Mixed Case Facebook Passwords work With or Without Caps Lock

Date: 2011-09-14 08:36:50

Emil Protalinski at ZDNET made an interesting discovery the other day when logging into facebook. He found that his mixed case password still worked when caps lock was on.

After breaking the story, Emil Protalinski interviewed Fred Wolens at the Facebook PR security team and confirmed this is by design. He learned there three possible combinations to authenticate with facebook:

1. Your original Password

2. Your original password with the first letter capitalized (this covers mobile devices which automatically change the first letter to upper-case)

3. Your original password with the case reversed (this covers accidental caps-lock use)

According to Wolens, this doesn't impact security. We disagree. To put this into simple, but less precise terms, if your mixed case password only uses letters, this can make it twice as easy to crack. As you add numbers and special characters, it keeps getting harder, but still will remain much easier to crack.

Category: Facebook

Subcategory: Passwords