Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The problem is that it requires you to store multiple hashes while case normalization doesn't.

At least they do not strip special characters out of the password.



Actually, I don't think there's a need to store multiple hashes.

Here's one idea: Let's say the user's password is P. The user enters some password P' with a typo. The authentication check is "does H(T_k(P')) == H(P)" for some set of transformations {T_1, T_2, ..., T_n}. Each transformation T_i hypothesizes that the user made a specific mistake. (e.g., T_1 is the caps lock is on so we need to flip the case of all the characters)


That caps lock case is a good one, but I don't really see other realistic instances where you wouldn't just say "username or password is incorrect".


A few other cases: transcription errors (i.e., mistaking 1 for l), wrong case of the first character of the password, extraneous character at the end of a password, etc.

The paper I linked to actually does a good job motivating specific classes of typos by looking at real typos from Dropbox users.


No, you can just store the original hash and try two times when matching.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: