting. If any of the four hashes match the stored hash, they get in.

I think what was meant was that they don’t store a second hash in order to allow chopping off a character at the end. I agree with you that they would need to store extra hashes for allowing all-caps and some of the other cases.

No extra hashes needed for an all caps version or inverted case version of a password, just perform those transformations on the user input, hash, and compare the result to the single stored hash.

Reply on news.ycombinator.com