Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

eng.getwisdom.io

Post reply on HN
Print view View original

21–30 of 231 posts

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#21

Post by dmurray »

notlukesky wrote: post #16
anderskaseorg wrote: post #12

Earlier quoted context omitted.

That’s incorrect. The attack vector hinges on the ability to create email addresses with Turkish characters. There is nothing stopping an attacker from creating addresses with Turkish characters to attack existing addresses without Turkish characters.

https://en.wikipedia.org/wiki/Email_address#Internationaliza... Turkish emails are not supported in the first place. Internationalization examples[edit] The example addresses below would not be handled by RFC 5322 based servers, but are permitted by RFC 6530. Servers compliant with this will be able to handle these: Latin alphabet with diacritics: Pelé@example.com Greek alphabet: δοκιμή@παράδειγμα.δοκιμή Traditional…

RFC 6530 doesn't mention those character sets explicitly. It proposes allowing all Unicode characters, apart from some control characters.

It is true that the RFC recommends mailbox providers take normalization into account. A mailbox provider that allows i and dotless-i addresses to be routed to different mailboxes is careless, if not actually uncompliant. I don't know if any popular provider does this: I'm guessing the authors created their own to demonstrate this attack.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#22

Post by kevin_thibedeau »

microcolonel wrote: post #11
ljm wrote: post #2

So if I understand this right, what GitHub did was something like: user = get_user_from_valid_email(params[:email]) send_reset_email(params[:email]) # instead of # send_reset_email(user.email) ? I've seen this pattern before and the reason is usually something about using the variable in memory as opposed to the function call. Total non-optimisation.

We use three versions of the email address internally: the exact verified address used at signup or the last valid email change, a normalized version of that (for identity) without + mailboxes, lowercased, de-accented, stripped of dots and other inert punctuation, and normalized in a number of other ways... and then of course the email parameter (only used during registration). We accomplish this with a slightly more…

You can't assume that '+' has special meaning that can be stripped away.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#23

Post by microcolonel »

kevin_thibedeau wrote: post #22
microcolonel wrote: post #11

Earlier quoted context omitted.

We use three versions of the email address internally: the exact verified address used at signup or the last valid email change, a normalized version of that (for identity) without + mailboxes, lowercased, de-accented, stripped of dots and other inert punctuation, and normalized in a number of other ways... and then of course the email parameter (only used during registration). We accomplish this with a slightly more…

You can't assume that '+' has special meaning that can be stripped away.

Why not? On most major hosts it has a special meaning, and otherwise it is a relatively ridiculous thing to just add willy-nilly to your email address. We keep your verified mailbox address, the one you gave us, for sending mail.

I doubt we'll ever turn away a customer by preventing registration of a new account sharing the prefix to a plus sign in their email address with an existing customer.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#24

Post by microcolonel »

_jal wrote: post #19
microcolonel wrote: post #11

Earlier quoted context omitted.

We use three versions of the email address internally: the exact verified address used at signup or the last valid email change, a normalized version of that (for identity) without + mailboxes, lowercased, de-accented, stripped of dots and other inert punctuation, and normalized in a number of other ways... and then of course the email parameter (only used during registration). We accomplish this with a slightly more…

> stripped of dots and other inert punctuation The period thing is a Gmail feature, not a standard. some.email@mydomain and someemail@mydomain most certainly do not deliver to the same mailbox.

> some.email@mydomain and someemail@mydomain most certainly do not deliver to the same mailbox.

That's why we keep your verified mailbox address for sending mail; but there's no good reason to consider them different for the purpose of identity.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#25

Post by Alex3917 »

jcranmer wrote: post #17
deathanatos wrote: post #3

This blog sets opacity: 0 (fully invisible) on the entire content, then fails to unset that CSS with JS, b/c the JS crashes if you block cookies. > because the system lowercased the provided email address and compared it to the email address stored in the user database. While sending the email to the attack-provided email, instead of the one in the database, is bad… lowercasing emails is also not valid. The lookup sh…

Practically speaking, you have to treat email addresses as case-preserving: you match case-insensitive, but you always store the case the user entered in directly. I usually give my email address as starting with a capital letter for historical reasons, and I once had an issue that wouldn't let me log on with any case whatsoever, probably because it lowercased the email address and tried to match it against the upper…

> you match case-insensitive, but you always store the case the user entered in directly.

You still need to normalize the unicode for either search or display, unless you're only allowing ascii or something.

E.g. for the column you store for search and to guarantee uniqueness, casefold and then normalize to NFKC. And for the column you store for display, normalize to NFC. (And obviously you need to sanitize user input before doing anything.)

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#27

Post by kevin_thibedeau »

microcolonel wrote: post #23
kevin_thibedeau wrote: post #22

Earlier quoted context omitted.

You can't assume that '+' has special meaning that can be stripped away.

Why not? On most major hosts it has a special meaning, and otherwise it is a relatively ridiculous thing to just add willy-nilly to your email address. We keep your verified mailbox address, the one you gave us, for sending mail. I doubt we'll ever turn away a customer by preventing registration of a new account sharing the prefix to a plus sign in their email address with an existing customer.

Senders don't get to dictate how a recipient encodes their addresses.

RFC 822:

The local-part of an addr-spec in a mailbox specification (i.e., the host's name for the mailbox) is understood to be whatever the receiving mail protocol server allows.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#28

Post by microcolonel »

kevin_thibedeau wrote: post #27
microcolonel wrote: post #23

Earlier quoted context omitted.

Why not? On most major hosts it has a special meaning, and otherwise it is a relatively ridiculous thing to just add willy-nilly to your email address. We keep your verified mailbox address, the one you gave us, for sending mail. I doubt we'll ever turn away a customer by preventing registration of a new account sharing the prefix to a plus sign in their email address with an existing customer.

Senders don't get to dictate how a recipient encodes their addresses. RFC 822: The local-part of an addr-spec in a mailbox specification (i.e., the host's name for the mailbox) is understood to be whatever the receiving mail protocol server allows.

I am well aware of that, but I'm comfortable requiring that new customers don't register an account with an email address foolishly designed to resemble another customer's email address in this particular way. We don't throw away their specified mailbox address, we just don't accept registrations which look suspiciously similar, or intended to cause confusion.

I repeat, this has absolutely nothing to do with the mailbox address, where we send mail.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#30

Post by Thorentis »

michelpp wrote: post #18

The word "delıvered" is snuck into the article as a little Easter egg.

So it is! It seems to even fool Chrome. If you search for "delivered" on the page the search box says "1/4" but entering will only take you to the 2 real ones, not the Turkish i ones which it has presumably counted.
Post reply on HN