Wrong Answer... Would you like to try again?

Recently at work we did our change to the next years Insurance plan. I went to the company's website to register and login. I attempted to register with my id in lower case. When I tried to register I found that I was already registered. Well and good. Let's login. So I go back to the login screen and enter my ID in lowercase and my suspected password... Crash. Server returns with a 500 error and stack trace for a null pointer error. I can tell they are using Websphere etc. Not the sort of error you want your users to see or any black hat types either.

Well I attempt to find the number to call on this. I talked to my HR rep and we found the 800 #, can you guess where? She logged on and found it (wait for it) Yes on the inside of the website. Wouldn't it be better listed outside where people could find it?

Anyway I called the number and got the technical support person. I gave the require info and I expalined what my problem was. She found that I needed to login in ALL CAPS. So let me get this right... login in lower case = NPE, login in upper case = SUCCESS. What has me scratching my head is that my registration attempt was in lower case and it was able to successfully figure out that I was already registered. So on some parts of the site your login is case specific and some parts it's not. This must be a new security technique that I did not know about.

The sad thing is the advice from the technical dept was I would just have to make a note to use upper case in the future. She wasn't at all intersted in making a ticket to get it FIXED! She also offered no option to reset my id to lower case.