Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can we believe our eyes? Misleading people with Unicode.

blogs.technet.com

Post reply on HN
Print view View original

61–70 of 128 posts

Re: Can we believe our eyes? Misleading people with Unicode.

#61

Post by Timothee »

noahc wrote: post #41

Somewhat related to this is the ability to change 'l" and "I" around when they both look the same, basically a straight line. This was very common in Yahoo Chat Rooms when folks would pretend to be someone else by registering their name with the opposite of what they had (assuming it had an "i" or "l" in it). They would then take a screen shot of their font and copy that exactly so they could appear to be the other p…

Somebody got me with that exact trick during the Charlie Sheen debacle: I was going back and forth between the Twitter page for @CharlieSheen and @CharIieSheen and couldn't figure out how this was possible… I didn't feel exactly smart when I realized what was going on.

edit: on a related note, I half-jokingly tend to read RockMelt as rock-me-it…

Re: Can we believe our eyes? Misleading people with Unicode.

#62

Post by nxn »

shrikant wrote: post #38
Blarat wrote: post #30

Earlier quoted context omitted.

I find that disturbing, one of the first things I do after a clean install of windows is to check the "Show Hidden Files", which was hard to find in Windows 7 :/ I thought most tech savvie people did that?

I wonder why you say it was hard to find - it's always been under the View tab in Folder Options. Maybe because of the Control Panel revamp, or the fact that the menu-bar is hidden by default in Explorer windows?

I've been using Windows 7 at work for about a year, and I had absolutely no idea that the menu will show up when I hit the alt key until exactly 2 days ago. Every time I needed something from it I'd just rummage around all the visible menus, not find it, curse my head off and open up the command prompt.

I'm not sure which will look dumber as a consequence of this post: me or the Windows 7 UI.

Re: Can we believe our eyes? Misleading people with Unicode.

#63

Post by bzbarsky »

xtacy wrote: post #54
Rygu wrote: post #3

I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ‮ppa.emorhCelgooG

Try selecting the text, it behaves funnily in a way that I can't understand!

It behaves funny in a very "simple" way. Selections have this little problem where you move your mouse over the visual representation but the selection is in the logical representation.

So say your logical text is this:

  ltr LTR.
where the capital letters are RTL chars (whether because they're actually RTL or because of an RLO in the char stream). That is, the above represents the reading order. Visually this would look like this:

  ltr RTL.
assuming that this paragraph directionality is left-to-right; a reader reading this text would read the letters in the order 'l', 't', 'r', ' ', n 'L', 'T', 'R' (which if you note matches the logical order, hence the name).

Now say you mouse down between the 't' the 'r' and drag right until your mouse is between the 'R' and the 'T'. Those are your selection endpoints. But the selection happens on the _logical_ text, so what's selected is the 'r', the space, the 'L', and the 'T' (and even in that order). You can see that in the example above; if you mouse down between the two 'o' chars in "elgooG" and drag right to between the two 'o' chars in "Google", then you get exactly this sort of behavior.

Re: Can we believe our eyes? Misleading people with Unicode.

#64

Post by byrneseyeview »

This was how some folks pretended that Google had erased all mentions of "Oracle":

http://giorgiosironi.blogspot.com/2010/08/google-never-remov...

I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index.

e.g. http://www.google.com/search?sourceid=chrome&ie=UTF-8&#3...

Re: Can we believe our eyes? Misleading people with Unicode.

#65

Post by pavel_lishin »

noahc wrote: post #41

Somewhat related to this is the ability to change 'l" and "I" around when they both look the same, basically a straight line. This was very common in Yahoo Chat Rooms when folks would pretend to be someone else by registering their name with the opposite of what they had (assuming it had an "i" or "l" in it). They would then take a screen shot of their font and copy that exactly so they could appear to be the other p…

I have a friend whose last name is McIntire, and his handle everywhere was xmcintire. I used to have a lot of fun changing my username to xrncintire - exploiting keming to impersonate him on any non-fixed-width-font system.

(name changed to protect him, he was pretty peeved that I did this - though I think he registered a few places as pavellishir to exploit the r/n similarity, too :P)

Re: Can we believe our eyes? Misleading people with Unicode.

#66

Post by derleth »

sarenji wrote: post #56

This is an important issue in some chat programs. I had to deal with this all the time: malicious users using i vs. l to pose as others, and using unicode to mess up or reverse the entire chat. One of the more interesting unicode had characters going left, right, and up and down . This confused moderators about who to kick/ban and obscured other users' text. The solution was to implement a regex of whitelisted charac…

> malicious users using i vs. l to pose as others

It seems like it would be easy to implement a blacklist that automatically updates based on the current crop of registered names such that filters are applied to each registered name to generate a number of lookalike names which are all unavailable for use. This should allow any good-faith user to register any name they want without causing confusion.

Re: Can we believe our eyes? Misleading people with Unicode.

#67

Post by nodata »

mikelward wrote: post #18
nodata wrote: post #11

Seems easy enough to guard against. Highlight the characters which are unexpected for my locale.

With a whitelist of multiple languages/ranges for those who can speak multiple languages. But then what's the solution for someone who speaks both Russian and English?

Does Russian contain/mix English characters within words?

Re: Can we believe our eyes? Misleading people with Unicode.

#69

Post by pavel_lishin »

andresmh wrote: post #45

this reminds me of IDN domains, a few weeks ago I purchased fácebook.com and góogle.com. I get a few hundred visits every day. I posted about it here https://plus.google.com/110362380602139255131/posts/NPS3VNyD...

I wonder how/why people end up typing á in that URL - on my machine, it takes extra effort (OPTION-e a) to enter that.
Post reply on HN