Why can I log in to my Facebook account with a misspelled email/password?

https://security.stackexchange.com/questions/214814/why-can-i-log-in-to-my-facebook-account-with-a-misspelled-email-password

by Rondom • 7 years ago

30 5 7 years ago

security.stackexchange.com

tarnet• 7 years ago

it seems nobody has a clear answer as to how this process is done, everyone is debating on if passwords are stored in clear text (which sounds terrifying) or hashes...

how much do you trust facebook?

jbarberu• 7 years ago

I trust they know better than to store passwords in clear text. I distrust them for a large enough host of other reasons keeping me off the platform.

likpok• 7 years ago

Huh?

The top answer links https://www.youtube.com/watch?v=7dPRFoKteIU&feature=youtu.be..., which explains exactly what they do: try a number of different errors client-side.

segmondy• 7 years ago

read the replies, they answered how it's done. There's even a link to a youtube video of a facebook talk, the passwords are hashed.

mrastro• 7 years ago

They obviously don't store their passwords in plaintext. It would be terrible practice even if their incentive is just to save their user info in case of a breach.

They just hash common variations of the password (e.g. missing the last letter) to make it easier to login. Is that a good usability/security trade off? I think so but that's more debatable.

Why can I log in to my Facebook account with a misspelled email/password?

Related Stories