Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail password first character is case insensitive on mobile device

support.google.com

Post reply on HN
Print view View original

11–20 of 278 posts

Re: Gmail password first character is case insensitive on mobile device

#11

Post by nicoburns »

coredev_ wrote: post #8
chris_l wrote: post #2

So they hash both versions of the password? Or how does this work?

Sadly it can also mean that they save your password in a form that enables them to read it if they need/want it.

Unlikely from Google though. They might have a lot of questionable practices, but their security is top draw.

Re: Gmail password first character is case insensitive on mobile device

#14

Post by jikbd »

qwerty1793 wrote: post #7

Similarly there are many sites that allow you to log in using `your password` or `your password`.swapcase() (for example, Password123 or pASSWORD123). Automatically trying a variant only costs a single bit of entropy and can greatly reduce login issues

I remember this being the case on Facebook?

Re: Gmail password first character is case insensitive on mobile device

#16

Post by OJFord »

chris_l wrote: post #4
cotillion wrote: post #3

Earlier quoted context omitted.

They probably just do two password checks.

That's what I meant... hash both versions when logging in.

Ah, it's a bit ambiguous though: not GP, but I read you as meaning do they store both versions' hash and check against either.

Actually I realise GP is equally ambiguous. But I read that as (and my own assumption would be) frontend retries with the variation, backend verifies against the same only one stored.

Re: Gmail password first character is case insensitive on mobile device

#17

Post by iso1210 »

coredev_ wrote: post #8
chris_l wrote: post #2

So they hash both versions of the password? Or how does this work?

Sadly it can also mean that they save your password in a form that enables them to read it if they need/want it.

Assuming the password is sent over the wire (rather than the salt being sent to the client, the client doing the hash, and sending the hash), the password will be stored in memory while the login process runs

Normal password code would be

  if (doHash(password+salt) == storedHash) {
   failedLogins = 0;
   return 1;
  }
  failedLogins++;
  return 0;
This would presumably be

  if (doHash(password+salt) == storedHash) {
   failedLogins = 0;
   return 1;
  }
  if (doHash(swapFirstLetterIfClientIsMobile(password)+salt) == storedHash) {
   failedLogins = 0;
   return 1;
  }
  failedLogins++;
  return 0;
So while the password is 'stored' in the server side heap, it's no different to normal password 'storage'

If the hash is done in the client it's the same, just the client sends two attempts rather than one.

Re: Gmail password first character is case insensitive on mobile device

#18

Post by egeozcan »

jikbd wrote: post #14
qwerty1793 wrote: post #7

Similarly there are many sites that allow you to log in using `your password` or `your password`.swapcase() (for example, Password123 or pASSWORD123). Automatically trying a variant only costs a single bit of entropy and can greatly reduce login issues

I remember this being the case on Facebook?

It was possible to login with the reverse of your password (as in password.split().reverse().join('')).

Re: Gmail password first character is case insensitive on mobile device

#20

Post by Raed667 »

morsch wrote: post #13
chris_l wrote: post #2

So they hash both versions of the password? Or how does this work?

Or just normalize the password by making the first character either lower- or uppercase both when checking and setting it.

It would be more complicated to do this once you stored millions of passwords.

So now you have to create 2 flows, those before the new policy and those that were set after the normalization.

Post reply on HN