Opened 21 months ago

Last modified 2 weeks ago

#23771 new defect

Certain Trac accounts are vulnerable to social engineering homograph impersonation

Reported by: arthuredeIstein Owned by: qbi
Priority: Very High Milestone:
Component: Internal Services/Service - trac Version:
Severity: Critical Keywords:
Cc: arthuredelstein Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description (last modified by teor)

Certain accounts are vulnerable to social engineering homograph impersonation

=====

The way this works is since it's hard to distinguish between lower case "L" (l) and upper case "I" (I) in the font used for usernames, then one can make accounts on trac that impersonate other legitimate accounts by using upper case "I", such as the account that I use right now to report this issue.

There are two possible solutions for this:

  1. Change the font used for usernames on Trac with one in which lower case "L" (l) and upper case "I" (I) are visually distinguishable with our normal human eyes.
  1. Make alternate accounts for all core Tor people that substitute lower case "L" (l) with upper case "I" (I) (or permutations of them if they more than a single lower case "L"), and then change the hashed passwords in the database with something else.

I'd like that option 2 is at least made for the present account.

Child Tickets

Change History (6)

comment:1 Changed 21 months ago by cypherpunks

Status: newneeds_information

It is distinguishable on Windows.
Is this a real problem?

comment:2 in reply to:  1 Changed 21 months ago by cypherpunks

Status: needs_informationnew

Replying to cypherpunks:

It is distinguishable on Windows.
Is this a real problem?

It isn't on Debian.

comment:3 Changed 21 months ago by cypherpunks

Also AFAIA most/many Tor folks are on Debian.

comment:4 Changed 20 months ago by arthuredelstein

Cc: arthuredelstein added

Ouch.

comment:5 in reply to:  4 Changed 20 months ago by cypherpunks

Replying to arthuredelstein:

Ouch.

Relax. It's just a homograph.

comment:6 Changed 2 weeks ago by teor

Description: modified (diff)
Summary: Certain Trac accounts are vulnerable to social engineering hologram impersonationCertain Trac accounts are vulnerable to social engineering homograph impersonation
Note: See TracTickets for help on using tickets.