Ask HN: Why aren't Unicode passwords a big thing?

#1

Post by shapath » Thu, Jan 19, 2017, 11:56 PM UTC

ASCII character set only has 127 input options. Unicode has over 128,000 input options. Wouldn't moving to Unicode enabled passwords make passwords, in general, exponentially secure?

In short, why do most websites restrict their passwords to the ASCII character table?

Re: Ask HN: Why aren't Unicode passwords a big thing?

#2

Post by wjh_ » Fri, Jan 20, 2017, 12:20 AM UTC

I don't have any experience with this, but I suppose it's probably due to a) a lack of awareness and b) a lack of support.

For one, people probably aren't aware enough of unicode to think to use a unicode character in their password, and they probably also aren't aware of how to actually type a unicode character.

Plus, website support for unicode chars is... unpredictable. If I set my password to "foo1234", then I expect it to be "foo1234", not just "foo" and a lack of any error. Similar to how password length is sometimes just randomly truncated.

Re: Ask HN: Why aren't Unicode passwords a big thing?

#3

Post by gus_massa » Fri, Jan 20, 2017, 2:00 AM UTC

One of the problems is that some characters have multiple encodes. It's a problem if you enter one form in one computer and another form in other.

From: https://en.wikipedia.org/wiki/Unicode#Ready-made_versus_comp...

For example, é can be represented in Unicode as U+0065 (LATIN SMALL LETTER E) followed by U+0301 (COMBINING ACUTE ACCENT), but it can also be represented as the precomposed character U+00E9 (LATIN SMALL LETTER E WITH ACUTE). Thus, in many cases, users have multiple ways of encoding the same character. To deal with this, Unicode provides the mechanism of canonical equivalence.