Unicode in five minutes (2013)

Re:Unicode in five minutes (2013) by rurban on Friday August 14, 2020 @11:34AM (#24159256)

It misses the security considerations for names. Almost nobody knows about nor implements that. Eg for filenames or variable names.

[ Parent | on HN ]

Re:Unicode in five minutes (2013) by pacaro on Friday August 14, 2020 @11:44AM (#24159397)

If you're interested in this... https://en.wikipedia.org/wiki/Homoglyph

[ Parent | on HN ]

Re:Unicode in five minutes (2013) by jermier on Friday August 14, 2020 @02:44PM (#24161676)

Also recently spotted as an avenue for attack in the wild:

Magecart group uses homoglyph attacks to fool you into visiting malicious websites: https://www.zdnet.com/article/magecart-group-uses-homoglyph-...

Homoglyph attacks used in phishing campaign and Magecart attacks https://securityaffairs.co/wordpress/106916/hacking/homoglyp...

https://cisomag.eccouncil.org/homoglyph-attacks/

[ Parent | on HN ]

Re:Unicode in five minutes (2013) by rurban on Saturday August 15, 2020 @02:33AM (#24166539)

You can easily avoid homoglyph attacks or similar stuff by following the relevant unicode security considerations. I'm on Moderately Restrictive level for General Security Profile for identifiers. http://perl11.org/blog/unicode-identifiers.html

Forbidding mixed scripts fixes this attack. You also need to normalized names, and a few more minor things.

[ Parent | on HN ]