[EthicalSimilar]

> If your password is incorrect, it checks again with the case swapped to account for caps lock being on.

I love this idea, going to add this to future projects.

[pimlottc]

Don't forget about internationalization. Not all language have uppercase and lowercase characters [0], and tbh I'm not sure what effect (if any) caps lock has for these. And rules for converting case can sometimes be tricky.

0: https://en.wikipedia.org/wiki/Letter_case#Bicameral_script

[robinson7d]

But it’s not core functionality, it’s just a convenience.

Making it more convenient for everybody equally is an admirable goal, but should a trivial change that makes life a bit easier for many people be scrapped just because making it easier for everyone else is difficult? Specifically here where the experience doesn’t significantly regress for anyone.

[sroussey]

This is a terrible idea!

It means that the passwords have far less entropy.

It means the uppercase you password when generating a hash. Good lord.

[lhamil64]

> It means the uppercase you password when generating a hash. Good lord.

No it doesn't. Say your password is "Abc1". When you sign up, they would hash "Abc1". Then when you login, say you type "aBC1". The site would first hash "aBC1" and find that it is incorrect. Then it would invert the case to "Abc1" and try again, and it would work. It's basically just automating a second attempt. In fact, I wonder if it even counts as a second failed attempt if both failed.

If someone were able to make brute force attempts on the website, it would still end up evaluating the passwords the same number of times as if the inverted case wasn't checked (the attacker would just need to invert it themselves) and in fact would likely slow down the attack because they are forced into checking inverterted case passwords. But that's moot anyway because the website limits login attempts. And if the database leaked, it's not stored any differently than if they didn't invert the case.

Of course I'm making assumptions about the implementation (I didn't know they did this until this comment) and it could be done poorly but I would hope a company as big as meta/Facebook put at least this amount of thought into it.

[rezonant]

Whoa, let's not all freak out here (for this post and sibling posts). While I don't think I would personally do this, it only removes 1 bit of entropy because the case is swapped, and it only does that when checking the password. This does not imply they uppercase/lowercase the password prior to hashing at all, nor that foobar123 will work when the hashed password is FooBar123. Rather that fOObAR123 can be transformed by swapping case to FooBar123 and then checked against the hash.

Don't forget that the shift key makes things lowercase when Caps Lock is turned on.

[bheadmaster]

Technically, one bit less, which is insignificant for strong passwords.

And for weak passwords... Well, it's not like that one extra bit would have made a difference.

[marcinzm]

No...they literally have the password you just entered. In plain text. They can change the case of that and compare against the DB hash twice. The entropy for someone trying to brute force the hashes directly is identical.

[jerbear4328]

No, you don't ignore the case, you swap it and try again. This could be implemented as a browser extension:

- User types pA$$WORD1 and clicks Sign In

- Frontend sends that to the server

- Server responds "incorrect"

- Frontend tries again with Pa$$word1

- Server responds "correct" and user is logged in

[Trrrrappp]

A user can only have one password. How does entropy come into play ?

[anymouse123456]

Just came here to say, please don't do this to your users, or your business.

Also, can someone please tell me that Facebook doesn't really do this?

[nekasrbenda]

yOUaREwRONG1!