HN Explorer

I just discovered that my online banking password is not case-sensitive

1 points by dopamean ↗ HN
Try it for yourself if you have a Capital One account. I just logged in with an entirely downcased password when the password I signed up with was mixed case.

What the hell? How is this allowed?

2 comments

[ 5.2 ms ] story [ 17.1 ms ] thread
mantawolf
Not hashing passwords...
Nadya
Can convert inputs to all lower-case or all upper-case before hashing. The result being people who mess up their capitalization or have CAPSLOCK on can still login without issue.

This is a surprisingly common practice. Not one I agree with, personally, but one I can at least see where the logic comes from.