45

This question already has an answer here:

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the first letter of my password in uppercase and the rest in lowercase. Again, I got in. How is this even possible? Does Facebook keep a cookie for the password or something?

marked as duplicate by MechMK1, AndrolGenhald, Steffen Ullrich, multithr3at3d, Joseph Sible Aug 11 at 4:29

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

55

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or whose devices automatically capitalize the first letter of the password.

I don't think there are any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords are probably generated from the password submitted, via the login form, and not stored as alternates on the back end.

It appears that they are only flipping a-zA-Z, and not a mix of incorrect case. They are also checking against a capitalzied first character as pointed out by PwdRsch in the comments.

While this may increase the online brute force attack surface, if you use a password of high entropy, it's pretty unlikely that this would prove to be much of a security risk in my opinion.

i.e:

Password: aBcDeF123
Works:    AbCdEf123  // Flipped Case
Works:    ABcDeF123  // Caps First Char
Doesnt:   ABCDEF123  // Mixed Case
Doesnt:   AbCdEf!@#  // Shifted Numbers
  • 12
    This is correct and it has been this way for years. There is a third scenario, which is where Facebook will accept your password with the first letter capitalized even if it isn't normally. – PwdRsch Sep 23 '14 at 15:47
  • 5
    Interesting, does Facebook document this anywhere? – Abe Miessler Sep 23 '14 at 16:50
  • 2
    I can't find anything, but I don't think the server side authentication process is something that needs to be publicly documented. – David Houde Sep 23 '14 at 18:35
  • 1
    I read a post of a Facebook employee that explained that Facebook does actually store variations of the password hash to prevent reusing similar passwords (for example simply adding a 2). I'll try to find it. – Christian Strempfer Sep 23 '14 at 19:26
  • 4
    Ah sorry, they don't store them, they generate similar passwords on password change to check if one matches with the old one. – Christian Strempfer Sep 23 '14 at 19:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.