Passwords should not be cast to lower case

[nacorid]

The login logic casts passwords to lower case when creating the user and when checking for password validity.
https://github.com/2004Scape/Server/blob/main/src/server/login/LoginServer.ts#L54
I know this was used in runescape, but this is a serious security violation.

Is there any reason not to change this?

[Frosty-J]

Normally I'd agree with you, but in the case of private servers I think case-insensitive passwords are the least of your concerns. 2004Scape allows passwords up to 20 characters, which isn't feasible to brute-force over the network (hopefully some kind of rate-limiting is in place, though I haven't checked) even with only lowercase letters and numbers.

Length	Possible Combinations
5	60,466,176
8	2,821,109,907,456
12	4,738,381,338,321,616,896
16	7,958,661,109,946,400,884,391,936
20	13,367,494,538,843,734,067,838,845,976,576

I have to acknowledge that dictionary attacks will be far faster. I'm not suggesting that monkey is a difficult password to crack.

If the database is breached, it's a different story. Don't reuse username/password combinations across multiple services - that never ends well. While RuneScape itself doesn't support pasting passwords (RuneLite has implemented this feature but it's never been vanilla) some password managers support autotyping your details.