Seems easy enough to guard against. Highlight the characters which are unexpected for my locale.
Can we believe our eyes? Misleading people with Unicode.
11–20 of 128 posts
Re: Can we believe our eyes? Misleading people with Unicode.
#12I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ppa.emorhCelgooG
Whoa. Check out you did to the markup of this page. http://d.pr/HKSQ
Looks like the bug is in Chrome's View Source - the markup itself is fine.
Re: Can we believe our eyes? Misleading people with Unicode.
#13On Linux, how could you make standard tools highlight or differentiate potentially misleading characters? I guess the solution would have to be in the terminal emulator? Would a blacklist of Unicode ranges be sufficient?
A "safe" font that renders Cyrillic characters as a box?
Change my system back to ASCII? :-)
Re: Can we believe our eyes? Misleading people with Unicode.
#14This is why "filters" that prevent XSS, etc by remove malicious characters are so easily breakable. This type of attack is called a canonicalization attack (more here https://www.owasp.org/index.php/Canonicalization,_locale_and... )
This is not a canonicalization attack. Those attacks are based on there being multiple ways to encode the same unicode codepoint in utf8. A utf8 decoder should reject portions of utf8 streams that don't use the shortest possible encoding, but not all do. If there are multiple ways to encode 'The attack described here is simpler: two unicode codepoints, roman 'o' and cyrillic 'o', usually look identical. So by substituting cyrillic we can make a file called 'hosts' that the operating system won't pay attention to. This is the same problem with punycode internationalized domain names, where paypal.com might be spelled with a cyrillic 'a' and mislead people. The fix for domain names was to restrict what unicode you could use where. I'm not sure what the fix is here, aside from always showing hidden files.
Re: Can we believe our eyes? Misleading people with Unicode.
#15I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ppa.emorhCelgooG
This is an interesting page from 2006: http://digitalpbk.blogspot.com/2006/11/fun-with-unicode-and-... and seems to demonstrate to me that Firefox, Opera, and Internet Explorer all will eagerly display the RLO character, and Chrome and Safari will not.
Is Chrome and Safari broken or being responsible? (Are there settings to change the behaviors in any of these browsers...?)
Re: Can we believe our eyes? Misleading people with Unicode.
#16Earlier quoted context omitted.
Whoa. Check out you did to the markup of this page. http://d.pr/HKSQ
Looks like the bug is in Chrome's View Source - the markup itself is fine.
Is it a bug? Or is chrome correctly interpreting the right-to-left override character it sees in the source?
Re: Can we believe our eyes? Misleading people with Unicode.
#17I've had a Fасевоок Offіcіal account lying around for a year or so.
Re: Can we believe our eyes? Misleading people with Unicode.
#18Seems easy enough to guard against. Highlight the characters which are unexpected for my locale.
With a whitelist of multiple languages/ranges for those who can speak multiple languages.
But then what's the solution for someone who speaks both Russian and English?
Re: Can we believe our eyes? Misleading people with Unicode.
#19I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ppa.emorhCelgooG
Whoa. Check out you did to the markup of this page. http://d.pr/HKSQ
Ha, nice catch!
edit: I get the same in Opera 11.50, Firefox 5.0 and some Chrome version.
Re: Can we believe our eyes? Misleading people with Unicode.
#20Yes - reminds me of how several users would exploit the Bolt.com chat system (back in the day) using upper-case 'I's as lower case 'L's to pose as different users and cause mayhem.
In systems that allow spaces in the middle of your username, there are some that do the same with the various unicode variations on white space. That's confusing even to people who know what to look for.
I have thought someone should compile a mapping of all the visually similar characters in Unicode to one canonical character. Then we can all include a check for potential impersonation in account-creation code.