Oct 26, 2026, 8:48 PM@fluepke same issue, yeah. and same outcome.
- Oct 26, 2026, 8:48 PM
Replies
- Oct 26, 2026, 8:51 PM
@fluepke the length is also wonky as hell. Swift uses extended grapheme clusters, Python/Ruby use unicode code points, Java/JS/TS/C#/Obj-C use UTF-16 code units, Rust/Go/PHP generally use byte length in UTF-8 encoding. breaks all sorts of things, cryptographic and otherwise.
also things like character class checks are totally different across languages.
- Oct 26, 2026, 8:53 PM
@fluepke my favourite example of this was a platform with web/android/iOS apps, where signing up with a password containing diacritics or emojis would let you log in, but if you switched apps it wouldn't let you log in because the complexity check got re-ran on login (it was a shared component). for some passwords you could have one app approve the length, but another reject it. for other passwords you could have one app approve the complexity requirements, but another rejected it. wacky.
nadjadequbed@mastodon.chaosfield.atOct 26, 2026, 8:54 PM@gsuberland @fluepke oh god I don't even want to know how somebody messed up their cryptography enough for this to make a difference <.<
- Oct 26, 2026, 8:56 PM
- nadjadequbed@mastodon.chaosfield.atOct 26, 2026, 8:59 PM
@gsuberland @fluepke yeah, I figured. By the time some input touches cryptography it really ought to be some opaque array of bytes you can assume nothing about or you *will* give yourself an exploit-shaped headache :[