Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

Not if, when caps lock is detected, the case is inverted before submitting.


I purposefully create passwords with caps lock on, what then?


> I purposefully create passwords with caps lock on, what then?

I think he means doing it on the server, i.e. checking the password as-is, if that doesn't work, then check it with case inverted.


The best way to handle this is not to modify the entered password, or to reject it, but rather to just display the message. If it stands out enough you should notice it and make the corrective action yourself. In your case no corrective action would be necessary.


It does "halve" the keyspace, by removing one bit of entropy from your password. This is assuming you only use letters in your password and not numbers or other symbols not affected by capslock.


Well, it's a bit tricky. Two inverted passwords still have different hashs. From that perspective, two inverted passwords are not equivalent and therefore the entropy is not decreased.

This is important because if you want to decode a hashed password using a rainbow table for example, you still have to hash the entire keyspace, not just half of it.

Edit @sp332: Exactly. That was my point.


If you're doing an online attack, you can submit half as many passwords. I guess it's just as hard for an offline attack where you're cracking the database of hashes.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: