> UTF-8, for example, allows to encode the character "ä"
> [...]
> I believe that it makes sense to display a warning
"If Unicode characters are accepted in memorized secrets, the verifier SHOULD apply the Normalization Process for Stabilized Strings defined in Section 12.1 of Unicode Standard Annex 15 [UAX 15] using either the NFKC or NFKD normalization. Subscribers choosing memorized secrets containing Unicode characters SHOULD be advised that some characters may be represented differently by some endpoints, which can affect their ability to authenticate successfully."
Well-designed high-level programming language (see Perl6) compares strings depending on how they look, not on their binary representation [0].
For example let's play with Perl6 REPL:
> my $a = Blob.new(0xc3, 0xa4)
Blob:0x<c3 a4>
> my $b = Blob.new(0x61, 0xcc, 0x88)
Blob:0x<61 cc 88>
> $a eqv $b
False
> $a.decode() eqv $b.decode()
True
> $a.decode() eq $b.decode()
True
>>> a = b'\xc3\xa4'
>>> b = b'\x61\xcc\x88'
>>> a == b
False
>>> a.decode() == b.decode()
False
[0] https://perl6advent.wordpress.com/2015/12/07/day-7-unicode-p...
That's a non-issue. You should normalize unicode strings to a common form (preferably NFC) before any comparision.
Hell no. This WILL lead to disaster, especially if people store their passwords in managers that may or may not mess up Unicode. UTF-8, for example, allows to encode the character "ä" as \xc3\xa4 OR \x61\xcc\x88. They look visually identical, yet fail any string comparison.
Not to mention the support calls "I'm in $random_foreign_country and don't have $random_char on my keyboard, cannot login"... good luck trying to match the kitty emoticon on your Android phone to the random font on a website to whatever input system iPhone uses. Or when they're used a German Windows keyboard and suddenly have to use a German Mac - basic stuff like the tilde symbol ~, pipe symbol | or the (square) brackets {[]} are not marked out on the keyboard.
I believe that it makes sense to display a warning "Your password may be impossible to type in another country/using a non-$current_platform keyboard" when such characters are encountered.