• 1 Post
  • 173 Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle


  • I’ve always wondered about Unicode normalization and passwords. I don’t know a ton about it, but I think it’s that things like ö and be represented as one character for the whole thing or two, one for the umlaut and another for o. That means that there are at least two sequences of code points that make the same… Glyph? I forget the word. The thing you see on the screen.

    Anyway, what if you have that ö in your password and one browser/keyboard/os/lovecraftian nightmare makes the mark one way and the other does it the other way? They aren’t the same bytes. So they won’t hash the same and you just can’t tell why. Without digging super deep.

    There are standard ways to normalize the Unicode but I don’t imagine most password systems use them. Maybe it’s some intermediate layer. But I kind of doubt it. Those are complex, evolving standards.

    Oh. And that “evolving” thing might make trouble for password systems. Are these standards backwards compatible in the way they’d need to be for a normalization upgrade not to break any passwords?

    Oh God, what nightmare have I found?








  • nik9000toProgrammer HumorGithub > youtube
    link
    fedilink
    arrow-up
    4
    ·
    28 days ago

    Take the win.

    I mostly just use GitHub for work. I don’t think the social media bits matter.

    Except stars. I’ve been told investors use stars as a proxy for interest lately. I see how bots these make a lot of sense.

    All this bots stuff reminds me of an off hand part of Anathem. They had this historical arms race of garbage spread on their internet. There’s these monk folks who have been fighting it for generations. I thought it was sill years ago. Feels sane now.