4 ms·

In that case, the email is the username, and the problem remains: are josh@gmail.com and jоsh@gmail.com the same user? To the system, of course they're differe

In that case, the email is the username, and the problem remains: are josh@gmail.com and jоsh@gmail.com the same user? To the system, of course they're different - it's just looking at the bytes. Problem comes when a human interacts with the account. Maybe they see the email on the account and manually type it in to another system. Or records are printed as part of a lawsuit and has to be transcribed. Allowing indistinguishable characters in unique tokens creates confusion at best. Broadly I agree that we should reduce our reliance on unique identifiers, and I don't have a good answer for the right approach, but certainly we can't abandon the concept of a unique identifier altogether: it predates computers and the character encoding mess we made, by a long time.

deleted 6y ago
[deleted]
inetknght 6y ago
> are josh@gmail.com and jоsh@gmail.com the same user? I like to think I have a keen eye and pay attention to subtle details. I don't think I see a difference between the two addresses. Your message seems to state they're different though. Did HN normalize the differences? Did my browser? In a blaze of stupidity, I decided to to copy and paste into my terminal and pipe it through a hex dump [0]. * The character difference doesn't show up in the viewport in Firefox; of course, it's rendered. * The character difference doesn't show up in the HTML editor; of course, it's showing the "raw text" and the "raw text" is valid unicode. * It doesn't show up in the browser's network inspection of the response payload. That's the scariest part in Firefox IMO. * It doesn't show up in my Terminal either. Why shouldn't it? We've fought long and hard for terminals to support Unicode. Of course, then there's the fact that I decided to copy and paste from a browser into my terminal even though I already knew I shouldn't [1]. What else could be hidden in unicode? An entire bash script starting with `sudo`, perhaps? Websites can already inject their shitware into the clipboard with clipboard events [1]. [0]: https://knightoftheinter.net/img/hacker%20news%20id%2023774300.png https://knightoftheinter.net/img/hacker%20news%20id%20237743... [1]: https://security.stackexchange.com/q/39118/47800 https://security.stackexchange.com/q/39118/47800
- FreeFull 6y ago
  The second email address uses the Cyrillic small letter O, which renders the same as the Latin small O in almost all fonts. You can see this in your hex dump, too: Instead of a single o, your hex dump shows two bytes for the second character in the second email address.
  - inetknght 6y ago
    Yup! I was surprised they're rendered the same. The hex dump didn't lie even though everything until then did.
    - hombre_fatal 6y ago
      They aren't "lying", it's the same glyph in many fonts. That you think homoglyphs would somehow look different in any of those steps of your post is peculiar to me. l and I are the same in some fonts and they are in the ascii set.
      - microcolonel 6y ago
        I think part of the mistake was separating them to begin with. Far as I can tell, they are literally the same character, with the same origin.
        TheDong 6y ago
        Unicode, in some cases, did avoid separating characters out, and that was also a mistake that damaged existing alphabets irreparably. See the Han unification [0] effort. There are characters in Japanese and Chinese which are similar, but written differently in each... And they ended up using the same codepoint in unicode for them and relying on different fonts. So now I can't easily quote a japanese sentence in a chinese book without having to use two different fonts, which seems quite silly. Worse yet, there were many common glyphs in use (especially for names) that were unified out of existence. There are literally people who couldn't type their names in unicode. There are a lot of works of text that can't be faithfully OCRd due to not having certain character variants that were unified away. Okay, so why wasn't the cyrillic alphabet unified with the latin one even if the japanese and chinese ones were? Clearly Han unification did much more damage than cyrillic unification would have. Well, the answer is sorta politics. ISO 8859 is what came before Unicode, as far as the unicode consortium is concerned. Since ISO 8859 encoded latin and cyrillic separately, that got carried over for "compatibility". Because the unicode consortium and ISO 8859 were both more western-centric, and CJK users had already dealt with things in a way that was standardized only over there, not in any western ISO standard, of course the unicode consortium would honor the existing ISO standard and ignore the CJK standards. [0]: https://en.wikipedia.org/wiki/Han_unification https://en.wikipedia.org/wiki/Han_unification
nevir 6y ago
FWIW, some sites—like Amazon—allow multiple users on the exact same email address (distinguished by password or other identifiers)
- anamexis 6y ago
  And it is an unbelievable pain in the ass. I accidentally ended up in this situation somehow, and it took me forever to figure out that I had two different accounts with the same email. If I log into AWS using one account (the one I've had for Amazon.com for more than a decade), I get the console with no resources in it. If I log in with the same email but a different password, I see all of my resources. Absolutely insane.
  - echelon 6y ago
    Such an insane user model! Could you effectively DOS an account by creating thousands of shadow accounts with different passwords? The login handler is only going to try to bcrypt so many times before timing out.
  - em-bee 6y ago
    to distinguish only by password is evil. a token that can be the same over multiple accounts must not be used as an account identifier for login or anywhere else. what if i use the same password on both?
- ben0x539 6y ago
  How the hell do they implement "lost password" resets?
cantrevealname 6y ago
> are josh@gmail.com and jоsh@gmail.com the same user? You made me think of an interesting hack. We could pass public messages or make public statements that are forever ungoogleable. I could write: “Hey, jоsh, you can bring up the secret menu in еріс games by clicking six times on the blue icon.” But you’d never find this message again by searching the Internet for josh or epic spelt the normal way. By the way, a quick way to perceive the lookalike Unicode above is to paste the words with an appended .com into the address bar of your browser. If you paste jоsh.com or еріс.com, you’ll see punycode.
- Hasnep 6y ago
  There was a Reddit account that for a few months posted all their comments with alphas instead of the letter a. There was some speculation that it was too make their comments ungoogleable, but it turned out to just be for fun.

