Gmail password first character is case insensitive on mobile device • Hacker News Board

Re: Gmail password first character is case insensitive on mobile device

#271

Post by naniwaduni » Mon, Oct 11, 2021, 2:24 AM UTC

freemint wrote: post #185

delaaxe wrote: post #174

Earlier quoted context omitted.

Oh you mean the client sends 3 hashes and backend validates if just one matches?

The client usually doesn't send hashes of passwords. Has he's are computed server side. Sending client side hashes beings no benefits

Double-hashing (peppered on client, salted on server) does have a modest benefit: the passwords are no longer sent in plain-text and cannot be cheaply intercepted by a passive eavesdropper (i.e. without observably tinkering with the data sent).

This often isn't considered worth the accessibility and maintenance costs of requiring the user to compute a hash (the threat model isn't exactly hugely concerning, especially to service providers, and is mostly obviated by transport encryption anyway) or the risk that somebody's going to come along and ask why we're hashing twice and rip out the server hash (very bad), but calling that "no benefits" is more or less lies-to-children.

Re: Gmail password first character is case insensitive on mobile device

#272

Post by caymanjim » Mon, Oct 11, 2021, 4:07 PM UTC

scbrg wrote: post #247

caymanjim wrote: post #209

Earlier quoted context omitted.

They might do the same stupid thing Gmail does, and ignore certain characters. My Gmail is "first.m.last@gmail.com", but I constantly get mail from idiots who don't know their own email address, and use my "firstmlast@gmail.com" to sign up for things. This problem would go away entirely if Gmail didn't do this. Facebook might do similar things to make it "easier" to login, even though there are security implications.

> This problem would go away entirely if Gmail didn't do this No it wouldn't. The problem is that people believe they have addresses they don't. They don't have firstmlast@gmail.com any more than they have firt.m.last@gmail.com. I have a surname@ address, and I receive similar mails all the time. People just simply assume they have my email address. No dots involved. https://xkcd.com/1279/

It would go away for me because no one ever uses the real first.m.last address; all the misdirected mail is from people who think firstmlast is their email address.

Re: Gmail password first character is case insensitive on mobile device

#273

Post by ourcat » Mon, Oct 11, 2021, 4:32 PM UTC

zbuf wrote: post #252

ourcat wrote: post #144

Earlier quoted context omitted.

Doesn't the HTML input `pattern` attribute help solve this with a RegEx?

I'd need to double check, but I was under the impression that it affects a validation check, but that it didn't actually prevent the input of these characters.

You can catch the 'invalidity' of the input with the `oninvalid` JS event, then use that to `e.preventDefault()` and show a message as to why it it failed.

Re: Gmail password first character is case insensitive on mobile device

#274

Post by tsimionescu » Tue, Oct 12, 2021, 2:32 PM UTC

thefreeman wrote: post #80

tsimionescu wrote: post #61

Earlier quoted context omitted.

Even surprisingly big names are surprisingly bad at this. Don't know recently, but Hotmail/Outlook used to have a rule of only using letters, numbers, and a handful of symbols, also limiting you to at most 16 characters or something. You couldn't even type a space!

This is much more excusable for email providers to prevent phishing. There are a ton of unicode points that indistinguishable from ascii letters. There are other security issues that can arise as well. Here is an example from spotify https://engineering.atspotify.com/2013/06/18/creative-userna...

I should have specified - this was (is?) for passwords, not usernames. I'm much more sympathetic to limited character sets in usernames, but I don't see much valid reason for doing so with passwords

Re: Gmail password first character is case insensitive on mobile device

#275

Post by tsimionescu » Tue, Oct 12, 2021, 2:33 PM UTC

spookthesunset wrote: post #166

tsimionescu wrote: post #61

Earlier quoted context omitted.

Even surprisingly big names are surprisingly bad at this. Don't know recently, but Hotmail/Outlook used to have a rule of only using letters, numbers, and a handful of symbols, also limiting you to at most 16 characters or something. You couldn't even type a space!

For what it’s worth the “big” company I work for stores usernames in MySQL. 15 years ago when the username column was created it was set for ASCII (or whatever legacy charset it was). Changing it to utf8 would be a royal pain in the ass, requiring all kinds of testing and crazy updates across the entire company. So while we’d love to make it utf8, it is just too much work to justify doing over other things.

I should have noted - i was talking about their restrictions for passwords, not usernames. Since those are hashed before storage, i think there are far fewer excuses for such limitations.

Re: Gmail password first character is case insensitive on mobile device

#276

Post by farazzz » Wed, Oct 13, 2021, 12:17 AM UTC

snthd wrote: post #147

josalhor wrote: post #78

This is a well-understood feature. Facebook does the same thing[0]. Quote: Facebook actually accepts three forms of your password: * Your original password. * Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word. * Your original password with the case reversed, for those with a caps lock key on. [0]: https://www.zdnet.com/a…

Facebook doesn't even require you get your login email address 100% right.

Yeah, I noticed this since I have two accounts with emails that are one character apart, and I was unable to log into one of my accounts because of this feature…

Re: Gmail password first character is case insensitive on mobile device

#277

Post by freemint » Wed, Oct 13, 2021, 12:36 AM UTC

naniwaduni wrote: post #271

freemint wrote: post #185

Earlier quoted context omitted.

The client usually doesn't send hashes of passwords. Has he's are computed server side. Sending client side hashes beings no benefits

Double-hashing (peppered on client, salted on server) does have a modest benefit: the passwords are no longer sent in plain-text and cannot be cheaply intercepted by a passive eavesdropper (i.e. without observably tinkering with the data sent). This often isn't considered worth the accessibility and maintenance costs of requiring the user to compute a hash (the threat model isn't exactly hugely concerning, especially…

I've considered that but then there is transport encryption.

Re: Gmail password first character is case insensitive on mobile device

#278

Post by zbuf » Fri, Oct 15, 2021, 8:58 PM UTC

ourcat wrote: post #273

zbuf wrote: post #252

Earlier quoted context omitted.

I'd need to double check, but I was under the impression that it affects a validation check, but that it didn't actually prevent the input of these characters.

You can catch the 'invalidity' of the input with the `oninvalid` JS event, then use that to `e.preventDefault()` and show a message as to why it it failed.

Interesting... I'll investigate this. Thanks!