The Whiteboard

miroxlav

7:01 PM

Hi Snowman, is this right chatroom to discuss that case-insensivity question?

user55340

Discuss away.

miroxlav

ok

user114359

This is the question, in case people do not know:

user114359

0

Q: Most common practice in case sensitivity of credentials?

Regarding case sensitivity of login credentials, I can imagine 3 approaches: Username case-insensitive, Password case-insensitive Username case-insensitive, Password case-sensitive Username case-sensitive, Password case-sensitive I'm experienced only with Windows OS, which uses approach #2. I...

Ixrec

thanks

user114359

7:03 PM

I think I understand what and why you are asking, but it seems to be a little off-topic and difficult to answer.

user55340

I have seen passwords being insensitive on some systems where phone (t9 word style) entry is an option.

miroxlav

I was about to post a link :) My concern is that I think this question is actually answerable by someone who has experience with more systems an isn't opinion based in sense "how can be username/password case sensitivity opinion-based"?

user114359

I think the right thing to do is whatever is more secure: that is the message in those InfoSec.SE questions/answers I linked

user55340

I hate user name sensitivity because Ihate and lhate are distinct.

user114359

Those links go into more detail as to why some systems behave the way they do, and what offers more entropy

miroxlav

7:05 PM

yeah, I've studied them

user55340

And ihate and IHate and...

user114359

Everything about security is a tradeoff, and it boils down to being a personal decision. What do you and your team or company feel is the right tradeoff?

user55340

From my perspective though, it's a "what the client wants" and that's the answer I have to go with.

user41796

@miroxlav IIRC, in most cases username is case insensitive for reasons that MichaelT pointed out.

user41796

Older Oracle servers (and some peoplesoft, afaik) used case sensitive usernames

miroxlav

7:06 PM

currently I have option to go with CS (case-sensitive) username and password, but CS username doesn't seem to be convenient for users. I'm not so concerned about security. My mail concern is STANDARD (if there is any). I don't want admins feel pain "what a weird system is this" :)

user114359

Personally, I want case-sensitivity. I want passwords of reasonably long length with no restrictions on contents. If I want an 80 character password with random characters, the system should let me. It should reject my login if I get anything wrong at all.

user41796

passwords are generally case sensitive (as they should be) but there are variants where that is not the case

miroxlav

I'm FOR case-sensitive passwords, but I'm wondering if there's any standard for usersnames

user114359

I can see an argument for a username being case-insensitive, since that is generally visible by all users.

Ixrec

I don't think there is a standard when it comes to user-facing requirements for password entry; just from a user's POV I see absolutely no consistency in min/max lengths, special character requirements, case-sensitivity, expiration periods and all sorts of other things

user41796

7:08 PM

If there's a standard, it's:
username - case insensitive
password - case sensitive

André

Personally, I'd want username being case-insensitive and password case sensitive

user41796

That would be a de facto standard. But a standard nonetheless

miroxlav

yeah, something like that I'm seeking to hear.

I just wanted to ensure with someone

André

I think is a de facto standard

user114359

@Ixrec password expiring annoys the hell out of me. I use strong passwords and store them in a non-cloud password program. I should only ever need to change them if there is a security breach.

user41796

7:09 PM

I can point out exceptions to those rules, but the norm or expected is what I laid out.

miroxlav

if you feel that CS passwords and CI usernames are most common

Ixrec

@Snowman agreed, all this variation in policy does is force me to pick one common password and give everyone a slightly different number on the end so I have a prayer of remembering them all

user41796

@Snowman arguable

user55340

Most practical.

user41796

Rolling windows protect you from situations where a backup of the system is stolen and they have some time to spend cracking the associated password files

user41796

7:10 PM

It is annoying, no doubt. But it pushes the bar a little bit higher

user41796

And most users do not use strong passwords as you do.

user55340

... My voice mail password was mandated to be a minimum of 10 digits.

user41796

@MichaelT And I hope it can't be the same as your phone number?

miroxlav

:)

should I delete the question put on hold? ... or can someone unlock it so I can add an answer...? or should it remain as it is?

what do you recommend?

Ixrec

I remember once forgetting to type the capital letters in my password as capitals and it let me in anyway, which spooked me a little at the time, so I guess there's a vote for case-sensitive passwords

user55340

7:12 PM

@GlenH7 nope. Can't be the same.

user41796

@miroxlav Not locked, it's on-hold. They have different semantic meaning. Question is too broad for the main site. It'll delete off on it's own in 9 days or you can self-delete

user55340

@Ixrec Facebook close enough passwords?

Ixrec

nope, something at work

I stopped using FB years ago

user41796

@Ixrec hallmark of a poorly secured system

Ixrec

it also has a maximum length =)

user41796

7:14 PM

@Ixrec No sense in allowing unnecessary entropy, right?

Ixrec

I think we get away with it because of the fingerprint scanners

user114359

@miroxlav As I mentioned the question is a poor fit for the main site but you got your answer and some good discussion here. I would recommend deleting it, but the choice is up to you.

Ixrec

there's probably a long sob story involving legacy code about why it's like this

user41796

It's not uncommon. But it's still horrific

user55340

@miroxlav we enjoy a good discussion here - the format of each part of the site is different.

user114359

7:16 PM

Related Google search: Blizzard's Battle.net passwords are not case sensitive. As someone who plays some of their games this concerned me until I got their RSA key.

miroxlav

this is very interesting answer: ux.stackexchange.com/a/28478/45260

CS passwords, but also with trying hash from reversed-case string so accidental caps-lock won't frustrate users

Ixrec

I do like the Facebook scheme, very minimal loss of entropy there

miroxlav

thank you all for answering. perhaps the question was better for UX site at the beginning but I hoped I could find people with greater oversight here. anyway, I'll delete the question from this site now

user114359

@miroxlav I just tested by opening a tab to my bank's login page, and it warned me when the password field had focus and capslock was on.

user114359

I know both Windows 7 and Kubuntu 14.04 do that as well.

user41796

7:20 PM

@miroxlav Bad approach - if someone gets the password file, you just halved the space they have to search to crack the passwords.

durron597

@GlenH7 half of a million years is half a million years. oh noes

user114359

Old but good reading: Schneier on Security - Why Cryptography Is Harder Than It Looks

user41796

@durron597 have you seen some of the meta analysis done on password structure?

miroxlav

@GlenH7 sure, but if they get it, they are half-way to victory either... I'm not good in protecting passwords beyond basic practices (salted hashes)

user114359

What is impossible today is difficult tomorrow. What is difficult today is easy tomorrow.

user41796

7:23 PM

A significant percentage of passwords fall into the same dozen patterns of upper, lower & numbers. Given password re-use across sites, halving the search space makes that a honeypot for other attack vectors

user55340

user41796

@miroxlav Use bcrypt and a salt

miroxlav

I'm still wondering why people don' use Unicode passwords

here in Europe we can easily produce +ľščťžýáíé\|€€'đ[]ŁĐ etc... directly

user41796

@miroxlav difficulty in entering them

user41796

And how are you going to do that on a smartphone? :-)

user55340

7:24 PM

Do you have a Unicode keyboard? Can you type 💾🔉✔️💩?

miroxlav

non-US kbd has all the chars, too...

user114359

Entering accented characters and some other niche symbols is actually easier on my smartphone than on my standard US keyboard.

miroxlav

not a full set ;) but this is what I can type on both PC and smartphone:

user55340

@GlenH7 it's the not smart phone that sucks. Unless you have an Optimus keyboard.

miroxlav

ľščťžýáíé€÷×$ß

user55340

7:26 PM

Optimus Maximus keyboard

The Optimus Maximus keyboard, previously just "Optimus keyboard", is a keyboard developed by the Art. Lebedev Studio, a Russian design studio headed by Artemy Lebedev. Each of its keys is a display which can dynamically change to adapt to the keyboard layout in use or to show the function of the key. Pre-orders began on May 20, 2007 for a limited production run from December 2007 to January 2008, with a second batch expected to arrive in February 2008. It first started shipping the week of February 21, 2008. == Overview == The design featured on the studio's website received attention on the web...

miroxlav

so this is pretty beyond many test character sets.

yeah, that one... people with lower budget could purchase Optimus numpad :)

user55340

"Just hit the numbers 1-9 on this setting to get my password"

miroxlav

artlebedev.com/everything/optimus/aux/optimus-aux-3-4.jpg :)

user41796

This provides a good summary and also links to more in-depth information.

durron597

@MichaelT My problem with this chart is that I don't know what a typical attacker is going to have as their "attempts per second"; from 13 year old on his parents macbook to the NSA

And of course there's no "quantum computer" column.

user55340

7:32 PM

1B/s until you get to huge distributed systems.

durron597

also, it seems clear that the best way to have a secure password on a computer (not mobile) is to have a password like

user41796

@durron597 After the KoreLogic study and BCrypt increasing in popularity, I think there has been a shift away from trying to build the fastest cracking rig possible

durron597

doyoufeelluckybuddyhuhdoyou

user55340

That's for someone who wants to crack it. Those who are less serious... Are less serious.

durron597

as opposed to a1s2d3f4!?

user41796

7:34 PM

@MichaelT Some of the GPU cluster ones could hit hundreds of billions per second

durron597

@GlenH7 Links?

user55340

@GlenH7 and those are from people who want to and have spent money to do so.

durron597

(assuming you have them ready faster than i can google)

user20683

slightly off topic: which brands of memory are good? I upgrade things so rarely that I can never remember.

miroxlav

just add a greek (or russian) keyboard to your OS and press your standard password keys there :) you will quickly run out from standard domain of characters hackers rely on :)

André

7:37 PM

@WorldEngineer, as in RAM?

user41796

@durron597 Exhibit 1 although I'll note there are earlier studies. And Exhibit 2 which is dated, but mentions a 350B guesses/second GPU cluster.

user41796

@WorldEngineer I like Crucial and Kingston

user55340

Apple //c had a davorak keyboard switch. Could only log on from a //c though.

user41796

@miroxlav Yes, surprisingly effective and simple

user114359

@WorldEngineer I have G.Skill in my system and it has been working great for a while. As long as the motherboard is compatible and all of the memory sticks are from the same lot you should have no problem.

user20683

7:38 PM

@Snowman macbook pro 2009

user20683

it's my mom's

user41796

@WorldEngineer I like crucial as it can query the system and tell you the exact, correct type for that quarter's MBP production

user20683

@GlenH7 I'm pretty sure that's what I have but I'd rather not crack open my own and see

durron597

@WorldEngineer Are you a 13 year old script kiddie hacker?

user41796

I used them on my '08 that I upgraded. Can't update the more recent one. :-(

André

7:40 PM

@WorldEngineer Kingston is fine, I never had troubles with it

user20683

@durron597 I am a 29 year old actual programmer with interests in data visualization

user114359

@WorldEngineer I don't know anyone about macs, hardware or software.

user20683

amongst many other things

durron597

@WorldEngineer Dang. And I used to be good at guessing ages.

user20683

@durron597 I was never a script kiddie

Transcript for