Re: [http-auth] http-auth BOF

["KIHARA, Boku" <[e-mail]>]

2012/9/15 Peter Saint-Andre <[e-mail]>:
> On 9/14/12 9:09 AM, KIHARA, Boku wrote:
>> <off-topic> I heard a discussion about i18n of passwords: about
>> Chinese characters (of course used in Japan too), there are many
>> characters that have the same pronunciations so they are input by
>> input method software. Users type sentences in latin characters
>> (such as pinyin and roma-ji) then pick intended characters from
>> candidates. When inputting passwords, typically input method
>> software are disabled and userstype unconverted characters. As a
>> result, passwords become within ascii range. The problem might be
>> more noticeable in non-ascii locales where characters are input
>> directly from keyboards.
>
> Hello Kihara-san,
>
> Could you please clarify what you mean by "unconverted characters"? It
> seems that you mean these are characters from the ASCII range not
> converted into their CJ equivalents, but I'd like to make sure.

Exactly. I meant they are ASCII characters that are not processed by
input method software. In Japan, the input process is often called
"Kanji Henkan" (Chinese characters conversion) so I used the word.

>> By the way, I think i18ning passwords in at least CJ locales will
>> cause another problem that conversion process can be vulnerable to
>> shoulder attacks :<
>
> When you say "i18ning passwords", do you mean allowing characters
> outside the ASCII range?
>
> Of course, we like to enable lots of entropy in passwords, so limiting
> the allowable characters to the ASCII range would be at odds with that
> desire.

By all means passwords should become more secure and allowing non-ASCII
characters is very good way. I only intended to notice that there may be
issues to be solved and I am sorry if my message was misleading.

> By the way, some of these considerations are relevant to SASLprep (RFC
> 4013) and its proposed replacement
> (draft-melnikov-precis-saslprepbis), so I hope you will review the
> latter specification and provide feedback on the [e-mail] and
> [e-mail] lists. :)

Sure. I hope my little knowledge can help...:<

Regards,
Boku KIHARA