48

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the first letter of my password in uppercase and the rest in lowercase. Again, I got in. How is this even possible? Does Facebook keep a cookie for the password or something?

4

1 Answer 1

57

This is simply Facebook trying to provide a better user experience for those users who may have Caps Lock enabled, or whose devices automatically capitalize the first letter of the password.

I don't think there are any cookies per your question. It is likely that the password hashing and storage is as standard as you would expect. The alternate passwords are probably generated from the password submitted, via the login form, and not stored as alternates on the back end.

It appears that they are only flipping a-zA-Z, and not a mix of incorrect case. They are also checking against a capitalzied first character as pointed out by PwdRsch in the comments.

While this may increase the online brute force attack surface, if you use a password of high entropy, it's pretty unlikely that this would prove to be much of a security risk in my opinion.

i.e:

Password: aBcDeF123
Works:    AbCdEf123  // Flipped Case
Works:    ABcDeF123  // Caps First Char
Doesnt:   ABCDEF123  // Mixed Case
Doesnt:   AbCdEf!@#  // Shifted Numbers
6
  • 13
    This is correct and it has been this way for years. There is a third scenario, which is where Facebook will accept your password with the first letter capitalized even if it isn't normally.
    – PwdRsch
    Sep 23, 2014 at 15:47
  • 7
    Interesting, does Facebook document this anywhere? Sep 23, 2014 at 16:50
  • 2
    I can't find anything, but I don't think the server side authentication process is something that needs to be publicly documented. Sep 23, 2014 at 18:35
  • 4
    Ah sorry, they don't store them, they generate similar passwords on password change to check if one matches with the old one. Sep 23, 2014 at 19:37
  • 2
    @Chris I can remember some fb employee replied to a similar thread. However, I don't see any reason to store variations of the password in hash form. When changing password, they can try to modify the new password with some variations and see if any of them matches their hash in file.
    – AKS
    Sep 24, 2014 at 8:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.