The answer to this question depends on two factors:
- the attack vector
- the implementation of allowing different passwords
Websites should store passwords not in plain-text or any other form allowing to get the password from the saved value. Therefore usually a irreversible hash-function is used, so that only the hashes of the passwords are compared.
Now there are mainly two methods of allowing simmilar passwords:
1) (The bad one, should not be used, only for completeness) One could store many different hashes of the user's password in the database. Example: User enters 'abc123' as password, and saved are the hashes of
and so on. Now on login you hash the given password and look if it matches with any password of the user.
2) Only the hash of the real password is saved, and on login time the given password gets altered (if the original one doesn't match) and the resulting salts are compared to the one in the database.
Now to different attack vectors:
If someone gets the database described in method 1, the security is a little weaker than normaly, because there are many different hashes for the user and the chances are higher that one may be found. With the database from method 2, there is only one hash, and the exact spelling has to be found.
Generally speaking, you have more enthropy in your character space with the second method, because you make a difference between Upper- and Lower-Case letters.
For an attacker holding the database (as long as it is made the reasonable way) there is no security deficit with this approach.
But in the case of a brute-force attack on the website there is allways a higher chance for the attacker to successfully log in to the users account. Therefore additional actions have to be taken to prevent this kind of attack!