Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can we believe our eyes? Misleading people with Unicode.

blogs.technet.com

Post reply on HN
Print view View original

71–80 of 128 posts

Re: Can we believe our eyes? Misleading people with Unicode.

#71

Post by xtacy »

bzbarsky wrote: post #63
xtacy wrote: post #54

Earlier quoted context omitted.

Try selecting the text, it behaves funnily in a way that I can't understand!

It behaves funny in a very "simple" way. Selections have this little problem where you move your mouse over the visual representation but the selection is in the logical representation. So say your logical text is this: ltr LTR. where the capital letters are RTL chars (whether because they're actually RTL or because of an RLO in the char stream). That is, the above represents the reading order. Visually this would lo…

Ah, that makes sense. I didn't think that text selection defines end points and everything between the endpoints (in the physical text) is highlighted. So, if you have:

    Hi RLO elgooG
    ^ select ^
I expected (everything between the logical end points selected):

    Hi Google
    ^^^^^^^ (selected)
In other words, I expected text selection to obey RLO character as well.

Re: Can we believe our eyes? Misleading people with Unicode.

#72

Post by pavel_lishin »

xentronium wrote: post #60
adobriyan wrote: post #32

Earlier quoted context omitted.

Code point has script property and mixing it inside strings which aren't likely to contain multiscript code points (like filenames) is a sign of trouble.

Filenames can contain multiscript code points. E.g.: "Архив.gz" (Archive.gz)

But do default windows ones? I think (hope?) that the hosts file is hosts on every system, no matter which country or locale you selected - instead of, say, хозяин.

Perhaps limit system folders and files to ascii-only. Doesn't solve any of the picjpg.exe issues, but it's a start.

Re: Can we believe our eyes? Misleading people with Unicode.

#73

Post by tomp »

byrneseyeview wrote: post #64

This was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-remov... I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index. e.g. http://ww…

Wow, clicking your link (the google search for site:news.ycombinator.com) sure was scary, but since I kinda knew what it was about, I didn't freak out, and simply changed the encoding of the website to some ASCII code page, revealing the illusion.

HOWEVER, what I find extremely worrying, is that the URL in the URL bar remained the same all the time, with the embedded query string site%3Anеws.ycombinator.com, and IT DIDN'T CHANGE TO ASCII when I changed the encoding of the web page. Haven't they/we learned yet, that this is a very serious security issue?

Re: Can we believe our eyes? Misleading people with Unicode.

#74

Post by sesqu »

pavel_lishin wrote: post #69
andresmh wrote: post #45

this reminds me of IDN domains, a few weeks ago I purchased fácebook.com and góogle.com. I get a few hundred visits every day. I posted about it here https://plus.google.com/110362380602139255131/posts/NPS3VNyD...

I wonder how/why people end up typing á in that URL - on my machine, it takes extra effort (OPTION-e a) to enter that.

On my keyboard, it's '-a, with ' in a place that's easy to hit accidentally, and since it's combining, it doesn't print. I suspect some layouts might have OPTION-a, which would be almost as easy a mistake to make.

Re: Can we believe our eyes? Misleading people with Unicode.

#75

Post by sesqu »

tomp wrote: post #73
byrneseyeview wrote: post #64

This was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-remov... I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index. e.g. http://ww…

Wow, clicking your link (the google search for site:news.ycombinator.com) sure was scary, but since I kinda knew what it was about, I didn't freak out, and simply changed the encoding of the website to some ASCII code page, revealing the illusion. HOWEVER, what I find extremely worrying, is that the URL in the URL bar remained the same all the time, with the embedded query string site%3Anеws.ycombinator.com, and IT D…

They've gone back and forth on this. It is a serious security issue, but for people who regularly use non-ascii characters, it's a usability issue. A blacklist might be a usable compromise, but I bet it would feel terribly confusing - in part because of font variability.

Re: Can we believe our eyes? Misleading people with Unicode.

#76

Post by shabble »

pavel_lishin wrote: post #65
noahc wrote: post #41

Somewhat related to this is the ability to change 'l" and "I" around when they both look the same, basically a straight line. This was very common in Yahoo Chat Rooms when folks would pretend to be someone else by registering their name with the opposite of what they had (assuming it had an "i" or "l" in it). They would then take a screen shot of their font and copy that exactly so they could appear to be the other p…

I have a friend whose last name is McIntire, and his handle everywhere was xmcintire. I used to have a lot of fun changing my username to xrncintire - exploiting keming to impersonate him on any non-fixed-width-font system. (name changed to protect him, he was pretty peeved that I did this - though I think he registered a few places as pavellishir to exploit the r/n similarity, too :P)

The original site doesn't seem to be there any more, but here's a (horribly mangled) version from the Wayback machine:

http://web.archive.org/web/20080922234800/http://www.rnicros...

Re: Can we believe our eyes? Misleading people with Unicode.

#77

Post by yuvipanda »

jerf wrote: post #42
yahelc wrote: post #5

Earlier quoted context omitted.

Whoa. Check out you did to the markup of this page. http://d.pr/HKSQ

The HTML standard specifies that changes in text direction are bounded to the block they occur in: http://www.w3.org/TR/1999/REC-html401-19991224/struct/dirlan... I discovered this as I was writing a paranoid HTML cleanup library and wanted to prevent the attack where a user sticks a text-direction-change character into the page and reverses the whole thing. As we've all just witnessed, that can't happen in a conform…

Is this 'really, really paranoid' library available somewhere?

Re: Can we believe our eyes? Misleading people with Unicode.

#79

Post by njharman »

pavel_lishin wrote: post #69
andresmh wrote: post #45

this reminds me of IDN domains, a few weeks ago I purchased fácebook.com and góogle.com. I get a few hundred visits every day. I posted about it here https://plus.google.com/110362380602139255131/posts/NPS3VNyD...

I wonder how/why people end up typing á in that URL - on my machine, it takes extra effort (OPTION-e a) to enter that.

non-english keyboards

links

Post reply on HN