41–50 of 278 posts
Earlier quoted context omitted.
It was possible to login with the reverse of your password (as in password.split().reverse().join('')).
What was the reasoning? Unlike case or typos, you wouldn't accidentally type a password backwards.
Earlier quoted context omitted.
If your storing millions of passwords surely a version field and an if statement is not going to be a huge concern
It is definitely more complicated than changing the case and running the hash again
I just want a phone number input box that will strip dashes for me. Many go to the effort of having an error message pop up that says "no dashes or parentheses allowed." So they went to the effort of writing special case code to notice and handle this ... by giving instructions to the person, instead of the computer.
Earlier quoted context omitted.
What was the reasoning? Unlike case or typos, you wouldn't accidentally type a password backwards.
For a long time, in some browsers/OSes there was a bug (or perhaps an archaic feature that was accidentally triggered) where the cursor in an input could get stuck and cause all new characters to be inserted to the left; I'm assuming it's related to that.
Earlier quoted context omitted.
Assuming the password is sent over the wire (rather than the salt being sent to the client, the client doing the hash, and sending the hash), the password will be stored in memory while the login process runs Normal password code would be if (doHash(password+salt) == storedHash) { failedLogins = 0; return 1; } failedLogins++; return 0; This would presumably be if (doHash(password+salt) == storedHash) { failedLogins =…
Even if it’s encrypted, they could send both forms. Edit: not a good idea.
Similarly there are many sites that allow you to log in using `your password` or `your password`.swapcase() (for example, Password123 or pASSWORD123). Automatically trying a variant only costs a single bit of entropy and can greatly reduce login issues
The German letter ß gets uppercased to SS instead of ẞ by most libraries in a neutral/generic culture. ẞ on the other hand gets lowercased to ß.
This happens because there wasn't an official ẞ in German until recently but the uppercasing/lowercasing standard was already written for ß.
Earlier quoted context omitted.
It is definitely more complicated than changing the case and running the hash again
is_password_valid = hash_password(normalize_password_case(password) if version == 1 else password) == hashed_password
If you're actually using a 'strong enough' hash to prevent easy cracking if your hashed password database is leaked then you're doubling the server load which can be quite substantial in some cases.
Earlier quoted context omitted.
This is in no way an educated guess, but it could be something about dealing with right-to-left language support?
The actual character bytes do not go end-to-start in RTL text, so I have a hard time seeing it'd be that. I have no better guess though.
I just want a phone number input box that will strip dashes for me. Many go to the effort of having an error message pop up that says "no dashes or parentheses allowed." So they went to the effort of writing special case code to notice and handle this ... by giving instructions to the person, instead of the computer.
This works for a lot of other things that people format wildly like Canadian postal codes (which are A1A 1A1 format but many places require presence or absence of a space), credit cards (strip the spaces) and so many other fields.
PS. You can see this for yourself, just leave a negative review for Staples Canada on google and your account will be attacked from somewhere inside Vietnam via windows phone.