Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail password first character is case insensitive on mobile device

support.google.com

Post reply on HN
Print view View original

201–210 of 278 posts

Re: Gmail password first character is case insensitive on mobile device

#201

Post by jeltz »

cylon13 wrote: post #192
phailhaus wrote: post #189

Earlier quoted context omitted.

Why? If you hash on the server, then you have to send the password in plaintext to the server. EDIT: Oh right, salts.

More importantly if the server just accepts hashed passwords and stores them, then if you got ahold of a hashed password through a leak you could just use it directly to authenticate by modifying the client. The hashed password just becomes the password with one extra client-side step that you can trivially skip. Salting is more about making it non-obvious which passwords map to which hashes so you can’t easily build…

If you do not want to send them in plain text you can use SCRAM.

Re: Gmail password first character is case insensitive on mobile device

#202

Post by atoav »

johnchristopher wrote: post #119
atoav wrote: post #68

Earlier quoted context omitted.

This is like when on a cli application -h displays a hint that you probably meant --help (or the other way around). If you already know someone wants to display the help, why not just display it?

Last time I complained about something like that https://news.ycombinator.com/item?id=27951099 (it's okay to quote myself, right ? I am allowed to ?) I was told it's a UX FEATURE and apparently some people like to be treated like that when interacting with computers. ¯\_(ツ)_/¯

While I agree with that usage in the example you mentioned in your post over there, I don't think it applies here.

Some applications use -h and some --help. Many support both. So unless we get all software to agree on one standard here, expecting your user to remember which one it was is actually bad UX in my book. Best is to just support both, so people don't have to think about how to get the help.

Displaying a notice when some option changed makes totally sense tho, but -h/--help is not that kind of issue.

Re: Gmail password first character is case insensitive on mobile device

#203

Post by juloo »

cylon13 wrote: post #192
phailhaus wrote: post #189

Earlier quoted context omitted.

Why? If you hash on the server, then you have to send the password in plaintext to the server. EDIT: Oh right, salts.

More importantly if the server just accepts hashed passwords and stores them, then if you got ahold of a hashed password through a leak you could just use it directly to authenticate by modifying the client. The hashed password just becomes the password with one extra client-side step that you can trivially skip. Salting is more about making it non-obvious which passwords map to which hashes so you can’t easily build…

The server could hash again the hashed password sent by the client. Especially if the client use an insecure hash algorithm (no secret salt for example).

I feel like if the client always hash passwords as soon as it is typed (the javascript never sees the unhashed password), no one would notice. (except some with crazy password rules that would disallow a hash-looking password)

Re: Gmail password first character is case insensitive on mobile device

#204

Post by martincmartin »

lelandfe wrote: post #154
martincmartin wrote: post #79

Earlier quoted context omitted.

But the changing isn't user visible. To the user, the phone number is the string "(416) 555-1270". If you want to store it differently in your database go ahead. But to the user, the phone number has dashes. In fact, on my phone, when I type in just the digits, my phone inserts the parens and dashes. Presumably, users consider this easier to read, and dare I say, more canonical. So, many applications can't handle pho…

> I just want a phone number input box that will strip dashes for me. So you don't actually want the input box to strip dashes, right? It sounds like you want more sites to accept dashes.

Very true. I wasn't very precise in my original comment.

Re: Gmail password first character is case insensitive on mobile device

#205

Post by BoorishBears »

eterm wrote: post #197
dylan604 wrote: post #164

Earlier quoted context omitted.

good lord, why would you ever expect psuedo code to be my level of understanding of how to store a password. i don't ever store passwords. hashes only.

You can't compare hashes like that unless they're not salted. The same password won't hash to the same thing without the same salt so you can't compare them like that. (If you could, then you would notice multiple users with the same hashes, i.e. the same passwords). To verify a hash you need to retrieve the user's salt (typically stored with the hash the algorithm in a single string) then re-hash with the same salt.

You're really grilling someone for not fetching salts in psuedocode?

