Skip to main content
Information Security

Return to Question

edited tags
Link
Thomas Pornin
Thomas Pornin
  • 328.6k
  • 60
  • 800
  • 969
edited tags
Link
AviD ♦
AviD ♦
  • 73.6k
  • 24
  • 141
  • 222
Tweeted twitter.com/#!/StackSecurity/status/114502525633306624
Source Link
Pacerier
Pacerier
  • 3.3k
  • 7
  • 37
  • 64

How much security is compromised if we accept other characters as login (other than the original password)?

I've just realised that facebook accepts 3 forms of a password:

Source:

Facebook actually accepts three forms of your password:

  1. Your original password.

  2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.

  1. Your original password with the case reversed, for those with a caps lock key on.

Obviously they are claiming that the security compromised is insignificant. My question is is the security compromised really insignificant ?

How much easily is a hacker able to achieve a login with 2 additional "holes" ?