_jg
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
on Tuesday December 17, 2019 @02:02AM (#21811337)
Should be:
'John@Gıthub.com'.toUpperCase() === '[email protected]'.toUpperCase()
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
on Monday December 16, 2019 @08:58PM (#21809762)
Our team at Wisdom has done the exact same. It's been confusing at times, but much better once we got going.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
on Monday December 16, 2019 @08:47PM (#21809702)
This was a very real and demonstrated vulnerability. Perhaps I've misunderstood your comment.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
on Monday December 16, 2019 @08:45PM (#21809695)
Unfortunately convention has normalised user expectations that email addresses are now case-insensitive. It's now a standard business requirement.
Too bad few devs fully handle Unicode.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
on Monday December 16, 2019 @08:37PM (#21809649)
Yes! Add in a toLowerCase() in there as well.
An apparently small deviation with surprisingly large repercussions.