11

I've just realised that facebook accepts 3 forms of a password:

Source:

Facebook actually accepts three forms of your password:

  1. Your original password.

  2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.

  3. Your original password with the case reversed, for those with a caps lock key on.

Obviously they are claiming that the security compromised is insignificant. My question is is the security compromised really insignificant ?

How much easily is a hacker able to achieve a login with 2 additional "holes" ?

Improve this question

2 Answers 2

Reset to default
15

These rules basically mean that instead of having one valid password for an account, there are three of them (two, if the original password already begins with an uppercase letter). Theoretically, this divides attacker effort by up to 3, but actually a bit less than that because "pASSWORD" is much less probable as a user-chosen password than "Password".

So, in short words: these rules make password-guessing attacks three times easier. This does not mean that they make attacks easy.

Improve this answer
9
  • So, would it be fair to state that these rules lower the effective entropy by approximately 1.5 bits (all else being equal)?
    – AviD ♦
    Commented Sep 20, 2011 at 16:22
  • 1
    That's three times easier to guess using their external login system. Brute-forcing would require the exact same amount of hashes, since their login mechanism likely takes the input password, transforms it, and hashes each version of it (for a total of three hashes to try three versions of the input password). Since they control the login system it would be difficult to use as an attack vector.
    – pdubs
    Commented Sep 20, 2011 at 16:34
  • 2
    @AviD: about 1.585 bits, actually (logarithm of 3 in base 2).
    – Thomas Pornin
    Commented Sep 20, 2011 at 16:37
  • 1
    @pdubs: there is a need for some formalism here. A password hashing scheme invokes the hash function N times for each login attempt; N is adjusted so that the process is slow, but not too slow on the server. If the server must hash three password variants, it will use N/3 hash invocations on each. If it accepted only a single password variant, it could afford to spend three times as many CPU on that, i.e. N hash invocations on that unique password. This is where the 3x comes from: 3x weaker for a given CPU budget on the server.
    – Thomas Pornin
    Commented Sep 20, 2011 at 17:13
  • 1
    In other words, a server can always increase the number of nested hash invocations on any hashed password: it increases attack cost by a factor of x, and usage cost by the same factor x. I am reasoning at constant usage cost.
    – Thomas Pornin
    Commented Sep 20, 2011 at 17:16
1

Facebook is correct. It's an insignificant decrease in security for an enormous increase in usability.

Even making passwords a million times easier to guess isn't a big problem. That's what many other sites do. To solve the same problem, they simply treat all upper and lower case the same. That means a 9 letter password will have a million combinations, and thus will become a million times easier to guess.

While these sorts of things make passwords "weaker", websites can do things to make passwords "stronger". One way is to enforce minimal password lengths, or force users to include punctuation/numbers. Another way is "key strengthening", or repeatedly hashing a password many times. For example, some sites hash the password 1000 times, making it 1000 times harder to crack.

Some people choose easy passwords like "123456" that can be guessed no matter how strong the system is. Likewise, some people choose passwords like "#hd&G!!nv*63" that cannot be guessed, not matter how weak the system is. Making the system a million times stronger or a million times weaker only protects/endangers the tiny number of passwords on the edge between the two.

Improve this answer
1
  • with a strong hash, I believe hashing a password 1000 times doesn't make it any more than hashing it once right?
    – Pacerier
    Commented Sep 22, 2011 at 3:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .