<story><title>Passwords For Your Facebook Account</title><url>http://www.labnol.org/internet/facebook-account-passwords/21241/</url><text></text></story><parent_chain><item><author>0x0</author><text>You don&apos;t even need that. When you receive the password, you can compare the stored hash against:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  hash(password)
  hash(password-inverted)
  hash(password-first-upper-case)
&lt;/code&gt;&lt;/pre&gt;
This way it&apos;ll work with an inverted password even on the first attempt (after this feature was implemented)&lt;p&gt;Edit: Going by my gut feeling only, this feels slightly more secure too... If the hashed password database is ever leaked, it feels like it would be easier to crack a password given the three related hashes, compared to just the one.</text></item><item><author>raquo</author><text>You don&apos;t need to store the password in plaintext, you can just capture the password from a successful login attempt and generate new acceptable hashes from different variations of it. That way you&apos;d gradually add this feature for most of the active accounts.</text></item><item><author>tomkinstinch</author><text>This raises several questions:&lt;p&gt;Have they always done this, or is this new?&lt;p&gt;For those of us who haven&apos;t changed our Facebook password in years, does this mean that we don&apos;t get this option, or do we? And if we do, is Facebook storing our passwords in plaintext?</text></item></parent_chain><comment><author>bluesnowmonkey</author><text>I don&apos;t think that is correct.  They&apos;ll need to generate and store hashes of all three variations on the plaintext password before discarding it.  For example, given a password of &quot;AaAaAa&quot;, where the user attempts to log in with &quot;AAAAAA&quot; (doh, capslock!), how would they guess which characters you intended to be uppercase and which not?</text></comment>
<story><title>Passwords For Your Facebook Account</title><url>http://www.labnol.org/internet/facebook-account-passwords/21241/</url><text></text></story><parent_chain><item><author>0x0</author><text>You don&apos;t even need that. When you receive the password, you can compare the stored hash against:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  hash(password)
  hash(password-inverted)
  hash(password-first-upper-case)
&lt;/code&gt;&lt;/pre&gt;
This way it&apos;ll work with an inverted password even on the first attempt (after this feature was implemented)&lt;p&gt;Edit: Going by my gut feeling only, this feels slightly more secure too... If the hashed password database is ever leaked, it feels like it would be easier to crack a password given the three related hashes, compared to just the one.</text></item><item><author>raquo</author><text>You don&apos;t need to store the password in plaintext, you can just capture the password from a successful login attempt and generate new acceptable hashes from different variations of it. That way you&apos;d gradually add this feature for most of the active accounts.</text></item><item><author>tomkinstinch</author><text>This raises several questions:&lt;p&gt;Have they always done this, or is this new?&lt;p&gt;For those of us who haven&apos;t changed our Facebook password in years, does this mean that we don&apos;t get this option, or do we? And if we do, is Facebook storing our passwords in plaintext?</text></item></parent_chain><comment><author>joejohnson</author><text>Given hash(password), how do they get hash(password-inverted)?  That requires going from hash(password) -&amp;#62; password -&amp;#62; password-inverted -&amp;#62; hash(password-inverted), right?&lt;p&gt;I think that first step (un-hashing) is impossible for a cryptographically secure hashing algorithm.&lt;p&gt;Edit: archivator explained it me :)</text></comment>