Re: [http-auth] http-auth BOF

[Peter Saint-Andre <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 9/14/12 9:09 AM, KIHARA, Boku wrote:
> 2012/9/14 Cameron Jones <[e-mail]>:
>> The problem which has been highlighted is that it requires the
>> necessary encoding to be universally applicable. There are CJKV
>> users who use their own language characters as passwords. It 
>> would be nice to be able to decode these reliably and then we can
>> just ignore BASIC for ever more and get on to developing more
>> secure methods.
> 
> <off-topic> I heard a discussion about i18n of passwords: about
> Chinese characters (of course used in Japan too), there are many 
> characters that have the same pronunciations so they are input by 
> input method software. Users type sentences in latin characters
> (such as pinyin and roma-ji) then pick intended characters from
> candidates. When inputting passwords, typically input method
> software are disabled and userstype unconverted characters. As a
> result, passwords become within ascii range. The problem might be
> more noticeable in non-ascii locales where characters are input
> directly from keyboards.

Hello Kihara-san,

Could you please clarify what you mean by "unconverted characters"? It
seems that you mean these are characters from the ASCII range not
converted into their CJ equivalents, but I'd like to make sure.

> By the way, I think i18ning passwords in at least CJ locales will
> cause another problem that conversion process can be vulnerable to
> shoulder attacks :<

When you say "i18ning passwords", do you mean allowing characters
outside the ASCII range?

Of course, we like to enable lots of entropy in passwords, so limiting
the allowable characters to the ASCII range would be at odds with that
desire.

By the way, some of these considerations are relevant to SASLprep (RFC
4013) and its proposed replacement
(draft-melnikov-precis-saslprepbis), so I hope you will review the
latter specification and provide feedback on the [e-mail] and
[e-mail] lists. :)

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/


-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iEYEARECAAYFAlBTTGMACgkQNL8k5A2w/vwhHgCfamVqTgUQEkTF/c9YFqvvsWpX
RBUAoNRad2jaSbcXdMz6//6HP4uAzfhv
=mVXQ
-----END PGP SIGNATURE-----