I guess the original password is stored as a hash in the DB normally, then when someone logs it it hashes what they entered, what they entered with the first char lowercased, and what they entered with all cases inverted, and see if any of the hashes match.
MD5 is bad because it suffers from collision attacks, however it doesn't suffer from preimage attacks, so it's actually fairly secure for passwords (although I still wouldn't use it over any modern algorithm).
Basically, you can make 2 arbitrary pieces of data have the same hash, but you can't create a piece of data matching a known hash.
> Asking if the tests are correct is really asking if the requirements are correct.
Not really. Tests can have obscure bugs just like any other piece of software. If a test fails it could very well be a bug in the test, not the code being tested.
but what's he doing about the government mind rays? I have 14 different hats. I mainly use aluminium foil, but when entering passwords or other sensitive information I like to switch to pure tin, as that of course is most difficult to penetrate with mind rays.
Although the hashes don't seem to be salted...