57

With Facebook login, my password had a form of uppercase letters, lowercase letter and numbers. Not strong, but it did the job. For example

hunTer2

Recently, I was told by an acquaintance that I could do these as well

HunTer2
HUNtER2

I have tried other combinations but they do not seem to work. Is there a reason Facebook allows these alternative passwords?

63

It's because of caps lock key on/off to prevent double entering password.

Per http://www.zdnet.com/blog/facebook/facebook-passwords-are-not-case-sensitive-update/3612

Facebook actually accepts three forms of your password:

  1. Your original password.

  2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.

  3. Your original password with the case reversed, for those with a caps lock key on.

The third case is the one I stumbled upon today. Wolens told me Facebook has had this implemented “for a while” although he couldn’t say for exactly how long. He also noted that Facebook doesn’t believe this impact the security of the user’s passwords, since the characters are still unique, just flipped.

  • Which is an enormous real-world problem, which I can attest to after having seen our support department deal with many issues related to this since our platform moved to case-sensitive passwords. – jlarson May 2 '12 at 21:10
  • 1
    @larson4 which could be OK, provided they store three hashes and never the original password to modify. I'd assume they store three hashes of the three forms of the password, per codinghorror.com/blog/2007/09/… – Jeff Atwood May 2 '12 at 21:14
  • 25
    @JeffAtwood: You only have to store one hash. Then compute three hashes for the password the user submits. If one of them matches, it's OK. – Andomar May 2 '12 at 21:34
  • 1
    @jeff I was not involved in the implementation, and was not aware of this technique. But then, though I am working on reading the entire Internet, I hadn't reached this Coding Horror post yet. – jlarson May 2 '12 at 21:56
  • @larson4 - Waitasecond. Your platform didn't have case-sensitive passwords before? – Kevin Vermeer May 2 '12 at 22:00
1

Facebook also accept one more password type.

Your current password + any single character

  • Do you have any source for this? – serenesat Jan 24 at 6:40
  • You can verify it by logging into your Facebook account. If your Facebook account password is "Password" then try "Password1" "Password@" etc. – abhishek bundela Jan 24 at 13:09
  • I don't have source of it but I think they made this feature to provide better user experience. – abhishek bundela Jan 24 at 13:09
  • I am a source -- I just found this out myself by mistake. Still working as of today. – Moustache Sep 20 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.