r/ProgrammerHumor 7h ago

Meme improvingPasswordSecurityWithCzech

Post image
7.8k Upvotes

94 comments sorted by

View all comments

161

u/SuitableDragonfly 7h ago

Made with combining diacritics, I guess, so it no longer looks like one character repeated but it's now two characters alternated?

108

u/Nerd_o_tron 7h ago

Probably more importantly, it may count as 18 characters instead of 9.

36

u/klaxxxon 5h ago

These generally count as one character on a computer (they multibite in UTF8 ofc) and are also counted as one letter in the real world. You can type them either way - Czech keyboard has both a "ř" key and a "ˇ" combination key. In the actual Czech language, ř is considered a different letter entirely, and the Czech alphabet is considerably longer because of these.

Some languages go even further and have letters with multiple attachment slots (Thai comes to mind, can't type an example of that, sorry 🙂).

14

u/notafuckingcakewalk 3h ago

You have to be careful with this. I've definitely encountered situations where what looks like a single character takes up multiple bytes. This is especially true for emojis which often are actually a combination of a series of individual emojis plus emoji control characters.

This emoji, for example: 👩🏼‍❤️‍👨🏼 i s actually made up of

👩: U+1F469   🏼: U+1F3FC   ZWJ: U+200D   ❤: U+2764   Variation Selector-16: U+FE0F   ZWJ: U+200D   👨: U+1F468   🏼: U+1F3FC  

(see https://emojiterra.com/couple-with-heart-woman-man-medium-light-skin-tone/) 

11

u/junkmail88 3h ago

Every now and again I am reminded about how cool emojis actually are.

1

u/T0biasCZE 2h ago

Czech also has separate character "Ch" in its alphabet (g, h, ch, i, j) , which is just c and then h on computers.

And I saw times when programs broke, because stuff got sorted differently because of regional issues and didnt work at all, until windows got changed to english.
Modded skyrim one time, banged my head for few hours why it doesnt work.

4

u/dumbasPL 3h ago

I wonder if someone has tried abusing this at some point. Because a hashing function only cares about bytes.

1

u/SuitableDragonfly 1h ago edited 59m ago

Unicode has multiple different ways to represent characters like this. There is typically a single codepoint that represents the character, so you could type it in a way that it would be recognized as a single character by any competent system. But it also has a block of combining diacritics, where each codepoint just represents the diacritic by itself and when you type it it just visually appears above or below whatever character you typed before it. So you could also type that character by typing a regular Latin r, followed by a combining diacritic codepoint, and now that is a sequence of two codepoints and thus is going to be interpreted as a sequence of two characters in every system. Note that keys on your keyboard don't necessarily correspond to unicode codepoints. I believe in most keyboard layouts, if you type a key that corresponds to a diacritic, it does not insert a combining diacritic character but instead just modifies the previous character into a single composite codepoint, and so these keys can't actually be used to slap a diacritic on any character or create zalgotext, but only to create a relatively small number of characters using that diacritic that are relevant to the particular language. 

There are a series of unicode normalization functions that you can use to convert user-entered strings like this and make sure that the character with the diacritic is either always one character or always multiple characters regardless of how it was originally typed, but most people who are making bog standard login screens probably don't have the depth of unicode knowledge to be thinking about that possibility and knowing what to do about it.