Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail password first character is case insensitive on mobile device

support.google.com

Post reply on HN
Print view View original

231–240 of 278 posts

Re: Gmail password first character is case insensitive on mobile device

#231

Post by BrandoElFollito »

miki123211 wrote: post #219
hahajk wrote: post #122

Earlier quoted context omitted.

Is this implemented by Facebook holding 3 hashes of your password? It doesn’t save your actual password clear text (or encrypted clear text), does it? A related question: when a password system tells me I need to change my password, and it has to differ by 3 letters from my previous password, is that system storing my password text rather than the hash of the password? Is that safe?

When you change your password, you're usually required to enter both the old and the new one. This is when the check is usually performed. What I'm more worried about is the system that some Polish banks use, called masked passwords over here. With this system, you're only required to enter certain characters of your password, but the set of required characters changes at each login. This exists to make key loggers m…

Is this still the case? When living in Poland 15 years ago I had an account with WBK and they had this idiotic system where I had to write my password on a piece of paper with numbers below to be able to give the 3rd, 5th and 11th character. Goodbye password managers (at least the automatization part).

Then, suddenly, they got back to a normal login and password (I think I had the choice IIRC) but then I left the country.

Poland is a beautiful country, I lived in Krakow for a few years and it was A-WE-SOME.

Re: Gmail password first character is case insensitive on mobile device

#232

Post by [deleted] »

josefx wrote: post #229
remram wrote: post #145

Earlier quoted context omitted.

You can also normalize the password, e.g. always make the first letter lowercase and reverse the case of the rest if the second letter is uppercase. Then you only have to hash that. HeLLo, heLLo, hEllO, HEllO all normalize to heLLo

I hope Facebook passwords are limited to US ASCII, because I seem to remember that there are country specific conversion rules for various Unicode characters that may or may not be subject to change, not to mention the lack of 1:1 mapping for case conversions. Example the German lower case ß converts to SS, so does ss. Of course they also created an upper case variant ẞ of ß a few years ago so who knows what mapping…

[deleted]

Re: Gmail password first character is case insensitive on mobile device

#233

Post by mrb »

As an ex-Googler in the Information Security Engineering team who has looked at our implementation of password authentication, I confirm this is a feature, not a bug. (Some old mobile devices auto-capitalize of the first character typed in a text field.) That said, I can't remember of the top of my head if we just ignored the case altogether or if the logic was more restrictive (eg. if first char is uppercase, also allow its lowercase version.) Last time I looked at the code was 6 years ago.

Pretty sure this is a detail documented somewhere public-facing

Re: Gmail password first character is case insensitive on mobile device

#234

Post by AlexanderTheGr8 »

johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

if your pw was "abcd", then "Abcd" should work, right? Because it auto-capitalizes the first character of the first word. If your pw was "ABCD", then "abcd" (all-small) should be accepted because it auto-capitalizes and then you press the capital key once for caps, so it becomes all small.

Did I get anything wrong?

Re: Gmail password first character is case insensitive on mobile device

#236

Post by throw_m239339 »

ourmandave wrote: post #62

So many sites require "at least one uppercase letter" and a "special character" and people use the same password for everything. I wonder how many passwords have the first letter uppercase because that's easy to remember. And then a trailing "!" because it's the first one you see. Not that I would ever do that.

https://www.youtube.com/watch?v=aHaBH4LqGsI

Re: Gmail password first character is case insensitive on mobile device

#237

Post by Bilal_io »

AlexanderTheGr8 wrote: post #234
johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

if your pw was "abcd", then "Abcd" should work, right? Because it auto-capitalizes the first character of the first word. If your pw was "ABCD", then "abcd" (all-small) should be accepted because it auto-capitalizes and then you press the capital key once for caps, so it becomes all small. Did I get anything wrong?

Some other sub-comment mentioned that Facebook used (I think they no longer that according to another comment) to account for first letter being capitalized, and for reverse case. For example a&Ope$G would be accepted in its original form, as well as A&Ope$G and A&oPE$g

Re: Gmail password first character is case insensitive on mobile device

#238

Post by ademarre »

josefx wrote: post #229
remram wrote: post #145

Earlier quoted context omitted.

You can also normalize the password, e.g. always make the first letter lowercase and reverse the case of the rest if the second letter is uppercase. Then you only have to hash that. HeLLo, heLLo, hEllO, HEllO all normalize to heLLo

I hope Facebook passwords are limited to US ASCII, because I seem to remember that there are country specific conversion rules for various Unicode characters that may or may not be subject to change, not to mention the lack of 1:1 mapping for case conversions. Example the German lower case ß converts to SS, so does ss. Of course they also created an upper case variant ẞ of ß a few years ago so who knows what mapping…

https://tools.ietf.org/html/rfc8265

Re: Gmail password first character is case insensitive on mobile device

#239

Post by darkhorn »

qwerty1793 wrote: post #7

Similarly there are many sites that allow you to log in using `your password` or `your password`.swapcase() (for example, Password123 or pASSWORD123). Automatically trying a variant only costs a single bit of entropy and can greatly reduce login issues

This is very English alphabet centric view.

> only costs a single bit

What if the password includes İ. The swapcase would be i. And the again its swapcase would be İ. And swapcase of I is ı. And swapcase of ı is I. Right? Well, it should depend on what language you use. Or should it?

Also I think this was in Github; they ask uppercase and I enter Ğ and Github doesn't recognize it as uppercase letter.

Re: Gmail password first character is case insensitive on mobile device

#240

Post by scoopr »

qwerty1793 wrote: post #91
josalhor wrote: post #78

This is a well-understood feature. Facebook does the same thing[0]. Quote: Facebook actually accepts three forms of your password: * Your original password. * Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word. * Your original password with the case reversed, for those with a caps lock key on. [0]: https://www.zdnet.com/a…

That may have been the case in 2011 when that article was written, but I have just tested this now and my facebook does not accept my password with the case reversed by having the caps lock key on.

iirc, on mac capslock works like (caps OR shift) and on windows its (caps XOR shift), that is, on mac, with capslock on its always cap, but on windows its just a toggle.
Post reply on HN