deleted 6y ago

[deleted]

inetknght 6y ago

> are josh@gmail.com and jоsh@gmail.com the same user? I like to think I have a keen eye and pay attention to subtle details. I don't think I see a difference between the two addresses. Your message seems to state they're different though. Did HN normalize the differences? Did my browser? In a blaze of stupidity, I decided to to copy and paste into my terminal and pipe it through a hex dump [0]. * The character difference doesn't show up in the viewport in Firefox; of course, it's rendered. * The character difference doesn't show up in the HTML editor; of course, it's showing the "raw text" and the "raw text" is valid unicode. * It doesn't show up in the browser's network inspection of the response payload. That's the scariest part in Firefox IMO. * It doesn't show up in my Terminal either. Why shouldn't it? We've fought long and hard for terminals to support Unicode. Of course, then there's the fact that I decided to copy and paste from a browser into my terminal even though I already knew I shouldn't [1]. What else could be hidden in unicode? An entire bash script starting with `sudo`, perhaps? Websites can already inject their shitware into the clipboard with clipboard events [1]. [0]: https://knightoftheinter.net/img/hacker%20news%20id%2023774300.png https://knightoftheinter.net/img/hacker%20news%20id%20237743... [1]: https://security.stackexchange.com/q/39118/47800 https://security.stackexchange.com/q/39118/47800

FreeFull 6y ago
The second email address uses the Cyrillic small letter O, which renders the same as the Latin small O in almost all fonts. You can see this in your hex dump, too: Instead of a single o, your hex dump shows two bytes for the second character in the second email address.
- inetknght 6y ago
  Yup! I was surprised they're rendered the same. The hex dump didn't lie even though everything until then did.
  - hombre_fatal 6y ago
    They aren't "lying", it's the same glyph in many fonts. That you think homoglyphs would somehow look different in any of those steps of your post is peculiar to me. l and I are the same in some fonts and they are in the ascii set.
    - microcolonel 6y ago
      I think part of the mistake was separating them to begin with. Far as I can tell, they are literally the same character, with the same origin.
      - TheDong 6y ago
        Unicode, in some cases, did avoid separating characters out, and that was also a mistake that damaged existing alphabets irreparably. See the Han unification [0] effort. There are characters in Japanese and Chinese which are similar, but written differently in each... And they ended up using the same codepoint in unicode for them and relying on different fonts. So now I can't easily quote a japanese sentence in a chinese book without having to use two different fonts, which seems quite silly. Worse yet, there were many common glyphs in use (especially for names) that were unified out of existence. There are literally people who couldn't type their names in unicode. There are a lot of works of text that can't be faithfully OCRd due to not having certain character variants that were unified away. Okay, so why wasn't the cyrillic alphabet unified with the latin one even if the japanese and chinese ones were? Clearly Han unification did much more damage than cyrillic unification would have. Well, the answer is sorta politics. ISO 8859 is what came before Unicode, as far as the unicode consortium is concerned. Since ISO 8859 encoded latin and cyrillic separately, that got carried over for "compatibility". Because the unicode consortium and ISO 8859 were both more western-centric, and CJK users had already dealt with things in a way that was standardized only over there, not in any western ISO standard, of course the unicode consortium would honor the existing ISO standard and ignore the CJK standards. [0]: https://en.wikipedia.org/wiki/Han_unification https://en.wikipedia.org/wiki/Han_unification

nevir 6y ago

FWIW, some sites—like Amazon—allow multiple users on the exact same email address (distinguished by password or other identifiers)

anamexis 6y ago
And it is an unbelievable pain in the ass. I accidentally ended up in this situation somehow, and it took me forever to figure out that I had two different accounts with the same email. If I log into AWS using one account (the one I've had for Amazon.com for more than a decade), I get the console with no resources in it. If I log in with the same email but a different password, I see all of my resources. Absolutely insane.
- echelon 6y ago
  Such an insane user model! Could you effectively DOS an account by creating thousands of shadow accounts with different passwords? The login handler is only going to try to bcrypt so many times before timing out.
- em-bee 6y ago
  to distinguish only by password is evil. a token that can be the same over multiple accounts must not be used as an account identifier for login or anywhere else. what if i use the same password on both?
ben0x539 6y ago
How the hell do they implement "lost password" resets?

cantrevealname 6y ago

> are josh@gmail.com and jоsh@gmail.com the same user? You made me think of an interesting hack. We could pass public messages or make public statements that are forever ungoogleable. I could write: “Hey, jоsh, you can bring up the secret menu in еріс games by clicking six times on the blue icon.” But you’d never find this message again by searching the Internet for josh or epic spelt the normal way. By the way, a quick way to perceive the lookalike Unicode above is to paste the words with an appended .com into the address bar of your browser. If you paste jоsh.com or еріс.com, you’ll see punycode.

Hasnep 6y ago
There was a Reddit account that for a few months posted all their comments with alphas instead of the letter a. There was some speculation that it was too make their comments ungoogleable, but it turned out to just be for fun.