31–40 of 278 posts
Earlier quoted context omitted.
It would be more complicated to do this once you stored millions of passwords. So now you have to create 2 flows, those before the new policy and those that were set after the normalization.
If your storing millions of passwords surely a version field and an if statement is not going to be a huge concern
Earlier quoted context omitted.
It was possible to login with the reverse of your password (as in password.split().reverse().join('')).
What was the reasoning? Unlike case or typos, you wouldn't accidentally type a password backwards.
This has been like this for at least a couple years now. Struck me as bit odd in the beginning but it doesn't really improve the chances of brute forcing too much (which is hard on Google login anyways). And potentially saves so much time and server resources
Many go to the effort of having an error message pop up that says "no dashes or parentheses allowed." So they went to the effort of writing special case code to notice and handle this ... by giving instructions to the person, instead of the computer.
Earlier quoted context omitted.
They probably just do two password checks.
Yeah we did it this way on an app I worked on in the past, try the verbatim input and then a couple of minor variations in casing if it didn't work. I've also found that for email fields you need to be careful to normalize the input (trim, casing) as safari had a habit of autocorrecting the first character to be a capital
Why is that relevant? The standard technically allows for case sensitivity but nobody does it
This has been like this for at least a couple years now. Struck me as bit odd in the beginning but it doesn't really improve the chances of brute forcing too much (which is hard on Google login anyways). And potentially saves so much time and server resources
Why do you suggest it saves time and server resources? Because people are likely to miscaptialize the first character of their password?
Earlier quoted context omitted.
Sadly it can also mean that they save your password in a form that enables them to read it if they need/want it.
Assuming the password is sent over the wire (rather than the salt being sent to the client, the client doing the hash, and sending the hash), the password will be stored in memory while the login process runs Normal password code would be if (doHash(password+salt) == storedHash) { failedLogins = 0; return 1; } failedLogins++; return 0; This would presumably be if (doHash(password+salt) == storedHash) { failedLogins =…
Edit: not a good idea.
Earlier quoted context omitted.
What was the reasoning? Unlike case or typos, you wouldn't accidentally type a password backwards.
This is in no way an educated guess, but it could be something about dealing with right-to-left language support?