4 ms·

I'm very much in favor of UTF-8 everywhere, I think the pros outweigh the cons, but: >there are quite easy ways to avoid homograph attacks I'd like to hear ab

by simias 7y ago

I'm very much in favor of UTF-8 everywhere, I think the pros outweigh the cons, but: >there are quite easy ways to avoid homograph attacks I'd like to hear about those because as far as I can tell it's still very much an unsolved problem.

jcranmer 7y ago
The simplest way to avoid most of them is to ban script mixing, especially mixing Latin, Greek, Cyrillic, and Cherokee.
- squiggleblaz 7y ago
  So in a secure environment I can't write words in IPA? IPA requires mixing Greek beta and theta with Latin letters (but there's a Latin/IPA phi just for fun). It also doesn't help ɡ vs g. It sounds like any genuine solution is either not simple or excludes legitimate use cases.
  - cdirkx 7y ago
    Yes, the Unicode Technical standard identifies the Latin, Greek and Cyrillic (most of IPA characters) scripts as confusable, and recommends against mixing them in identifiers. Use in general text is fine though.
cdirkx 7y ago
The Unicode Technical Standard [1] (different from Unicode Standard) recommends treating identifiers (filenames, variable or fuction names, email adresses, usernames, etc.) different from normal text. There is a special class of 'identifier characters' which already exludes a lot of sneaky characters like invisible punctuation and obscure scripts that are not in modern use. Additionally there are 5 additional restriction levels for identifiers depending on your specific situation: 1. ASCII only 2. single script 3. single script or Latin+{Japn, Hanb, Kore} 4. single script or Latin+{any, excluding Cyrillic, Greek} 5. Not containing any characters in the recommended blacklist of characters for use in secure contexts 6. No restrictions other than normal identifier restrictions For any specific strings that might be confused, there is an algorithm to compute the visual 'skeleton' of a string and match it against that of another string to test if they are confusable. [1] https://www.unicode.org/reports/tr39/ https://www.unicode.org/reports/tr39/

by simias 7y ago

jcranmer 7y ago

The simplest way to avoid most of them is to ban script mixing, especially mixing Latin, Greek, Cyrillic, and Cherokee.

squiggleblaz 7y ago
So in a secure environment I can't write words in IPA? IPA requires mixing Greek beta and theta with Latin letters (but there's a Latin/IPA phi just for fun). It also doesn't help ɡ vs g. It sounds like any genuine solution is either not simple or excludes legitimate use cases.
- cdirkx 7y ago
  Yes, the Unicode Technical standard identifies the Latin, Greek and Cyrillic (most of IPA characters) scripts as confusable, and recommends against mixing them in identifiers. Use in general text is fine though.

cdirkx 7y ago

The Unicode Technical Standard [1] (different from Unicode Standard) recommends treating identifiers (filenames, variable or fuction names, email adresses, usernames, etc.) different from normal text. There is a special class of 'identifier characters' which already exludes a lot of sneaky characters like invisible punctuation and obscure scripts that are not in modern use. Additionally there are 5 additional restriction levels for identifiers depending on your specific situation: 1. ASCII only 2. single script 3. single script or Latin+{Japn, Hanb, Kore} 4. single script or Latin+{any, excluding Cyrillic, Greek} 5. Not containing any characters in the recommended blacklist of characters for use in secure contexts 6. No restrictions other than normal identifier restrictions For any specific strings that might be confused, there is an algorithm to compute the visual 'skeleton' of a string and match it against that of another string to test if they are confusable. [1] https://www.unicode.org/reports/tr39/ https://www.unicode.org/reports/tr39/