Maybe it says someone used your master password even if they didn't? It gave the IP as Islington which is kind of correct.
Maybe it says someone used your master password even if they didn't? It gave the IP as Islington which is kind of correct.
If you didn't receive a "Someone just used" email (with an IP that's completely geographically off from where you are) that's a good sign, of course.
"But famous company X does this, it is really convenient for users!" was all the response I got. All I could do at the time was (internally) shake my head.
I'm happy to be proven wrong, but I think that what's happening with @tim333 is that master passwords may be all lower cased (for example) before being hashed. Or maybe the password is hashed twice with the first letter upper and lower cased.
Here's what I found from a quick google re: password case:
https://www.zdnet.com/article/facebook-passwords-are-not-cas...
https://security.stackexchange.com/questions/68013/facebook-...
"This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or whose devices automatically capitalize the first letter of the password."