用户期望和 unicode 规范化
这是一个有点软的问题，请随时告诉我是否有更好的地方。
我正在开发一些接受需要国际字符的密码的代码 - 因此我需要将输入的 unicode 字符串与存储的 unicode 字符串进行比较。很容易。
我的问题是 - 国际字符集的用户通常期望在这种情况下标准化吗？我的 Google 搜索显示，从“总是这样做”(http://unicode.org/faq/normalization.html) 到“别打扰”之间存在一些意见冲突。不正常化有什么优点/缺点吗？ （即，不太可能猜测密码等）
This is a bit of a soft question, feel free to let me know if there's a better place for this.
I'm developing some code that accepts a password that requires international characters - so I'll need to compare an input unicode string with a stored unicode string. Easy enough.
My question is this - do users of international character sets generally expect normalization in such a case? My Google searches show some conflicts in opinion from 'always do it' (http://unicode.org/faq/normalization.html) to 'don't bother'. Are there any pros/cons to not normalizing? (i.e., less likely to able guess a password, etc.)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我建议，如果您的密码字段接受 Unicode 输入（大概是 UTF-8 或 UTF-16），请在散列和比较之前对其进行规范化。如果您没有对其进行标准化，并且人们从不同的系统（不同的操作系统，或者不同的浏览器，如果它是网络应用程序，或者具有不同的区域设置）访问它，那么您可能会得到用不同的标准化表示的相同密码。这意味着您的用户将输入正确的密码，但密码被拒绝，并且原因并不明显，他们也没有任何方法可以修复它。
I would recommend that if your password field accepts Unicode input (presumably UTF-8 or UTF-16), that you normalize it before hashing and comparing. If you don't normalize it, and people access it from different systems (different operating systems, or different browsers if it's a web app, or with different locales), then you may get the same password represented with different normalization. This would mean that your user would type the correct password, but have it rejected, and it would not be obvious why, nor would they have any way to fix it.
我不会打扰有几个原因：
I wouldn't bother for a couple reasons: