Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail password first character is case insensitive on mobile device

support.google.com

Post reply on HN
Print view View original

71–80 of 278 posts

Re: Gmail password first character is case insensitive on mobile device

#71

Post by jeroenhd »

tsimionescu wrote: post #61
jeroenhd wrote: post #56

Earlier quoted context omitted.

Most competent websites I know accept general UTF8 characters like emoji perfectly fine. There are a lot of crappier websites that don't even have proper unicode support for usernames or profile descriptions out there, though, so your mileage may vary. As far as I know, there's nothing preventing a password field from containing any valid unicode string. The problem may be IME support or servers stuck in ASCII, but t…

Even surprisingly big names are surprisingly bad at this. Don't know recently, but Hotmail/Outlook used to have a rule of only using letters, numbers, and a handful of symbols, also limiting you to at most 16 characters or something. You couldn't even type a space!

Honestly, that stuff only proves that big name websites aren't necessarily competent. PayPal used to let you register an account with a password longer than the maximum password length used in the authentication code, for example, essentially allowing you to set a password you could never use with your account again. Being worth billions doesn't mean you've got all the basics down, it just means you've tricked many people into giving you their business.

Even good websites that will accept any valid password string will sometimes cut off the last part of a long password because their hashing algorithm throws that data away. Bcrypt, for example, supports a maximum input length between 50 and 72 bytes, depending on the library you use to hash your passwords. That's bytes, not characters!

More primitive systems used to have problems with non-alfanumerical passwords and once those algorithms have been unleashed upon the unsuspecting public, you need to support them in your login flow for years to come.

Re: Gmail password first character is case insensitive on mobile device

#72

Post by [deleted] »

johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

[deleted]

Re: Gmail password first character is case insensitive on mobile device

#73

Post by frosted-flakes »

ourmandave wrote: post #62

So many sites require "at least one uppercase letter" and a "special character" and people use the same password for everything. I wonder how many passwords have the first letter uppercase because that's easy to remember. And then a trailing "!" because it's the first one you see. Not that I would ever do that.

I just stick an "A!" on the end of my otherwise complex password to satisfy these stupid rules. The worst is when they don't even allow spaces.

Re: Gmail password first character is case insensitive on mobile device

#74

Post by chrisshroba »

johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

I would have thought password fields in particular would never auto-capitalize. Is this not the case?

Re: Gmail password first character is case insensitive on mobile device

#75

Post by st3fan »

johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

That is a text field feature, not a keyboard feature. Google controls all the text fields for gmail. Both in the web version and in their native apps.

Re: Gmail password first character is case insensitive on mobile device

#76

Post by jrootabega »

tsimionescu wrote: post #61
jeroenhd wrote: post #56

Earlier quoted context omitted.

Most competent websites I know accept general UTF8 characters like emoji perfectly fine. There are a lot of crappier websites that don't even have proper unicode support for usernames or profile descriptions out there, though, so your mileage may vary. As far as I know, there's nothing preventing a password field from containing any valid unicode string. The problem may be IME support or servers stuck in ASCII, but t…

Even surprisingly big names are surprisingly bad at this. Don't know recently, but Hotmail/Outlook used to have a rule of only using letters, numbers, and a handful of symbols, also limiting you to at most 16 characters or something. You couldn't even type a space!

They're not necessarily "bad" at it; there's a good chance they just want to make sure that the least competent of their users doesn't make a password that they have trouble with later. They don't care that security-conscious people get frustrated with it.

So I guess that could also be "bad," but not incompetent "bad" or Michael Jackson "bad."

Re: Gmail password first character is case insensitive on mobile device

#77

Post by sz4kerto »

chrisshroba wrote: post #74
johnnyApplePRNG wrote: post #69

Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…

I would have thought password fields in particular would never auto-capitalize. Is this not the case?

Many people note their passwords down in eg. a text document. Not a great practice, but password management is a pain for most people. So when they do that, their editor might auto-capitalize the first character.

Re: Gmail password first character is case insensitive on mobile device

#78

Post by josalhor »

This is a well-understood feature. Facebook does the same thing[0]. Quote:

Facebook actually accepts three forms of your password:

* Your original password.

* Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.

* Your original password with the case reversed, for those with a caps lock key on.

[0]: https://www.zdnet.com/article/facebook-passwords-are-not-cas...

Re: Gmail password first character is case insensitive on mobile device

#79

Post by martincmartin »

jpswade wrote: post #43
martincmartin wrote: post #35

I just want a phone number input box that will strip dashes for me. Many go to the effort of having an error message pop up that says "no dashes or parentheses allowed." So they went to the effort of writing special case code to notice and handle this ... by giving instructions to the person, instead of the computer.

There's a school of thought in interface design that you shouldn't change what the user inputs, as it can be a jarring experience for regular users.

But the changing isn't user visible. To the user, the phone number is the string "(416) 555-1270". If you want to store it differently in your database go ahead. But to the user, the phone number has dashes.

In fact, on my phone, when I type in just the digits, my phone inserts the parens and dashes. Presumably, users consider this easier to read, and dare I say, more canonical.

So, many applications can't handle phone number input in the exact form they display it to the user.

Re: Gmail password first character is case insensitive on mobile device

#80

Post by thefreeman »

tsimionescu wrote: post #61
jeroenhd wrote: post #56

Earlier quoted context omitted.

Most competent websites I know accept general UTF8 characters like emoji perfectly fine. There are a lot of crappier websites that don't even have proper unicode support for usernames or profile descriptions out there, though, so your mileage may vary. As far as I know, there's nothing preventing a password field from containing any valid unicode string. The problem may be IME support or servers stuck in ASCII, but t…

Even surprisingly big names are surprisingly bad at this. Don't know recently, but Hotmail/Outlook used to have a rule of only using letters, numbers, and a handful of symbols, also limiting you to at most 16 characters or something. You couldn't even type a space!

This is much more excusable for email providers to prevent phishing. There are a ton of unicode points that indistinguishable from ascii letters. There are other security issues that can arise as well. Here is an example from spotify https://engineering.atspotify.com/2013/06/18/creative-userna...
Post reply on HN