[tor-bugs] #23771 [Internal Services/Service - trac]: Certain Trac accounts are vulnerable to social engineering homograph impersonation (was: Certain Trac accounts are vulnerable to social engineering hologram impersonation)

[Tor Bug Tracker & Wiki]

#23771: Certain Trac accounts are vulnerable to social engineering homograph
impersonation
----------------------------------------------+---------------------
 Reporter:  arthuredeIstein                   |          Owner:  qbi
     Type:  defect                            |         Status:  new
 Priority:  Very High                         |      Milestone:
Component:  Internal Services/Service - trac  |        Version:
 Severity:  Critical                          |     Resolution:
 Keywords:                                    |  Actual Points:
Parent ID:                                    |         Points:
 Reviewer:                                    |        Sponsor:
----------------------------------------------+---------------------
Description changed by teor:

Old description:

> Certain accounts are vulnerable to social engineering hologram
> impersonation
>
> =====
>
> The way this works is since it's hard to distinguish between lower case
> "L" (l) and upper case "I" (I) in the font used for usernames, then one
> can make accounts on trac that impersonate other legitimate accounts by
> using upper case "I", such as the account that I use right now to report
> this issue.
>
> There are two possible solutions for this:
>
> 1. Change the font used for usernames on Trac with one in which lower
> case "L" (l) and upper case "I" (I) are visually distinguishable with our
> normal human eyes.
>
> 2. Make alternate accounts for all core Tor people that substitute lower
> case "L" (l) with upper case "I" (I) (or permutations of them if they
> more than a single lower case "L"), and then change the hashed passwords
> in the database with something else.
>
> I'd like that option 2 is at least made for the present account.

New description:

 Certain accounts are vulnerable to social engineering homograph
 impersonation

 =====

 The way this works is since it's hard to distinguish between lower case
 "L" (l) and upper case "I" (I) in the font used for usernames, then one
 can make accounts on trac that impersonate other legitimate accounts by
 using upper case "I", such as the account that I use right now to report
 this issue.

 There are two possible solutions for this:

 1. Change the font used for usernames on Trac with one in which lower case
 "L" (l) and upper case "I" (I) are visually distinguishable with our
 normal human eyes.

 2. Make alternate accounts for all core Tor people that substitute lower
 case "L" (l) with upper case "I" (I) (or permutations of them if they more
 than a single lower case "L"), and then change the hashed passwords in the
 database with something else.

 I'd like that option 2 is at least made for the present account.

--

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23771#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online