Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail password first character is case insensitive on mobile device

support.google.com

Post reply on HN
Print view View original

101–110 of 278 posts

Re: Gmail password first character is case insensitive on mobile device

#101

Post by johnnyApplePRNG »

st3fan wrote: post #75
johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

That is a text field feature, not a keyboard feature. Google controls all the text fields for gmail. Both in the web version and in their native apps.

It is indeed [0], but there's about 14% of the browser world who can't benefit from it yet [1].

[0] https://developer.mozilla.org/en-US/docs/Web/HTML/Global_att...

[1] https://caniuse.com/mdn-api_htmlelement_autocapitalize

Re: Gmail password first character is case insensitive on mobile device

#102

Post by hallway_monitor »

johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

This is definitely a feature and not a bug. I was a little worried when we implemented this 5 years ago, but it turns out there's no real security risk here. My app was a financial app and so many people had trouble logging in on mobile that we basically had to implement this.

Re: Gmail password first character is case insensitive on mobile device

#103

Post by attheicearcade »

jhgb wrote: post #88
josalhor wrote: post #78

This is a well-understood feature. Facebook does the same thing[0]. Quote: Facebook actually accepts three forms of your password: * Your original password. * Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word. * Your original password with the case reversed, for those with a caps lock key on. [0]: https://www.zdnet.com/a…

It seems to me that the third case could easily be subsumed by first transforming the text by inserting a "change case" token in front of any character with a different case than the previous character. In such a representation the original text and the "caps-locked" text are indistinguishable.

And then when management decides they don't want this feature anymore, you're stuck with it.

Re: Gmail password first character is case insensitive on mobile device

#104

Post by p49k »

Aachen wrote: post #87
p49k wrote: post #41

Earlier quoted context omitted.

For a long time, in some browsers/OSes there was a bug (or perhaps an archaic feature that was accidentally triggered) where the cursor in an input could get stuck and cause all new characters to be inserted to the left; I'm assuming it's related to that.

This is the first I've heard of it, and as a Linux user I feel like it's the kind of thing I'd either know about or experienced first-hand. What kind of system would do that? And "for a long time", like, you can't ever login anywhere, it's kind of obvious and breaking functionality badly, how can this exist for more than a single release if at all?

To be clear, it’s intermittent. Perhaps one in 500 times an input is focused, it exhibits this behavior.

I have experienced this so many times over my life with so many different hardware/software configurations, and I have to assume others have as well. It hasn’t happened in years but could explain why the “fix” described in the parent post was implemented.

Re: Gmail password first character is case insensitive on mobile device

#105

Post by the_gipsy »

squeaky-clean wrote: post #45
the_gipsy wrote: post #38

Earlier quoted context omitted.

Even if it’s encrypted, they could send both forms. Edit: not a good idea.

I'm no security expert, but this would let someone try two unrelated passwords at once and so probably wouldn't be done client-side.

Ouch, you are right.

Re: Gmail password first character is case insensitive on mobile device

#106

Post by vbezhenar »

wcoenen wrote: post #96
pansa2 wrote: post #86

Earlier quoted context omitted.

>>> exit Use exit() or Ctrl-Z plus Return to exit

This is different, there is no special case handling here for you typing "exit". Python functions are invoked with parenthesis, while typing a name without parenthesis retrieves the content of a variable. The Python CLI helpfully sets the "exit" variable to that string so that you don't get a confusing NameError when you make this mistake.

It is result of calling `exit.__str__()`. This function could have called exit() itself instead.

Re: Gmail password first character is case insensitive on mobile device

#107

Post by xrisk »

Freak_NL wrote: post #97
cute_boi wrote: post #84

Earlier quoted context omitted.

sounds like python which don't accept ctrl + c and says you to do ctrl + d or something (i don't know python)

Using Ctrl + D to exit a shell and Ctrl + C to interrupt/break off the current line is a rather strong convention. Bash does this too, and many other REPL's and shells (Ruby's irb for one). A lot of technical folk who rely on this immediately notice when some shell doesn't do this (exiting instead of breaking of the current input line). I have this with Hbase's hbase shell. I've dropped out of that by accident dozens…

FWIW, Ctrl+D is not "magic". It works because Ctrl+D is EOF. Applications that read input should expect that the input is done when they encounter EOF.

Re: Gmail password first character is case insensitive on mobile device

#108

Post by vfistri2 »

doesn't that mean they are storing plain text/reversible encrypted passwords? I have gmail and facebook accounts way before mobile was invented, if they've added that feature for mobile imho it means password was stored in plain text or with 2 way encryption

Re: Gmail password first character is case insensitive on mobile device

#109

Post by yatac42 »

wcoenen wrote: post #96
pansa2 wrote: post #86

Earlier quoted context omitted.

>>> exit Use exit() or Ctrl-Z plus Return to exit

This is different, there is no special case handling here for you typing "exit". Python functions are invoked with parenthesis, while typing a name without parenthesis retrieves the content of a variable. The Python CLI helpfully sets the "exit" variable to that string so that you don't get a confusing NameError when you make this mistake.

If the `exit` variable were set to a string, `exit()` would be an error because you can't use `()` on strings. `exit` is a callable whose `__str__` method returns that message.

Note that this isn't specific to the REPL. Running `print(exit)` in a Python script will print the same message.

Re: Gmail password first character is case insensitive on mobile device

#110

Post by drchickensalad »

vfistri2 wrote: post #108

doesn't that mean they are storing plain text/reversible encrypted passwords? I have gmail and facebook accounts way before mobile was invented, if they've added that feature for mobile imho it means password was stored in plain text or with 2 way encryption

You just store multiple hashes, and don't support it retroactively
Post reply on HN