Live data from Hacker News

Comparing how different devices display the SSID “á̶̛̛̓̿̈͐͆̐̇̒̑̈́͘͝aaa”

hamptonmoore.com

11–20 of 60 posts

Re: Comparing how different devices display the SSID “á̶̛̛̓̿̈͐͆̐̇̒̑̈́͘͝aaa”

#12
post #9
post #5

At least it nowhere caused an exploitable crash

On popular, actively maintained operating systems. Plug in your cheap Chinese IoT device and see what happens...

It might actually do well if you feed it Chinese…

Re: Comparing how different devices display the SSID “á̶̛̛̓̿̈͐͆̐̇̒̑̈́͘͝aaa”

#13
post #10
post #3

The 802.11 standards have always allowed up to 32 bytes which can be filled with any data, it does not have to be in a particular encoding. In 802.11-2012 there is a separate tag SSIDEncoding which can be used to specify if these bytes are in UTF-8 or "unspecified". If the UTF-8 option is set, the SSID should be interpreted as UTF-8. It is not clear in this case if the router sets this flag or not. Either way there i…

The bytestring was truncated after 32 bytes, in the middle of a UTF-8 byte sequence. This means the resulting truncated string is not valid UTF-8 anymore. So my guess is that most devices decide "if it's not valid UTF-8, it must $LEGACY_ENCODING".

Unicode offers two ways forward when you can't decode what you have, one alternative is an exception, you just fail because you weren't able to decode something.

The other is for any code unit that won't decode you emit U+FFFD the Unicode Replacement Character and then you carry on decoding.

For humans U+FFFD makes it obvious something is wrong, it's typically visualised as a black diamond with a white question mark. And for a machine it shouldn't match parsing rules, it isn't an alphanumeric, it isn't any of the common separator or spacing characters, so it's unlikely to be of use in an attack.

Re: Comparing how different devices display the SSID “á̶̛̛̓̿̈͐͆̐̇̒̑̈́͘͝aaa”

#15
post #14

In my firefox it looks like four "a"s with a little rat sitting on top of the first of them.

Same, I actually assumed that's what the string was supposed to be, now opening this in chrome I can see wildly different it looks

Re: Comparing how different devices display the SSID “á̶̛̛̓̿̈͐͆̐̇̒̑̈́͘͝aaa”

#16
post #7

Fun story about one of the devices mentioned there that I worked on. We used to store the saved wifi creds in a file named exactly what the SSID was. Some user managed to break things, and with their permission we gathered detailed wifi logs and found they were connected to an SSID that was an ASCII depiction of the equation: [redacted] plus [redacted] equals [redacted]. The issue was the forward slashes, presumably…

Sounds like a directory traversal to me :)

It's generally a bad idea to have the user in control of filenames you create if those files are not on a device they own.

Re: Comparing how different devices display the SSID “á̶̛̛̓̿̈͐͆̐̇̒̑̈́͘͝aaa”

#17
post #14

In my firefox it looks like four "a"s with a little rat sitting on top of the first of them.

On my computer I see three different representations: In the text on Hacker News, I see the stuff on top of the first "a", in the tab title, it is on top of the second "a", and in the window title, it doesn't render the SSID string (although the rest of the title is displayed).

Re: Comparing how different devices display the SSID “á̶̛̛̓̿̈͐͆̐̇̒̑̈́͘͝aaa”

#19

> Both the s8 and the Firestick are rendering the result in what I deem as the correct way with it showing the name just with some of the vertical characters cutoff. At least one is doing a poor job, though, because the diacritics look nothing alike… > After asking around on the Apple discord server someone said it might be using the Mac OS Roman character set. It turns out it which is strange because iOS used UTF-8…

The first Apple Airport routers predate MacOS X, so it wouldn’t be crazy for the initial MacOS X implementation to fall back to MacOS Roman as backcompat to routers configured with MacOS 8.6/9. And then if they never changed it since for 99% of users the UTF8 auto detect works fine...

Re: Comparing how different devices display the SSID “á̶̛̛̓̿̈͐͆̐̇̒̑̈́͘͝aaa”

#20
post #14

In my firefox it looks like four "a"s with a little rat sitting on top of the first of them.

On my Firefox it looks like four "a"s, with a sort of tower over the first "a" that ends in a frowny face with an accent over it. Is this[1] what you're seeing and describing differently? Or are we having different things displayed by Firefox?

[1] https://i.postimg.cc/nVPBqXjV/fireunicode.png

Post reply on HN