Pretty much says it in the title. It's difficult to tell O from 0 in the typeface being used.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T100375 Improve user experience of Two-Factor process | |||
| Open | None | T352856 Recovery code improvements | |||
| Open | None | T194077 2FA should clarify O and 0s in recovery codes |
Event Timeline
Comment Actions
What operating system/browser are you using? It depends on which font your browser ends up picking...on Fedora 28/Firefox, the monospace font is DejaVu Sans Mono, which does visually differentiate between 0 and O, as you can see in the screenshot. In Firefox if you right click on the text, pick show inspector from the menu, and then switch the tab to fonts, it'll tell you which font your browser picked.
Comment Actions
We could just generate codes which do not have easy to mistake characters. o (small letter) / O (large letter) / 0 (number) and 1 (number) / l (small L) / I (large i) are typically the things to avoid.
Comment Actions
Base56 and base58 are some common ways to generate characters which are hard to mistake for each other. We could use the uppercase-only version of one of those.