Hacker News Reader

Comment by heroic | Hacker News Reader

They dont need to store your pasword in plaintext for this, but it does raise a security concern. 3 times the chances to have your password guessed by brute force!

View on HN

Given a reasonably sized keyspace (which FB does have) a factor of three should not be a big deal.

You are right, but given the fact that most people still use very common words for their passwords, a 3 times increase is a very huge number. A recent story on HN stated the fact that passwords from sites that had their databases leaked, mostly consisted of dictionary based passwords.

One could posit that the negative security impact on such a password is negligible, since the password is already weak.

I think it would be worrisome if there weren't protective measures already in place, such as limited login attempts, two-factor auth, and so on.

The other weakness would be the repetition of that password on sites that place a low priority on, or are ignorant about, security. At which point, it doesn't even matter.

It's actually much more than 3 times the chance; this rule allows you to restrict your brute force search to only check passwords with no uppercase characters (or no lowercase characters) which reduces the key space for a given maximum password length quite a bit. (e.g., if there were normally 100 characters allowed and n is the max length, taking out 26 characters reduces the search space from 100^n to 74^n - not that an intelligent password cracker would ever try to iterate straight through the actual space of all allowable passwords)

Read the article again, its not making the passwords case insensitive, merely allowing you to invert the case. i.e. if your password was "aSdf" neither "ASDF" nor "asdf" would work.

Well I feel dumb, sorry. I thought he meant original casing + all lowercase version + all uppercase version were all acceptable (which isn't the same as case insensitive but for the purposes of cracking it is just as bad).

If you don't use Windows you definitely shouldn't feel dumb: if caps lock is enabled on Windows shift will cause you to type a lower case letter, thus inverting what you intended to type rather than uppercasing everything.

I was confused until I realized the caps lock case only applies to Windows users.

Actually, caps lock + shift gives lower-case in ubuntu as well.

I've been using OSX as my primary OS for about a year (other than using Linux exclusively on every machine I SSH into for dev), but I just found out from your post that caps lock + shift doesn't make things lowercase on Mac. So, nope, I have no excuses :P

That's not necessarily true -- it doesn't allow you to eliminate all uppercase // lowercase situations. You still have to have the correct casing, just inverted (as though Caps Lock was on). Since my FB password has both uppercase and lowercase letters, the inverted case would still have uppercase and lowercase. There is no option that I can use for my current password that is all lowercase or all uppercase.

I think we can be pretty certain Facebook already has robust login attempt throttling systems in place.

Reply on news.ycombinator.com