Hacker News Reader

I don't really see a reason they needed to be super transparent about that fact. It doesn't really have a significant security impact. It's just a small QOL improvement they implemented.

Honestly, given the possibility of accidental caps lock, and how mobile keyboards try to capitalize the first letter...

...that seems like a clever feature, and it doesn't reduce security in any meaningful way at all.

I would never bother to program that, out of my own laziness, but I respect that they did. It's really thinking about users.

Good to know. Someone in Facebook probably writes all his emails in all caps.

You don't need to store 3 hashes, infact, you would need many hashes for all possible cases. It is easier to drop all cases pre hashing, and only store a lower case hashed value.

Hashing the the lowercase version of the password string is not the same as what they’re doing. What you’re suggesting greatly reduces the security of the password, what they’re doing only divides the search space by 3 (which is nothing).