Hacker News Reader

Comment by outworlder | Hacker News Reader

The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text.

For instance, case-insensitive passwords.

EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name).

Why can't it have spaces? Hashes don't care about this. Smells awfully like some string manipulation going on.

Why is it limited to 20 characters? Odds are that they are using VARCHAR(20) or variants. Hashes also don't care about this.

None of this is proof, but it smells really bad.

View on HN

Not necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower() on the input before calculating the hash.

You are right. But then it boggles my mind even more that one would go through the extra effort.

Why? I've done it before. This was an in-house program with little in the way of security implications. Forcing the case on the password greatly cut down the number of problems.

Since then I have seen a better solution: Try the password, if it fails try it with the case flipped. If that works it's a caps-lock error, they know the password, accept it.

I haven't checked lately, but I understood that Facebook passwords are case-insensitive.

IIRC Wells Fargo passwords used to be /partially/ insensitive. Like, just the first half was to_lower.

They're not case insensitive, but they do allow for some casing mistakes.

Flipped case (caps lock) or first character case is wrong (mobile input field) were both allowed. Not sure about now. The article I found about it was from 2014.

That seems bad, like philosophically it feels like a password and only that exact password should work. But rationally I can't see too much of a problem with this.

No, not case-insensitive. They are case-sensitive. Atleast in 2012 Facebook accepted PassWord1 & pASSwORD1 (Case Reversed) passwords.

Stackoverflow Meta Question here:

https://webapps.stackexchange.com/questions/26301/facebook-a...

My Question (the reason why I know):

https://stackoverflow.com/questions/10718236/how-to-alter-th...

They could be doing argon2(lowercase(password)). But you're right, it's unlikely that they're doing the wrong thing in the right way.

You can't be sure, they could lowercase all passwords (so during registration and after logging in) after they are entered.

"For instance, case-insensitive passwords." "Why can't it have spaces?"

They don't want to deal with angry customers who are "definitely entering the correct password but it's not letting me in".

The one that actually tells you they store plaintext passwords is when it can't be close to previous passwords.

You can also implement that by just bruteforcing the previous hash with variants of the new password. IIRC Windows since 2000 implement these kinds of checks in exactly this way.

They are some ingenious ways to make that judgement without storing plaintext passwords.

But you are right, that none of those companies do that.

Reply on news.ycombinator.com