Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail password first character is case insensitive on mobile device

support.google.com

Post reply on HN
Print view View original

51–60 of 278 posts

Re: Gmail password first character is case insensitive on mobile device

#51

Post by mnahkies »

Levitz wrote: post #36
mnahkies wrote: post #5

Earlier quoted context omitted.

Yeah we did it this way on an app I worked on in the past, try the verbatim input and then a couple of minor variations in casing if it didn't work. I've also found that for email fields you need to be careful to normalize the input (trim, casing) as safari had a habit of autocorrecting the first character to be a capital

>I've also found that for email fields you need to be careful to normalize the input (trim, casing) as safari had a habit of autocorrecting the first character to be a capital Why is that relevant? The standard technically allows for case sensitivity but nobody does it

It can be problematic when you go to look up the account by email address during login and it isn't found due to inconsistent casing.

It's technically true that the part before the domain can be case sensitive, but as nobody does this the gain in UX from people not having to know the exact casing used during sign-up is worth it to me.

Re: Gmail password first character is case insensitive on mobile device

#52

Post by McMiniBurger »

foepys wrote: post #46
qwerty1793 wrote: post #7

Similarly there are many sites that allow you to log in using `your password` or `your password`.swapcase() (for example, Password123 or pASSWORD123). Automatically trying a variant only costs a single bit of entropy and can greatly reduce login issues

This doesn't always work by the way. When you venture outside of ASCII, it's quite often uppercase(lowercase(x)) ≠ uppercase(x) and/or the other way around. The German letter ß gets uppercased to SS instead of ẞ by most libraries in a neutral/generic culture. ẞ on the other hand gets lowercased to ß. This happens because there wasn't an official ẞ in German until recently but the uppercasing/lowercasing standard was…

but don't password fields only recognize ascii?

it seems i just can't type korean to password fields

Re: Gmail password first character is case insensitive on mobile device

#53

Post by Closi »

morsch wrote: post #13
chris_l wrote: post #2

So they hash both versions of the password? Or how does this work?

Or just normalize the password by making the first character either lower- or uppercase both when checking and setting it.

Sounds like the requirement might be for the case insensitivity of the first character to only be for some platforms (eg mobile devices where autocapitalisation might have happened).

In that case this solution would have the disadvantage that it wouldn’t be platform specific.

Re: Gmail password first character is case insensitive on mobile device

#54

Post by skitter »

foepys wrote: post #46
qwerty1793 wrote: post #7

Similarly there are many sites that allow you to log in using `your password` or `your password`.swapcase() (for example, Password123 or pASSWORD123). Automatically trying a variant only costs a single bit of entropy and can greatly reduce login issues

This doesn't always work by the way. When you venture outside of ASCII, it's quite often uppercase(lowercase(x)) ≠ uppercase(x) and/or the other way around. The German letter ß gets uppercased to SS instead of ẞ by most libraries in a neutral/generic culture. ẞ on the other hand gets lowercased to ß. This happens because there wasn't an official ẞ in German until recently but the uppercasing/lowercasing standard was…

Another case where it doesn't work is with keyboard layouts that use shift lock instead of caps lock.

Re: Gmail password first character is case insensitive on mobile device

#55

Post by johannes1234321 »

foepys wrote: post #46
qwerty1793 wrote: post #7

Similarly there are many sites that allow you to log in using `your password` or `your password`.swapcase() (for example, Password123 or pASSWORD123). Automatically trying a variant only costs a single bit of entropy and can greatly reduce login issues

This doesn't always work by the way. When you venture outside of ASCII, it's quite often uppercase(lowercase(x)) ≠ uppercase(x) and/or the other way around. The German letter ß gets uppercased to SS instead of ẞ by most libraries in a neutral/generic culture. ẞ on the other hand gets lowercased to ß. This happens because there wasn't an official ẞ in German until recently but the uppercasing/lowercasing standard was…

Thjs becomes even nkre fun with the Turkish i, which looks innocent, but doesn't necessarily become I. http://www.i18nguy.com/unicode/turkish-i18n.html

Re: Gmail password first character is case insensitive on mobile device

#56

Post by jeroenhd »

McMiniBurger wrote: post #52
foepys wrote: post #46

Earlier quoted context omitted.

This doesn't always work by the way. When you venture outside of ASCII, it's quite often uppercase(lowercase(x)) ≠ uppercase(x) and/or the other way around. The German letter ß gets uppercased to SS instead of ẞ by most libraries in a neutral/generic culture. ẞ on the other hand gets lowercased to ß. This happens because there wasn't an official ẞ in German until recently but the uppercasing/lowercasing standard was…

but don't password fields only recognize ascii? it seems i just can't type korean to password fields

Most competent websites I know accept general UTF8 characters like emoji perfectly fine. There are a lot of crappier websites that don't even have proper unicode support for usernames or profile descriptions out there, though, so your mileage may vary.

As far as I know, there's nothing preventing a password field from containing any valid unicode string. The problem may be IME support or servers stuck in ASCII, but the textbox itself will just work.

Re: Gmail password first character is case insensitive on mobile device

#58

Post by weird-eye-issue »

pixl97 wrote: post #47
weird-eye-issue wrote: post #42

Earlier quoted context omitted.

is_password_valid = hash_password(normalize_password_case(password) if version == 1 else password) == hashed_password

Are we doing this client side or server side? If you're actually using a 'strong enough' hash to prevent easy cracking if your hashed password database is leaked then you're doubling the server load which can be quite substantial in some cases.

It's only being hashed once...

And obviously this is server side

Re: Gmail password first character is case insensitive on mobile device

#59

Post by pawelmurias »

markenqualitaet wrote: post #40
Raed667 wrote: post #31

Earlier quoted context omitted.

It is definitely more complicated than changing the case and running the hash again

Why?

Because you are changing the daabase schema to introduce a stupid version field to store "normalized" passwords rather then just doing the check twice on mobile platforms.

Re: Gmail password first character is case insensitive on mobile device

#60

Post by [deleted] »

jeroenhd wrote: post #56
McMiniBurger wrote: post #52

Earlier quoted context omitted.

but don't password fields only recognize ascii? it seems i just can't type korean to password fields

Most competent websites I know accept general UTF8 characters like emoji perfectly fine. There are a lot of crappier websites that don't even have proper unicode support for usernames or profile descriptions out there, though, so your mileage may vary. As far as I know, there's nothing preventing a password field from containing any valid unicode string. The problem may be IME support or servers stuck in ASCII, but t…

[deleted]
Post reply on HN