Hacker News new | past | comments | ask | show | jobs | submit login
I just discovered that my online banking password is not case-sensitive
1 point by dopamean on Dec 9, 2016 | hide | past | favorite | 2 comments
Try it for yourself if you have a Capital One account. I just logged in with an entirely downcased password when the password I signed up with was mixed case.

What the hell? How is this allowed?




Not hashing passwords...


Can convert inputs to all lower-case or all upper-case before hashing. The result being people who mess up their capitalization or have CAPSLOCK on can still login without issue.

This is a surprisingly common practice. Not one I agree with, personally, but one I can at least see where the logic comes from.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: