Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

eng.getwisdom.io

Post reply on HN
Print view View original

111–120 of 231 posts

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#111

Post by tim333 »

ComputerGuru wrote: post #102
tim333 wrote: post #81

Earlier quoted context omitted.

I was thinking that. Unicode is great for presenting text to users but for file names, email addresses, code and the like ASCII has a lot going for it.

No, it doesn’t. What’s a typical corporate email address? First.Last@...? F.Last@...? More than half the world’s population does not use the Latin alphabet.

There's a certain value to say Arabs and Chinese being able to email customerservice@wherever.com rather than having to try to decipher خدمة الزبائن@ and 客戶服務@ in each others language.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#112

Post by iudqnolq »

jcranmer wrote: post #105
iudqnolq wrote: post #95

Earlier quoted context omitted.

Pick a language of your choice, and fully implement the spec. I bet it'll still be long. Edit: The following is completely wrong For example, the python module to parse an email address is around 500 lines and repeatedly warns it'll be very hard to follow without a copy of the spec in front of you. It contains code for parsing multiple timezone formats and cite to a follow up spec addressing a bug in the initial trea…

The timezone isn't for parsing addressing headers, it's for parsing date headers. And actually, that file isn't for parsing email addresses, it's for parsing addressing headers in mail messages. The code I wrote for parsing email headers is here: https://github.com/jcranmer/jsmime/blob/emailutils/headerpar... . A decent chunk of it is building a full lexer for email headers, and trying to cope with only supporting in…

Once again, you prove me completely wrong. Thanks for the detailed correction.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#114

Post by mrighele »

> // Note the Turkish dotless i 'John@Gıthub.com'.toLowerCase() === 'John@Github.com'.toLowerCase()

I'm not sure this example is correct. The dotless ı is already lower cased, so the comparison above should yield false. Maybe the author was thinking about upper case dotted "İ", which becomes regular dotted "i" when lower cased.

So what could happen is that an user enter "JOHN@GİTHUB.COM" as email, and then the email is sent to "john@github.com" .

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#115

Post by blipmusic »

Julia returns:

    julia> c='ı'
    'ı': Unicode U+0131 (category Ll: Letter, lowercase)
    julia> uppercase(c)
    'I': ASCII/Unicode U+0049 (category Lu: Letter, uppercase)
    julia> lowercase(uppercase(c))
    'i': ASCII/Unicode U+0069 (category Ll: Letter, lowercase)
Is this something that needs changing in the Unicode spec itself or how strings are handled in general by various tools/programming languages? I love [plain] text, but it's so, so fragile. :/

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#116

Post by koboll »

rgj wrote: post #110
BoppreH wrote: post #36

I love Unicode, but I'm more and more coming to the conclusion that strings are evil and should be treated as opaque byte arrays, whose only available operation is rendering into a bounded area. I now see any other string operation as code smell. It's scary how much of our infrastructure relies on strings, given how few guarantees string operations actually give. Take files names, for example. Two visually identical…

Strings are not evil - user supplied input should be treated as evil. The fact that most user input is supplied as a string is a mere coincidence.

Yep.

Github's mistake in the parent article wasn't overlooking a character casing collision -- it was sending password reset emails to the email provided by the resetter rather than the saved email for that user.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#117

Post by lookdangerous »

amenghra wrote: post #68
BoppreH wrote: post #36

I love Unicode, but I'm more and more coming to the conclusion that strings are evil and should be treated as opaque byte arrays, whose only available operation is rendering into a bounded area. I now see any other string operation as code smell. It's scary how much of our infrastructure relies on strings, given how few guarantees string operations actually give. Take files names, for example. Two visually identical…

Mr. dot is evil is the first thing we taught new engineers at Facebook during the security engineering on boarding. There’s a whole slide deck (filled with real code snippets) with examples where a string was used instead of a better suited object representation and lead to a security flaw. We eventually build xhp/jsx to get rid of strings-holding-html data, but that was just scratching the surface of bugs caused by…

Mr. Dot as in the php stir concatenation operator?

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#118

Post by onion2k »

microcolonel wrote: post #11
ljm wrote: post #2

So if I understand this right, what GitHub did was something like: user = get_user_from_valid_email(params[:email]) send_reset_email(params[:email]) # instead of # send_reset_email(user.email) ? I've seen this pattern before and the reason is usually something about using the variable in memory as opposed to the function call. Total non-optimisation.

We use three versions of the email address internally: the exact verified address used at signup or the last valid email change, a normalized version of that (for identity) without + mailboxes, lowercased, de-accented, stripped of dots and other inert punctuation, and normalized in a number of other ways... and then of course the email parameter (only used during registration). We accomplish this with a slightly more…

It's very unlikely but still conceivable that robby@ and rob.by@ could be two different people at the same domain.

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#119

Post by _jg »

mrighele wrote: post #114

> // Note the Turkish dotless i 'John@Gıthub.com'.toLowerCase() === 'John@Github.com'.toLowerCase() I'm not sure this example is correct. The dotless ı is already lower cased, so the comparison above should yield false. Maybe the author was thinking about upper case dotted "İ", which becomes regular dotted "i" when lower cased. So what could happen is that an user enter "JOHN@GİTHUB.COM" as email, and then the email…

Should be: 'John@Gıthub.com'.toUpperCase() === 'John@Github.com'.toUpperCase()

Re: Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

#120

Post by pas »

tim333 wrote: post #111
ComputerGuru wrote: post #102

Earlier quoted context omitted.

No, it doesn’t. What’s a typical corporate email address? First.Last@...? F.Last@...? More than half the world’s population does not use the Latin alphabet.

There's a certain value to say Arabs and Chinese being able to email customerservice@wherever.com rather than having to try to decipher خدمة الزبائن@ and 客戶服務@ in each others language.

Why not leave this choice for the providers?
Post reply on HN