Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I included emoji in my password and now I can't log in to my Account on Yosemite

apple.stackexchange.com

Post reply on HN
Print view View original

51–60 of 150 posts

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#51

Post by masklinn »

gambiting wrote: post #49
masklinn wrote: post #27

Earlier quoted context omitted.

There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the…

Try to create a password at Jet2.com. A Password like: "SuperSecretPassword!" gives you an error "Your password must be at least six characters or more and is case sensitive.". It's idiotic.

Oh yes, I'd almost forgotten about the misleading, unhelpful or downright incorrect error messages. It's also fun when account creation and login form don't use the same validation rules, so you can create an account but then you can't log into it.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#52

Post by Angostura »

masklinn wrote: post #27
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the…

VirginMedia (large ISP in the UK) won't accept passwords longer than 10 characters. No spaces or special characters allowed, must contain a number, must start with a letter etc.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#53

Post by someotheracct7 »

OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

Would love it if there were some kind of markup standard that password managers could read to determine the site's password rules when generating strong passwords.

I have the problem now with sites that don't tell you their password policy - I'll try several times to generate a password in LastPass and then end up with several entries for the same site, which I now need to inspect to determine which one is the one I don't want to delete. Hugely annoying.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#54

Post by realusername »

ramses0 wrote: post #48
bhaak wrote: post #26

Such problems are the reason why I never use anything but ASCII letters as passwords (if the system doesn't enforce arbitrary password policies). I'd rather have a longer ASCII-only password than a shorter one I might not be able to input. There's also the issue that often you are not sure what keyboard layout is current enabled and even such unsuspicious characters like ! or # are on completely different locations o…

I got bit one time at work by setting a password as "$foo", instead of "foo$" or "fo$o" ... turns out the password-setting script was written in perl and Strange Things happened where only some systems got updated but not others. Honestly, probably exploitable now that I'm thinking about it... I'll have to stop by the security group and give them something to chew on over the holidays.

I had the same problem at the university with a password with '*' in it. It was actually some old bash script behind it which would update random things.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#55

Post by tbabb »

someotheracct7 wrote: post #53
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

Would love it if there were some kind of markup standard that password managers could read to determine the site's password rules when generating strong passwords. I have the problem now with sites that don't tell you their password policy - I'll try several times to generate a password in LastPass and then end up with several entries for the same site, which I now need to inspect to determine which one is the one I…

I would love it if there were FCC-mandated password handling standards, like a (long) minimum max length, a (wide) mimimum permissible charset, and forbidden plaintext storage. It's arguably an issue of national security.

(Or some other appropriate regulatory agency).

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#56

Post by j42 »

kgtm wrote: post #40
j42 wrote: post #14

Earlier quoted context omitted.

Well, "startup" is a poor choice of words, but he actually has a half-decent idea. As someone who owns dozens of little "tool" sites (think less/scss converters, meme generators, JS beautifiers, etc), I can tell you each is probably 1-2 pages, took an hour to build and thankfully due to some domain squatting (kw in domain) and a low bounce rate I don't have to worry much about SEO. As for the Adsense revenue, I think…

Interesting. I would love to hear more details, like how much traffic you are bringing in total from these mini-apps and how much income from Adsense.

I have two books in my queue actually, and this is one of them.

There are parts of my content-property model I'm not ready to share, but most of it has been structured into a cohesive framework of how I:

1. find niches 2. automate site creation 3. optimize w/ gpt (google publisher tag)

I'm sorry to say I won't be releasing that first... The first is due within the next 12-14 days, after which it should take me 1-2 months to finish writing & editing the adsense-property-model guide.

To leave you with something tangible, it's very feasible to produce 5-figures per day with only hosting cost as your overhead ($300/mo).

[edit] without automation tools though, it would obviously be very tedious to produce the number of properties required to have that kind of income by hand. process flow & site generation/management is the crux of this strategy.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#57

Post by philh »

hahainternet wrote: post #47
minikomi wrote: post #29

Hmm. Not really related, but now that it seems to be fixed - I discovered that using an equals sign in your name was enough to be "locked out" of Airbnb - it wrecked the cookie & every page would return 403. No bug bounty though haha. Guess it wasn't enough of an "attack vector" to try and convince someone to change their name.

I know of an online store that if you use a + in your email address, will fail to charge you for any goods you order. I'm assuming because something somewhere on their backend assumes that '+' is an invalid email character and refuses to process the job. This is unbelievably common.

I remember finding somewhere that let me sign up with a +, but not log in with it - unless I disabled client-side validation, at which point the server was happy to let me in.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#58

Post by PhantomGremlin »

TwoBit wrote: post #11
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

8 characters max

Ha. Even better, they're also CASE INSENSITIVE!!!

We discussed this here a year ago: https://news.ycombinator.com/item?id=8783790

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#59

Post by PhantomGremlin »

Someone wrote: post #24
TwoBit wrote: post #11

Earlier quoted context omitted.

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

If you also can choose your account name, use it as sort-of additional password space. I have accounts with several instances where I could give you my password without running much risk of you logging in; even if their phone support would give out my account name, chances are they or you would misspell the line noise that it looks like.

Yes, Schwab does let you choose your account name. I'm not sure how many chars it can have.
Post reply on HN