Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail password first character is case insensitive on mobile device

support.google.com

Post reply on HN
Print view View original

221–230 of 278 posts

Re: Gmail password first character is case insensitive on mobile device

#221

Post by eterm »

BoorishBears wrote: post #205
eterm wrote: post #197

Earlier quoted context omitted.

You can't compare hashes like that unless they're not salted. The same password won't hash to the same thing without the same salt so you can't compare them like that. (If you could, then you would notice multiple users with the same hashes, i.e. the same passwords). To verify a hash you need to retrieve the user's salt (typically stored with the hash the algorithm in a single string) then re-hash with the same salt.

You're really grilling someone for not fetching salts in psuedocode?

It's not about fetching salts, it's about the whole approach; you literally can't approach it that manner.

Re: Gmail password first character is case insensitive on mobile device

#222

Post by grepfru_it »

For a very long time, Chase bank public websites only accepted the first 8 characters of your password. Anything else was silently dropped. If you used Chase for any loans, credit cards, or banking, you were forced to change your password around 2016ish, this is when they finally resolved this problem. Why? Mainframes.

Bank of America, internally, required you to have two passwords, a Windows and a UNIX password. The UNIX password was only 8 characters due to , you guessed it, mainframes. I don't know if this was ever resolved.

Re: Gmail password first character is case insensitive on mobile device

#223

Post by jsf01 »

miki123211 wrote: post #219
hahajk wrote: post #122

Earlier quoted context omitted.

Is this implemented by Facebook holding 3 hashes of your password? It doesn’t save your actual password clear text (or encrypted clear text), does it? A related question: when a password system tells me I need to change my password, and it has to differ by 3 letters from my previous password, is that system storing my password text rather than the hash of the password? Is that safe?

When you change your password, you're usually required to enter both the old and the new one. This is when the check is usually performed. What I'm more worried about is the system that some Polish banks use, called masked passwords over here. With this system, you're only required to enter certain characters of your password, but the set of required characters changes at each login. This exists to make key loggers m…

Hopefully the bank stores a separate hash for each mask, generated at the time of password creation. Otherwise, it’s hard for me to imagine how this would be possible without saving the password in clear text.

Re: Gmail password first character is case insensitive on mobile device

#224

Post by revicon »

ufmace wrote: post #156

This doesn't bother me that much, but what really grinds my gears is how many sites won't let you log in with the correct username and password. I don't care enough about the account to want to set up 2FA, and I'd rather preserve a bit more privacy by not sharing my real phone number or another email address. Some sites seem to insist, and I think it's more about advertising and anti-spam than actual security. Yahoo…

I think there have been so many password breaches that most sites feel that passwords alone are insufficient for security purposes. Most users reuse passwords and if sites don't enforce 2FA they open themselves up to batch account compromises via script kiddies trying all combos found in the username/password dumps found on various haxor forums.

This is especially true for sites that provide email accounts for users on sites like yahoo which are the 2FA for many other sites a user has accounts on. Gaining access to a yahoo user's email account could allow someone to reset all their passwords on any 3rd account they used that email address for when they signed up.

Re: Gmail password first character is case insensitive on mobile device

#225

Post by repsilat »

jsf01 wrote: post #223
miki123211 wrote: post #219

Earlier quoted context omitted.

When you change your password, you're usually required to enter both the old and the new one. This is when the check is usually performed. What I'm more worried about is the system that some Polish banks use, called masked passwords over here. With this system, you're only required to enter certain characters of your password, but the set of required characters changes at each login. This exists to make key loggers m…

Hopefully the bank stores a separate hash for each mask, generated at the time of password creation. Otherwise, it’s hard for me to imagine how this would be possible without saving the password in clear text.

> a separate hash for each mask

If someone steals a hash for characters 1-4 they'll be able to brute force it. Only 10000x the cost of a single login. And then if you have the hash for characters 2-5...

Re: Gmail password first character is case insensitive on mobile device

#226

Post by bink »

twistedpair wrote: post #140

Ever call Fidelity phone support and hear "enter your password on the keypad"? That means collapsing ~62 chars into 10 char options, a massive space reduction. Then there's the fact that many banking sites (BofA, IIRC) only used the first 8 char of your password anyway.

I'm not sure if this is still true, but at one point you could even use the all numeric version on their website.

Re: Gmail password first character is case insensitive on mobile device

#227

Post by ehsankia »

freemint wrote: post #186
joaomacp wrote: post #126

Earlier quoted context omitted.

It can all be done client-side: the client can try (un)capitalizing the letters after the original password fails

This would be bad for rate limiting though.

It would only half the rate limit, but any real brute force attempt requires way way more than what a normal human would try. Something like 5 attempts would double to 10 in the backend, still nowhere enough to bruteforce, but enough for human trial and error.

Re: Gmail password first character is case insensitive on mobile device

#228

Post by brennopost »

snthd wrote: post #147
josalhor wrote: post #78

This is a well-understood feature. Facebook does the same thing[0]. Quote: Facebook actually accepts three forms of your password: * Your original password. * Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word. * Your original password with the case reversed, for those with a caps lock key on. [0]: https://www.zdnet.com/a…

Facebook doesn't even require you get your login email address 100% right.

Instagram does this too. I can login with one character missing.

Re: Gmail password first character is case insensitive on mobile device

#229

Post by josefx »

remram wrote: post #145
ineedasername wrote: post #129

Earlier quoted context omitted.

They wouldn't have to store 3 hashes, would they? They could just get the hash of each of those transformations, e.g., reverse case, get hash. If the transformation make the incorrect password into the correct one, it will match the original hash.

You can also normalize the password, e.g. always make the first letter lowercase and reverse the case of the rest if the second letter is uppercase. Then you only have to hash that. HeLLo, heLLo, hEllO, HEllO all normalize to heLLo

I hope Facebook passwords are limited to US ASCII, because I seem to remember that there are country specific conversion rules for various Unicode characters that may or may not be subject to change, not to mention the lack of 1:1 mapping for case conversions. Example the German lower case ß converts to SS, so does ss. Of course they also created an upper case variant ẞ of ß a few years ago so who knows what mapping any software will use.

Going further to avoid collisions that could happen between words like massen and maßen when upper cased the rule of thumb was to convert ß to SZ when that happened, so getting the correct upper case would have also required a full German dictionary.

TL;DR: Upper/Lower case conversion is complex, avoid it if possible.

Re: Gmail password first character is case insensitive on mobile device

#230

Post by danachow »

teawrecks wrote: post #200
dylan604 wrote: post #150

Earlier quoted context omitted.

why would you have to retrieve multiple? could you not calculate the 3 hashes, and then do SELECT WHERE pass = HASH1 OR pass = HASH2 OR pass = HASH3? You don't care which one was correct just that one is.

You're now doing up to 3x the work for every login. When servicing millions of requests a second, that cost adds up.

“Up to 3x the work” is very misleading, since the average will be much less than 3.
Post reply on HN