While using the Tattersall’s online site, Jeff Wharton, Solutions Architect for WARDY IT Solutions discovered he was able to log in successfully whether he entered his password with capital letters or not.

Wharton had believed his password contained a mixture of lower- and upper-case letters as well as numbers. He had assigned this password himself and had always used it when logging in, but it turned out the Tattersall’s web site actually disregarded case. His judicious use of the shift key was all in vain.

To illustrate, this means the Tattersall’s site effectively treats a password like “iTWire77” the same as “ITWIRE77” or “itwire77” or “iTwIrE77” or any other case combination.

Wharton realised this weakened the security of his account and expressed his concern to the company. Specifically, he pointed out that the online facility permits funds to be withdrawn from credit cards and bank accounts and transferred to other credit cards and bank accounts and he expected top-class protection of his financial information.

A Tattersall's Incidents and Complaints Officer responded to Wharton saying,

“Tattersall’s treats the privacy and security of all our players’ with the utmost importance. We apply and maintain stringent security standards to protect data that we hold on behalf of our players. In keeping with this, Tatt’s Online password requirements are enforced as follows:-

‘Your Password must be between 8 and 12 characters long, and contain a letter and a number. Passwords should not contain your member ID< first name or surname.’

Tatt’s Online does not impose upper or lower case requirements for passwords.

Thank you for taking the time to provide feedback to Tattersall’s and trust that we have put your mind to rest on this issue.”

Does it really matter? Let's look at the numbers.

---

According to Hitachi’s best practices for password management a password of eight characters that only permits one case as well as numbers has 2.82e12 combinations (that’s 2,820,000,000,000.) By contrast, if both cases are permitted the number of combinations increases substantially to 2.8e14 (or 280,000,000,000,000.)

These are awfully large numbers of combinations either way. However, consider that the vast bulk of these combinations are meaningless jumbles of letters and numbers. In practice, many people will opt to use a real word or name and potentially only one or two letters at the end of the word. This diminishes the number of combinations dramatically.

Most institutions recommend passwords contain a mixture of upper- and lower- case letters.

I personally verified that Tattersall’s did not distinguish between case. I created an account on their site with a password of SMITH123 and was able to successfully log in using password smith123.

I phoned Tattersall’s using the telephone number provided to Jeff Wharton to call if he had further enquiries. I asked if there was a reason Tattersall’s did not make this distinction.

The person I spoke with was unaware that the web site allowed people to log in using any case variation on their password. I explained the problem and referred to the Complaints and Incidents Officer who had responded to Wharton.

I disclosed I was a journalist and the headline of this story.

The officer simply advised me that if Tattersall’s knew about this handling of upper- and lower- case characters then they must be satisfied and happy with it.

A call has been made to Tattersall's public relations for an official comment and will be added here as soon as it is received.