Re: Unicode and Security

From: David Starner (starner@okstate.edu)
Date: Sun Feb 03 2002 - 01:01:14 EST


On Sun, Feb 03, 2002 at 02:15:51PM +0900, Gaspar Sinai wrote:
> I am thinking about electronically signed Unicode text documents
> that are rendered correctly or believeed to be rendered correctly,
> still they look different, seem to contain additional or do not
> seem to contain some text when viewed with different viewers due
> to some ambiguities inherent in the standard.

Some CR's at the right place might produce the same effect in a pure
ASCII document. The O/0 and 1/l/| confusables exist in ASCII.
 
> It might be just a minor quirk unless they don't cost me
> trasferrring all the money from my bank account to a person
> unintentionally...

There seem to be much easier ways to scam money than to exploit
something like this. Promise the world, take their money and run has
been changed more by Ebay than Unicode. If you don't trust someone,
don't deal with them. If they do pull something like this, it's no more
legal than any other form of scam.
 
> Can all the cases be identified and clearified or there are
> infinite number of back-doors in the standard?

Since the only way to "fix" all these "problems" would be be to prescibe
a specific font and specific manner to render text using that font, it's
unlikely they will be "fixed". But there aren't an infinite number of
back-doors in the standard, as it's logically a finite document.

-- 
David Starner - starner@okstate.edu, dvdeug/jabber.com (Jabber)
Pointless website: http://dvdeug.dhis.org
What we've got is a blue-light special on truth. It's the hottest thing 
with the youth. -- Information Society, "Peace and Love, Inc."



This archive was generated by hypermail 2.1.2 : Sun Feb 03 2002 - 00:37:11 EST