Timeline for Are case-insensitive passwords a bad idea?
Current License: CC BY-SA 3.0
26 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 6, 2015 at 20:32 | comment | added | Fabian Blechschmidt | @CodesInChaos Sorry for being inaccurate - no clue how they save it (hopefully as hash), but they allow these three transformations. | |
| Sep 6, 2015 at 16:52 | comment | added | CodesInChaos | @FabianBlechschmidt There isn't a reason to store all of these. They can simply apply these transformations to the password being tested at the cost of up to two additional hash computations if one of the variants was entered. Or canonicalize the password before hashing. | |
| Sep 6, 2015 at 14:40 | review | Close votes | |||
| Sep 6, 2015 at 16:09 | |||||
| Sep 6, 2015 at 14:23 | comment | added | MikeFHay | possible duplicate of Is there any explanation (other than storing plaintext) for case-insensitive passwords? | |
| S Sep 5, 2015 at 19:43 | history | edited | S.L. Barth is on codidact.com | CC BY-SA 3.0 |
made title more accurate, and added that mixed-case passwords were also accepted
|
| S Sep 5, 2015 at 19:43 | history | suggested | sleblanc | CC BY-SA 3.0 |
made title more accurate, and added that mixed-case passwords were also accepted
|
| Sep 5, 2015 at 19:25 | review | Suggested edits | |||
| S Sep 5, 2015 at 19:43 | |||||
| Sep 5, 2015 at 19:10 | comment | added | Fabian Blechschmidt | I once read, that facebook is storing three versions of a password: the original, first character uppercase and the inverted version. security.stackexchange.com/questions/68013/… | |
| Sep 5, 2015 at 18:51 | comment | added | ratchet freak | if you can log in with caps lock on that means you are not using symbols or numbers... | |
| S Sep 4, 2015 at 20:17 | history | suggested | user49075 | CC BY-SA 3.0 |
fixed title's grammar
|
| Sep 4, 2015 at 20:12 | review | Suggested edits | |||
| S Sep 4, 2015 at 20:17 | |||||
| Sep 4, 2015 at 19:00 | comment | added | Quora Feans | It might be that they capitalize (or turn into lowercase) all passwords and then hash them. Being case insensitive does not mean that it's not being hashed. | |
| Sep 4, 2015 at 17:59 | comment | added | D.W. | Is it case-insensitive, or case-swapping? If your password is "happy", does it accept "happy" and "HAPPY" and "HaPpY" or just "happy" and "HAPPY"? If your password is "happiNESS", what does it accept? See also security.stackexchange.com/q/68013/971 and security.stackexchange.com/q/14816/971. | |
| Sep 4, 2015 at 17:56 | history | protected | Jeff Ferland♦ | ||
| Sep 4, 2015 at 17:50 | answer | added | kasperd | timeline score: 2 | |
| Sep 4, 2015 at 17:35 | vote | accept | Nerotech | ||
| Sep 4, 2015 at 17:28 | answer | added | cde | timeline score: 11 | |
| Sep 4, 2015 at 17:26 | history | tweeted | twitter.com/#!/StackSecurity/status/639852097094197248 | ||
| Sep 4, 2015 at 17:22 | vote | accept | Nerotech | ||
| Sep 4, 2015 at 17:35 | |||||
| Sep 4, 2015 at 17:17 | answer | added | Steve Sether | timeline score: 18 | |
| Sep 4, 2015 at 17:12 | answer | added | Masry | timeline score: 0 | |
| Sep 4, 2015 at 17:01 | history | edited | Nerotech | CC BY-SA 3.0 |
added 38 characters in body
|
| Sep 4, 2015 at 16:58 | answer | added | Gerasimos.Zap | timeline score: -2 | |
| Sep 4, 2015 at 16:47 | review | First posts | |||
| Sep 4, 2015 at 17:27 | |||||
| Sep 4, 2015 at 16:47 | history | edited | Nerotech | CC BY-SA 3.0 |
added 3 characters in body
|
| Sep 4, 2015 at 16:33 | history | asked | Nerotech | CC BY-SA 3.0 |