8 ms·

This is a mistake that shouldn't happen. It means that someone commiting crimes could trivially hide and get the wrong person accused by using homoglyphs [0].

by lefra 2mo ago

This is a mistake that shouldn't happen. It means that someone commiting crimes could trivially hide and get the wrong person accused by using homoglyphs [0]. [0] https://en.wikipedia.org/wiki/Homoglyph https://en.wikipedia.org/wiki/Homoglyph

srdjanr 2mo ago
Only if non-ASCII characters are allowed in usernames, and generally I don't think they often are
- dredmorbius 2mo ago
  I don't know what's most common these days, but quite to the contrary there's often a great deal of agitation for full i18n of name fields, such that people can specify their preferred name / spelling, in their native language. This is often pitched as a rights/respect issue. I feel otherwise: usernames and other identifiers (URLs particularly, and a number of other widely used identifiers), should be drawn from well-known, common, and small charactersets. The original 7-bit ASCII characterset (128 distinct characters), or some subset of that (e.g., Roman alphabet, Arabic numerals) may not be the native representation of all cultures, but it is all but certainly a familiar representation, and avoids numerous homoglyphic attacks. <https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack> By contrast, Unicode has something on the order of 160,000 distinct characters. <https://en.wikipedia.org/wiki/Unicode https://en.wikipedia.org/wiki/Unicode> This greatly exceeds the typical vocabulary (distinct known words) of most native-language speakers, estimated at between 20k -- 35k words for a typical adult English speaker. <https://wordcounter.io/blog/how-many-words-does-the-average-person-know https://wordcounter.io/blog/how-many-words-does-the-average-...>
  - account42 2mo ago
    Yes and pretty much all languages already have widely used and well known ASCII embeddings aka romanization schemes because early computing did have many places where more wasn't possible or at least not for more than one language at the same time.
- account42 2mo ago
  Depending on the font there are homoglyphs even with ASCII. 0 and O as well as I and l are the obvious ones.
echoangle 2mo ago
A bit off topic but is there a reason why the Cyrillic letter in the example image is slightly different than the regular “a”? Did someone redraw it from scratch and it looks kind of different or did someone actually take the “a” glyph and slightly modify it to make it Cyrillic? Because the small difference is so small that it can’t really be on purpose to make them look different, right?
- d1sxeyes 2mo ago
  It's not required, you can re-use the exact same glyph. The letters are effectively the same (both descendants of the Greek 'alpha'). Generally when this happens, it's because they copied the Latin glyph and then made some tweaks to the whole Cyrillic alphabet to make it look more even, etc., and the changes to the 'a' may not even be intentional, but the 'a' got caught up in a batch change or something.
  - account42 2mo ago
    Could also be that both were traced/vectorized independently from the same source. Still, you'd think that a competent digital front creator would recognize that the glyphs should be the same and store them only once for both characters.

by lefra 2mo ago

srdjanr 2mo ago

Only if non-ASCII characters are allowed in usernames, and generally I don't think they often are

dredmorbius 2mo ago
I don't know what's most common these days, but quite to the contrary there's often a great deal of agitation for full i18n of name fields, such that people can specify their preferred name / spelling, in their native language. This is often pitched as a rights/respect issue. I feel otherwise: usernames and other identifiers (URLs particularly, and a number of other widely used identifiers), should be drawn from well-known, common, and small charactersets. The original 7-bit ASCII characterset (128 distinct characters), or some subset of that (e.g., Roman alphabet, Arabic numerals) may not be the native representation of all cultures, but it is all but certainly a familiar representation, and avoids numerous homoglyphic attacks. <https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack> By contrast, Unicode has something on the order of 160,000 distinct characters. <https://en.wikipedia.org/wiki/Unicode https://en.wikipedia.org/wiki/Unicode> This greatly exceeds the typical vocabulary (distinct known words) of most native-language speakers, estimated at between 20k -- 35k words for a typical adult English speaker. <https://wordcounter.io/blog/how-many-words-does-the-average-person-know https://wordcounter.io/blog/how-many-words-does-the-average-...>
- account42 2mo ago
  Yes and pretty much all languages already have widely used and well known ASCII embeddings aka romanization schemes because early computing did have many places where more wasn't possible or at least not for more than one language at the same time.
account42 2mo ago
Depending on the font there are homoglyphs even with ASCII. 0 and O as well as I and l are the obvious ones.

echoangle 2mo ago

A bit off topic but is there a reason why the Cyrillic letter in the example image is slightly different than the regular “a”? Did someone redraw it from scratch and it looks kind of different or did someone actually take the “a” glyph and slightly modify it to make it Cyrillic? Because the small difference is so small that it can’t really be on purpose to make them look different, right?

d1sxeyes 2mo ago
It's not required, you can re-use the exact same glyph. The letters are effectively the same (both descendants of the Greek 'alpha'). Generally when this happens, it's because they copied the Latin glyph and then made some tweaks to the whole Cyrillic alphabet to make it look more even, etc., and the changes to the 'a' may not even be intentional, but the 'a' got caught up in a batch change or something.
- account42 2mo ago
  Could also be that both were traced/vectorized independently from the same source. Still, you'd think that a competent digital front creator would recognize that the glyphs should be the same and store them only once for both characters.