0

I'm trying to find on the Internet some manual, guide or policy secure about

applications should not convert lower string to upper string to store as password

I mean, don't make "testpassword123" into this "TESTPASSWORD123".

I have read a lot of recommendations, but I need some explicit documment that tells we "you should not upper the string when saving it as a password", explicit as that.

Thanks a lot by the help until now.

Improve this question
18
  • I can't see any logic here, its nothing more than an illogical crap in my opinion.
    – Batuhan
    Commented Mar 30, 2015 at 13:02
  • @Batuhan I already saw many applications doing that, I mean, converting lower cases caracters to upper before saving on database. I'm going to write a guideline about safe passwords and need some documentations, manuals, etc., exactly telling that it's not safe upper the caracters.
    – Felipe M
    Commented Mar 30, 2015 at 13:09
  • 1
    You could just point to any passwort policy which demands mixed case. That it is pointless to demand mixed case when you then throw it away on the backend should be obvious to anyone. Another pitfall is that upper-casing some more exotic unicode characters is non-trivial and often done inconsistently even by common libraries, which can lead to ambiguity.
    – Philipp
    Commented Mar 30, 2015 at 13:13
  • @Philipp I found a lot of password policy, but they just tell us recommendations. I'm looking for rules, not guidelines. Some web post, anything, that tells "don't upper the string before save". I found this: csrc.nist.gov/publications/drafts/800-118/draft-sp800-118.pdf page 3-8, but it's not "DON'T DO THAT" exactly.
    – Felipe M
    Commented Mar 30, 2015 at 13:21
  • @FelipeM What is the exact difference between "rules" and "recommendations" in your opinion? Any offical "Rule" only applies to a specific organization which is subject to that set of rules, so for everyone else they are just recommendations at best and completely irrelevant at worst.
    – Philipp
    Commented Mar 30, 2015 at 13:24

2 Answers 2

Reset to default
2

I also could not find any password storage policies that mention that passwords should not be upper-cased. But I also didn't find any guides which told me not to set every password to "password", not to remove all special characters, or not to shorten them to 4 characters. It's just obvious.

You should not change the password that the user supplied. This can lead to unreasonably weak passwords (without the users knowledge!), and to compatibility issues later on (the user will always type in their password the way they set it, so each login/verification mechanism needs to perform the password transformation on each login).

If you can't deal with some special characters, report this back to the user that submitted them, do not silently change the supplied password.

Improve this answer
1
  • That's exactly what I need and didn't find yet. Some material that says "don't upper your string when saving it as a password". Like I commented before, MS says ( technet.microsoft.com/en-us/library/cc786468(v=ws.10).aspx ) that the password must contain characters from three of five categories: upper, lower, Nonalphanumeric, number and unicode. If I upper the string, I still have possibilities. Right?
    – Felipe M
    Commented Mar 30, 2015 at 13:57
1

An historical example of such a poor algorithm is Microsoft's LM hash.

As you said Felipe, in order to create a strong password, you need among other things to mix uppercase and lower case letters. Why? Because by doing so there can be 52 different possible letters constituting each character of the password: 26 lowercase + 26 uppercase.

By converting the string to uppercase, you weaken the password since there will be now only 26 different possible letters constituting each character, not 56, which will make the password by far more easy to guess. In other words, you're helping hackers to penetrate the system because they will not have to bother with case issue since "secret", "Secret", "SecReT" and "SECRET" will all match the very same password and open the same access.

Improve this answer
3
  • Yes, but... where, in a oficial doc, from some company for example, I can read this? I can read "don't upper the string for passwords"?
    – Felipe M
    Commented Mar 30, 2015 at 14:16
  • 2
    There is no official doc stating this, because everyone is free to handle his company how he wants: there is no law forbidding the use of weak authentication scheme, and as long as you do not need some certification there is no compliance to abide by. However, since as a company holder you may be fully responsible of damages caused to your customers and partners by your own carelessness, you may want to apply the best practices in order to reduce all risks to the minimum and to, would the worse happen, be able prove to others that you took all appropriate measures and are not responsible.
    – WhiteWinterWolf
    Commented Mar 30, 2015 at 15:11
  • 2
    @FelipeM By changing a password to upper, you fundamentally change the password. There is not going to be a doc that says not to do this. By switching to upper(), you might as well change "testpassword123" and every other submitted password into "password" and there won't be a doc that tell you not to do that, either. Sure, the practical reason is about reducing complexity, but the basic principle is to not change the password submitted. The reasons why are inherently obvious.
    – schroeder ♦
    Commented Mar 30, 2015 at 20:09

Not the answer you're looking for? Browse other questions tagged .