Gmail password first character is case insensitive on mobile device • Hacker News Board

Re: Gmail password first character is case insensitive on mobile device

#211

Post by jacurtis » Sat, Oct 09, 2021, 5:36 PM UTC

freemint wrote: post #186

joaomacp wrote: post #126

Earlier quoted context omitted.

It can all be done client-side: the client can try (un)capitalizing the letters after the original password fails

This would be bad for rate limiting though.

Note that the client would only need to do this on a failed attempt.

So if i typed "Password" on mobile. The client would first send the request as "Password". If that succeeds, then no worries. If it fails, then the client could send a second request by reversing the case of the first letter. In this case, it would send a second request for "password".

At most, it is 2 login requests per password. Many other commenters here are incorrectly stating that 3 requests would be necessary, but this is untrue. A letter can only have 2 possible cases (uppercase or lowercase). So the client sends the originally typed one, and if that fails, then it flips the case of that first letter. That is the only alternative. There is not a third option.

A well-built login form would restrict users after 3-5 login attempts anyway and require a password-reset process. So that is 6-10 client requests to the backend (n * 2). That shouldn't be hitting any sort of rate limit.

Re: Gmail password first character is case insensitive on mobile device

#212

Post by nitrogen » Sat, Oct 09, 2021, 5:38 PM UTC

freemint wrote: post #183

rovr138 wrote: post #169

Earlier quoted context omitted.

Doing this reduces way more the space of characters and reduces security.

It reduces the password strength by at most two bits. For passwords made solely of non letters there is no reduction in password strength.

It's one bit per alphabetic character, isn't it?

Re: Gmail password first character is case insensitive on mobile device

#213

Post by nitrogen » Sat, Oct 09, 2021, 5:42 PM UTC

juloo wrote: post #203

cylon13 wrote: post #192

Earlier quoted context omitted.

More importantly if the server just accepts hashed passwords and stores them, then if you got ahold of a hashed password through a leak you could just use it directly to authenticate by modifying the client. The hashed password just becomes the password with one extra client-side step that you can trivially skip. Salting is more about making it non-obvious which passwords map to which hashes so you can’t easily build…

The server could hash again the hashed password sent by the client. Especially if the client use an insecure hash algorithm (no secret salt for example). I feel like if the client always hash passwords as soon as it is typed (the javascript never sees the unhashed password), no one would notice. (except some with crazy password rules that would disallow a hash-looking password)

There are formalized approaches to keeping the server from knowing the password at any time: https://en.m.wikipedia.org/wiki/Password-authenticated_key_a...

SRP is one such system: https://en.m.wikipedia.org/wiki/Secure_Remote_Password_proto...

Re: Gmail password first character is case insensitive on mobile device

#214

Post by smrq » Sat, Oct 09, 2021, 5:44 PM UTC

nitrogen wrote: post #212

freemint wrote: post #183

Earlier quoted context omitted.

It reduces the password strength by at most two bits. For passwords made solely of non letters there is no reduction in password strength.

It's one bit per alphabetic character, isn't it?

No, it's only one bit for the first character and one for the second. The case of every other character is maintained relative to the second character, so the parity there provides the one bit of information for each subsequent alphabetic character.

Re: Gmail password first character is case insensitive on mobile device

#215

Post by dado3212 » Sat, Oct 09, 2021, 5:57 PM UTC

caymanjim wrote: post #209

spicybright wrote: post #158

Earlier quoted context omitted.

Really?

They might do the same stupid thing Gmail does, and ignore certain characters. My Gmail is "first.m.last@gmail.com", but I constantly get mail from idiots who don't know their own email address, and use my "firstmlast@gmail.com" to sign up for things. This problem would go away entirely if Gmail didn't do this. Facebook might do similar things to make it "easier" to login, even though there are security implications.

That’s by design though, the .‘s are optional. You can add more even. Also plus routing: first.m.last+whatever@gmail.com also routes to the same email.

Re: Gmail password first character is case insensitive on mobile device

#216

Post by jacurtis » Sat, Oct 09, 2021, 6:04 PM UTC

jodrellblank wrote: post #146

Aachen wrote: post #81

Earlier quoted context omitted.

