Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by lonelappde on Monday December 16, 2019 @11:03PM
(#21810425)
Unicode is such a disaster for data processing that it's unfair to call anyone careless for getting it wrong.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by notlukesky on Monday December 16, 2019 @09:46PM
(#21810046)
Turkish characters are not part of RFC 6530.
There are no email addresses with Turkish characters at all. They all use Latin characters.
It just does not exist - yet at least.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by anderskaseorg on Monday December 16, 2019 @10:17PM
(#21810196)
Yes, they are part of RFC 6530, via its references to RFC 3629 (UTF-8) and the Unicode standard.
It is true that the RFC recommends mailbox providers take normalization into account. A mailbox provider that allows i and dotless-i addresses to be routed to different mailboxes is careless, if not actually uncompliant. I don't know if any popular provider does this: I'm guessing the authors created their own to demonstrate this attack.