Ask HN: How do I handle Unicode passwords? | Hacker News Reader

Ask HN: How do I handle Unicode passwords?

7 pointsunipassword9 comments

Hello, I was recently asked to, if possible, implement Unicode in the password field. The storage is not itself a problem - the hasher itself can accept binary, so I could use UTF-8 so that I wouldn't need to migrate ASCII passwords. My question is before that hasher: I'm aware that Unicode in itself is so messy that you need to normalise it first into something (https://en.wikipedia.org/wiki/Unicode_equivalence) so that would not run on normalisation bugs (such as https://eclecticlight.co/2021/05/08/explainer-unicode-normalization-and-apfs/). If it's impossible, I would have to write a detailed reason since the application is used around the world and they would really prefer to support Unicode passwords.

View on HN

Just hash raw bytes. Treat it as data and set a maximum byte limit.

Indeed, this is the correct solution.

Even if you assume that a user has a broken setup that somehow submits weird characters, you're still better off accepting it so that at least they can continue to log in using that weird setup, as opposed to trying to "correct" it and potentially locking the user out.

Just be sure there is some mechanism in place to reset the password. As they might then have issue with different platforms. And also ensure if you support multiple platforms there isn't clear operating difference in between.

Why a "maximum limit"?

You don't want someone to use password that is millions or billions code-points in length. Technically in spec, but utterly stupid and useless. Just don't go too low.

DOS/resource exhaustion. It doesn't need to be something dumb like 24 characters.

If I understand this correctly the canonical equivalence is more about visual appearance and a user's expectation that two visually identical symbols are treated the same. But I find it hard to imagine that a user somehow manages to input equivalent but differently coded symbols on any standard keyboard, especially for a password that a single person will probably always input the same way.

They may input the password on a phone and a computer. Or on computers running different operating systems.

Normalization rules change over time.

don't normalize. just hash the UTF-8 asis.

normalization changes every year.

you need normalization only if you need to find or compare strings. or for visual equivalence.

Reply on news.ycombinator.com