Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by mrighele on Tuesday December 17, 2019 @01:19AM (#21811150)

> // Note the Turkish dotless i 'John@Gıthub.com'.toLowerCase() === '[email protected]'.toLowerCase()

I'm not sure this example is correct. The dotless ı is already lower cased, so the comparison above should yield false. Maybe the author was thinking about upper case dotted "İ", which becomes regular dotted "i" when lower cased.

So what could happen is that an user enter "JOHN@GİTHUB.COM" as email, and then the email is sent to "[email protected]" .

[ Parent | on HN ]

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by _jg on Tuesday December 17, 2019 @02:02AM (#21811337)

Should be: 'John@Gıthub.com'.toUpperCase() === '[email protected]'.toUpperCase()

[ Parent | on HN ]

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by stedaniels on Tuesday December 17, 2019 @04:55AM (#21812154)

The example doesn't seem to work at all for GitHub's explanation.. they say that their outgoing email server didn't support unicode in the domain part anyway. What am I missing? Was your actual attack on the local part?

[ Parent | on HN ]