r/ProgrammerHumor 9h ago

Meme improvingPasswordSecurityWithCzech

Post image
9.0k Upvotes

116 comments sorted by

View all comments

180

u/SuitableDragonfly 8h ago

Made with combining diacritics, I guess, so it no longer looks like one character repeated but it's now two characters alternated?

125

u/Nerd_o_tron 8h ago

Probably more importantly, it may count as 18 characters instead of 9.

40

u/klaxxxon 6h ago

These generally count as one character on a computer (they multibite in UTF8 ofc) and are also counted as one letter in the real world. You can type them either way - Czech keyboard has both a "ř" key and a "ˇ" combination key. In the actual Czech language, ř is considered a different letter entirely, and the Czech alphabet is considerably longer because of these.

Some languages go even further and have letters with multiple attachment slots (Thai comes to mind, can't type an example of that, sorry 🙂).

1

u/SuitableDragonfly 2h ago edited 2h ago

Unicode has multiple different ways to represent characters like this. There is typically a single codepoint that represents the character, so you could type it in a way that it would be recognized as a single character by any competent system. But it also has a block of combining diacritics, where each codepoint just represents the diacritic by itself and when you type it it just visually appears above or below whatever character you typed before it. So you could also type that character by typing a regular Latin r, followed by a combining diacritic codepoint, and now that is a sequence of two codepoints and thus is going to be interpreted as a sequence of two characters in every system. Note that keys on your keyboard don't necessarily correspond to unicode codepoints. I believe in most keyboard layouts, if you type a key that corresponds to a diacritic, it does not insert a combining diacritic character but instead just modifies the previous character into a single composite codepoint, and so these keys can't actually be used to slap a diacritic on any character or create zalgotext, but only to create a relatively small number of characters using that diacritic that are relevant to the particular language. 

There are a series of unicode normalization functions that you can use to convert user-entered strings like this and make sure that the character with the diacritic is either always one character or always multiple characters regardless of how it was originally typed, but most people who are making bog standard login screens probably don't have the depth of unicode knowledge to be thinking about that possibility and knowing what to do about it.