Hacker News Reader

If your passwords are entered by humans (which is usually what "password" means) then you want to treat it as a real Unicode string so that you can normalize it before you do the dirty work on it. Otherwise you could end up with a situation where, for example, a user's password contains "é" and fails when entered on certain systems because that system composes é differently from the system on which the password was set.

And how do you suppose to deal for example cases where some login forms have different character encodings than others but use same authentication backend? Or cases where user agents use inconsistent character composition? Or some other fun edge case?

> We found that sometimes (no predictable pattern), we have interoperability problems between systems. The password produced by one system is not recognized by the other.