Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do Chinese, Japanese, other languages that can't be represented in ASCII get their passwords stolen? I figure there can't be some sort of bruteforce attack software for them, right? Their characters are so different the the usual ASCII or us keyboards.

share|improve this question
Just my opinion, I, as a Chinese (Traditional) user, never use Chinese passwords. I usually fear encoding issues will make my password "wrong". Not to say unable to log in on devices without Chinese input methods (especially for web services). – Alvin Wong Apr 30 '13 at 3:20

Let's start with looking at keyboards and language sets to understand they work. First up, we have ASCII which is how you're used to characters being saved. ASCII is an encoding, which maps individual characters to some binary combination. In modern computing, we're used to the idea of a byte being 8 bits long, but various hardware implementations (especially decades ago) have used other sizes.

But for now, let's settle with the idea that the world uses 8-bit bytes. English is easy because you can easily fit all predominant punctuation and symbols in 7 bits of space. Yet other latin-character languages such as French have important yet missing symbols in this space. To handle that, other representations besides ASCII such as ISO 8859-15 (Latin-9) come into play. Consider that if you used the ¾ symbol when writing with Latin-1 encoding, it would show up as Ÿ in Latin-9

Nothing really restricts one to using just a byte for defining a symbol, though. In fact, you can see the difference in my example above (a 3/4 symbol and a Y with a diaeresis over it) if you have Unicode properly working. Unicode is able to display this by using longer symbol tables in the form of UTF-16 or UTF-32. In that case, a symbol might be 2 or 4 bytes long, but have one meaning.

With Asian languages where symbols are more concept-based rather than letter based, this doesn't work as well for space, and so Unicode is particularly useful. In either case, though, the encodings really only matter for the human element. Once you send these down the wire, the computer isn't comparing to see whether you entered ¾ or Ÿ, it's checking to see if the binary value is 10111110. Thus, it's only the display that matters. That same value goes down the wire regardless of who wrote it, and indeed somebody in France will probably see a different appearance than I will hear and would press different keys on their keyboard to create it. In fact, for each language there are all sorts of keyboard layouts.

So, since everything is just a byte, malware works the same regardless. As far as trojans go, they have to be written to the language of the user they're targeting (remember, a trojan pretends to be something useful), but they function just the same.

As for brute-forcing, the time is a factor of the number of symbols tried. So one can brute-force (especially via dictionary) just as well in any encoding if all binary space is used, and much faster if you know the dictionary of valid entries to try.

share|improve this answer

Malware is not written in ASCII. Malware is in binary. A Windows virus will equally affect an unsecured Windows computer regardless of the default character encoding.

Stealing passwords via keyloggers and ARP spoofing works the same. In today's world where everything is UTF-8, malicious software is usually able to handle all characters, not just the ASCII subset.

share|improve this answer

You can record birds singing on your dictaphone, can't you? They were also made primarily to record human speech, but it so happens they actually record sound, so any will do. What you're probably confused about (I'm guessing here) is, that there must be some completely different underlying technology involved in displaying one character set from another. It isn't.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.