Why not simply leave it as the user input the value? Validation is one thing, but silently dropping information cannot possibly be helpful for the person that then has to call this number. I agree it should work for any phone number I've ever encountered, but just why

Will it work for the convention in the UK of writing +44 (0)1234 567 8901 which says to use 01234 dialling code inside the UK or 441234 if calling from another country, and don’t dial 4401234 ever?

A truly global phone number regex is quite literally impossible to make. There are too many combinations and expectations built into these conventions. You listed several here.

The "best" solution is to separate country code into a different field or input. Then have everything other than the country code (generally called a "subscriber number") added to another input.

Then on the backend you would essentially strip out all the non-numeric characters from the subscriber number and combine the country code and stripped "subscriber number" into an E.164 format number and store that in the database.

(Source) I have spent a decade dealing with phone numbers in databases and web forms. This is the "best" way to handle it, and even it isn't bulletproof, but it works 99.8% of the time. The best way to handle the other 0.2% of cases is to make a descriptive error message that explains to the user how you are expecting them to input their number (ie. No extensions, etc).

Here is the E.164 standard: https://www.itu.int/rec/T-REC-E.164/

Re: Gmail password first character is case insensitive on mobile device

#217

Post by nitrogen » Sat, Oct 09, 2021, 6:10 PM UTC

smrq wrote: post #214

nitrogen wrote: post #212

Earlier quoted context omitted.

It's one bit per alphabetic character, isn't it?

No, it's only one bit for the first character and one for the second. The case of every other character is maintained relative to the second character, so the parity there provides the one bit of information for each subsequent alphabetic character.

Whoops, I didn't notice that the two L's were still capitalized in the normalization example a few comments up.

Re: Gmail password first character is case insensitive on mobile device

#218

Post by lostlogin » Sat, Oct 09, 2021, 6:23 PM UTC

dado3212 wrote: post #215

caymanjim wrote: post #209

Earlier quoted context omitted.

They might do the same stupid thing Gmail does, and ignore certain characters. My Gmail is "first.m.last@gmail.com", but I constantly get mail from idiots who don't know their own email address, and use my "firstmlast@gmail.com" to sign up for things. This problem would go away entirely if Gmail didn't do this. Facebook might do similar things to make it "easier" to login, even though there are security implications.

That’s by design though, the .‘s are optional. You can add more even. Also plus routing: first.m.last+whatever@gmail.com also routes to the same email.

Well, I’ve learned something, thanks.

“ Gmail doesn't recognize periods as characters in addresses -- we just ignore them. For example, you could tell people your address was hikingfan@gmail.com, hiking.fan@gmail.com or hi.kin.g.fan@gmail.com. (We understand that there has been some confusion about this in the past, but to settle it once and for all, you can indeed receive mail at all the variations with dots.)”

https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...

Re: Gmail password first character is case insensitive on mobile device

#219

Post by miki123211 » Sat, Oct 09, 2021, 6:24 PM UTC

hahajk wrote: post #122

josalhor wrote: post #78

This is a well-understood feature. Facebook does the same thing[0]. Quote: Facebook actually accepts three forms of your password: * Your original password. * Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word. * Your original password with the case reversed, for those with a caps lock key on. [0]: https://www.zdnet.com/a…

Is this implemented by Facebook holding 3 hashes of your password? It doesn’t save your actual password clear text (or encrypted clear text), does it? A related question: when a password system tells me I need to change my password, and it has to differ by 3 letters from my previous password, is that system storing my password text rather than the hash of the password? Is that safe?

When you change your password, you're usually required to enter both the old and the new one. This is when the check is usually performed.

What I'm more worried about is the system that some Polish banks use, called masked passwords over here. With this system, you're only required to enter certain characters of your password, but the set of required characters changes at each login. This exists to make key loggers much less effective. There's apparently some hashing going on (something to do with curves and polynomials), but I couldn't find more details when I last looked.

Re: Gmail password first character is case insensitive on mobile device

#220

Post by [deleted] » Sat, Oct 09, 2021, 6:38 PM UTC

hallway_monitor wrote: post #102

johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

This is definitely a feature and not a bug. I was a little worried when we implemented this 5 years ago, but it turns out there's no real security risk here. My app was a financial app and so many people had trouble logging in on mobile that we basically had to implement this.

[deleted]