Re: Gmail password first character is case insensitive on mobile device

#206

Post by lordgrenville »

teawrecks wrote: post #200
dylan604 wrote: post #150

Earlier quoted context omitted.

why would you have to retrieve multiple? could you not calculate the 3 hashes, and then do SELECT WHERE pass = HASH1 OR pass = HASH2 OR pass = HASH3? You don't care which one was correct just that one is.

You're now doing up to 3x the work for every login. When servicing millions of requests a second, that cost adds up.

I would imagine it's sequential: check exact match hash, if it fails check uppercase-initial-hash, etc.

Re: Gmail password first character is case insensitive on mobile device

#207

Post by dylan604 »

adolph wrote: post #188
brigandish wrote: post #180

Earlier quoted context omitted.

Because the pseudo code looks quite bad? The clause should pick the user not the password or hash or anything like it. The hash (and possibly salt etc) should come back via the selected column list. The other way round is inviting trouble and could indicate a poor understanding, though I agree they shouldn't be so snarky without some explanation.

Unless it has been edited since i saw it, the pseudo sql doesn’t select anything, a logical assumption is user identity and not needed. The comparison is between the original hashed password and the hashes made at auth-time. The name of the original is “pass” but since it wouldn’t make sense to compare a plaintext string to a hash another logical assumption is that “pass” is a hash. Maybe these generous assumptions a…

Jeebus, it's just meant to show that you could do a select in one go without having to do them one at a time cascading to the next one if no match. I don't know what you need to select, that's up to the reader. That's the point of psuedo code. You saw select and made the connection to "it's a database query". Boom. point made. Again, I understand the concept of user provided pass and a hash with a salt. If you can't really put 2+2 together to see that you're taking the 3 different options then I'm sorry for you.

Re: Gmail password first character is case insensitive on mobile device

#208

Post by JeffRosenberg »

cdubzzz wrote: post #113
frosted-flakes wrote: post #73

Earlier quoted context omitted.

I just stick an "A!" on the end of my otherwise complex password to satisfy these stupid rules. The worst is when they don't even allow spaces.

I recently had to (for work) create an account on website with a password “strength” indicator and the following limitations: - At least one upper case - At least one lower case - At least one number, but not as the first character and no two numbers in a row - No special characters - Maximum characters: 8 There was a minimum too but I can’t recall what it was. Hopefully 7 for maximum security. My randomly generated…

I recently had to create accounts for work benefits at TWO different sites that had user name complexity requirements, and actually rated the strength of my user name! That's something I had never seen before, and it seems pretty misguided.

The worst of these also had a 20 character password limit (at least it wasn't 8!), along with several of these nonsense requirements that limit repeated characters. I couldn't manage to generate a password they would accept. Eventually I realized that not only did they allow only certain specific special characters, but their password length validation was wrong and would only accept 19 characters because they were testing for <= 20.

Re: Gmail password first character is case insensitive on mobile device

#209

Post by caymanjim »

spicybright wrote: post #158
snthd wrote: post #147

Earlier quoted context omitted.

Facebook doesn't even require you get your login email address 100% right.

Really?

They might do the same stupid thing Gmail does, and ignore certain characters. My Gmail is "first.m.last@gmail.com", but I constantly get mail from idiots who don't know their own email address, and use my "firstmlast@gmail.com" to sign up for things. This problem would go away entirely if Gmail didn't do this. Facebook might do similar things to make it "easier" to login, even though there are security implications.

Re: Gmail password first character is case insensitive on mobile device

#210

Post by jsnell »

teawrecks wrote: post #200
dylan604 wrote: post #150

Earlier quoted context omitted.

why would you have to retrieve multiple? could you not calculate the 3 hashes, and then do SELECT WHERE pass = HASH1 OR pass = HASH2 OR pass = HASH3? You don't care which one was correct just that one is.

You're now doing up to 3x the work for every login. When servicing millions of requests a second, that cost adds up.

Passwords are only verified on login. Does it seems reasonable that there are millions of logins to Gmail from mobile devices every second?

Back of the envelope: 2 million logins per second would mean about 170 billion logins per day. With 7 billion people on the planet, that'd mean about 25 logins per day from each man, woman and child.

Post reply on HN