Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail password first character is case insensitive on mobile device

support.google.com

Post reply on HN
Print view View original

181–190 of 278 posts

Re: Gmail password first character is case insensitive on mobile device

#181

Post by kevincox »

listenallyall wrote: post #178
kevincox wrote: post #92

Earlier quoted context omitted.

That makes sense if you are making a contact book or social profile. I was focusing on the case where I want the number as contact information. I want to validate up front that it is a number that I can actually call and don't really care about how the user wants to format it.

Right, but it's user-hostile. I prefer thinking of, and typing, my phone number as a mix of numbers and letters... so why won't you allow me to do so?

I am letting you. It is just when the number is sent to the backend it is converted into a usable format where I can for example generate tel: links and otherwise use the number. I agree that there is some value to being able to each your number back how you typed it, but I'm not sure it is more valuable then showing you the number how I am actually going to try to call it.

Re: Gmail password first character is case insensitive on mobile device

#182

Post by adolph »

dylan604 wrote: post #150
adolph wrote: post #137

Earlier quoted context omitted.

I think that’s a likely route. It’s a question of what is more efficient, compute of hash or storage/retrieval and comparison to multiple. To implement, choice of storing three hashes or computing n * hashes where n < 1, the probability of getting a match before having to try another.

why would you have to retrieve multiple? could you not calculate the 3 hashes, and then do SELECT WHERE pass = HASH1 OR pass = HASH2 OR pass = HASH3? You don't care which one was correct just that one is.

You can push the comparison into sql but you still have a series of retrievals and comparisons. Just because it happens in sql doesn’t mean the processes don’t have to happen. In your example you have calculated three hashes, then pushed them to the sql server where the retrieval and comparison occurs.

Re: Gmail password first character is case insensitive on mobile device

#183

Post by freemint »

rovr138 wrote: post #169
remram wrote: post #145

Earlier quoted context omitted.

You can also normalize the password, e.g. always make the first letter lowercase and reverse the case of the rest if the second letter is uppercase. Then you only have to hash that. HeLLo, heLLo, hEllO, HEllO all normalize to heLLo

Doing this reduces way more the space of characters and reduces security.

It reduces the password strength by at most two bits. For passwords made solely of non letters there is no reduction in password strength.

Re: Gmail password first character is case insensitive on mobile device

#184

Post by cylon13 »

delaaxe wrote: post #174
ineedasername wrote: post #129

Earlier quoted context omitted.

They wouldn't have to store 3 hashes, would they? They could just get the hash of each of those transformations, e.g., reverse case, get hash. If the transformation make the incorrect password into the correct one, it will match the original hash.

Oh you mean the client sends 3 hashes and backend validates if just one matches?

Hashing is done on the server. Hashing on the client would defeat the whole purpose.

Re: Gmail password first character is case insensitive on mobile device

#185

Post by freemint »

delaaxe wrote: post #174
ineedasername wrote: post #129

Earlier quoted context omitted.

They wouldn't have to store 3 hashes, would they? They could just get the hash of each of those transformations, e.g., reverse case, get hash. If the transformation make the incorrect password into the correct one, it will match the original hash.

Oh you mean the client sends 3 hashes and backend validates if just one matches?

The client usually doesn't send hashes of passwords. Has he's are computed server side. Sending client side hashes beings no benefits

Re: Gmail password first character is case insensitive on mobile device

#186

Post by freemint »

joaomacp wrote: post #126
hahajk wrote: post #122

Earlier quoted context omitted.

Is this implemented by Facebook holding 3 hashes of your password? It doesn’t save your actual password clear text (or encrypted clear text), does it? A related question: when a password system tells me I need to change my password, and it has to differ by 3 letters from my previous password, is that system storing my password text rather than the hash of the password? Is that safe?

It can all be done client-side: the client can try (un)capitalizing the letters after the original password fails

This would be bad for rate limiting though.

Re: Gmail password first character is case insensitive on mobile device

#187

Post by konschubert »

joaomacp wrote: post #126
hahajk wrote: post #122

Earlier quoted context omitted.

Is this implemented by Facebook holding 3 hashes of your password? It doesn’t save your actual password clear text (or encrypted clear text), does it? A related question: when a password system tells me I need to change my password, and it has to differ by 3 letters from my previous password, is that system storing my password text rather than the hash of the password? Is that safe?

It can all be done client-side: the client can try (un)capitalizing the letters after the original password fails

And it should. Better not to clutter the security-critical parts of the back end.

Re: Gmail password first character is case insensitive on mobile device

#188

Post by adolph »

brigandish wrote: post #180
dylan604 wrote: post #164

Earlier quoted context omitted.

good lord, why would you ever expect psuedo code to be my level of understanding of how to store a password. i don't ever store passwords. hashes only.

Because the pseudo code looks quite bad? The clause should pick the user not the password or hash or anything like it. The hash (and possibly salt etc) should come back via the selected column list. The other way round is inviting trouble and could indicate a poor understanding, though I agree they shouldn't be so snarky without some explanation.

Unless it has been edited since i saw it, the pseudo sql doesn’t select anything, a logical assumption is user identity and not needed. The comparison is between the original hashed password and the hashes made at auth-time. The name of the original is “pass” but since it wouldn’t make sense to compare a plaintext string to a hash another logical assumption is that “pass” is a hash.

Maybe these generous assumptions about someone’s pseudo code are unwarranted?

Re: Gmail password first character is case insensitive on mobile device

#189

Post by phailhaus »

cylon13 wrote: post #184
delaaxe wrote: post #174

Earlier quoted context omitted.

Oh you mean the client sends 3 hashes and backend validates if just one matches?

Hashing is done on the server. Hashing on the client would defeat the whole purpose.

Why? If you hash on the server, then you have to send the password in plaintext to the server.

EDIT: Oh right, salts.

Re: Gmail password first character is case insensitive on mobile device

#190

Post by remram »

rovr138 wrote: post #169
remram wrote: post #145

Earlier quoted context omitted.

You can also normalize the password, e.g. always make the first letter lowercase and reverse the case of the rest if the second letter is uppercase. Then you only have to hash that. HeLLo, heLLo, hEllO, HEllO all normalize to heLLo

Doing this reduces way more the space of characters and reduces security.

It reduces the space of passwords just as much as having the backend try those same combinations for every query.
Post reply on HN