The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text.
For instance, case-insensitive passwords.
EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name).
Why can't it have spaces? Hashes don't care about this. Smells awfully like some string manipulation going on.
Why is it limited to 20 characters? Odds are that they are using VARCHAR(20) or variants. Hashes also don't care about this.
For instance, case-insensitive passwords.
EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name).
Why can't it have spaces? Hashes don't care about this. Smells awfully like some string manipulation going on.
Why is it limited to 20 characters? Odds are that they are using VARCHAR(20) or variants. Hashes also don't care about this.
None of this is proof, but it smells really bad.