Hacker News Reader

Comment by alexkus | Hacker News Reader

> Are there hash algorithms which are upper and lower case agnostic? Or should I assume that they store a hash of both the original password form and a lower cased version?

The hash may not be case insensitive, but I've seen plenty of code in and around password handling code that forces all letters to be lower/upper case prior to hashing.

(There's rarely ever any explanation as to why, nor anyone still around who admits to writing that code.)

View on HN

Of course, I don't know why I didn't simply assume that whenever the password is handled it is lower cased.

Confession: I worked on a website where this was done both for usernames and passwords (about a decade ago). The justification at the time was that the users could not be expected to understand the difference between upper and lower case letters (or something to that effect). I suppose that justification continues to play well.

I usually lowercase usernames before storing them in the DB, which saves a lot of mental effort later on -- specifically, where usernames are used as keys (like "website.com/users/username/"), but I've always chosen to preserve case on passwords as a security measure (being able to tell somebody your password without actually telling them your password is valuable, if only in extremely rare situations). It's odd to me that someone like a bank would choose the other way.

Reply on news.ycombinator.com