Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I included emoji in my password and now I can't log in to my Account on Yosemite

apple.stackexchange.com

Post reply on HN
Print view View original

71–80 of 150 posts

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#71

Post by kuschku »

keithpeter wrote: post #9
Johnny_Brahms wrote: post #2

I have had something similar bite me, although mine was easily fixed. I used swedish (åäö) characters for my disk encryption password. This worked fine, until I did a dist-upgrade and had my boot keyboard reset to US QWERTY (using a custom swedish version of capewell-dvorak). The solution for me was to stick on LTS distros.

A quote from the Slackware README_CTYPT.txt "NOTE: if you use a non-US keyboard and need to enter a passphrase during boot, this may be problematic if the keyboard mapping is US while Slackware runs from the initrd filesystem. In this case, add support for your keyboard to the initrd image using this additional parameter to the 'mkinitrd' command above: "-l ". The string is the same as the one you select in the insta…

I have to input a different keyboard when logging in through sddm vs. when using sudo, due to sddm refusing to accept non-US locales.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#72

Post by reddytowns »

TwoBit wrote: post #11
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

They fixed that recently. Change your password

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#73

Post by arthurcolle »

philh wrote: post #57
hahainternet wrote: post #47

Earlier quoted context omitted.

I know of an online store that if you use a + in your email address, will fail to charge you for any goods you order. I'm assuming because something somewhere on their backend assumes that '+' is an invalid email character and refuses to process the job. This is unbelievably common.

I remember finding somewhere that let me sign up with a +, but not log in with it - unless I disabled client-side validation, at which point the server was happy to let me in.

That's insanely insecure. Can't believe client side validation would be used for a login system other than as a first check

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#74

Post by philh »

arthurcolle wrote: post #73
philh wrote: post #57

Earlier quoted context omitted.

I remember finding somewhere that let me sign up with a +, but not log in with it - unless I disabled client-side validation, at which point the server was happy to let me in.

That's insanely insecure. Can't believe client side validation would be used for a login system other than as a first check

I still needed the password (or so I assume). It was just a first check that was stricter than it should have been.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#75

Post by INTPenis »

emerongi wrote: post #16
INTPenis wrote: post #13

Earlier quoted context omitted.

Swedbank in Sweden have a feature where you can access an accounts entire balance by generating random CC#'s for online shopping and this service is protected by your social security number, a 6 character password, a-z, 0-9 and no special characters allowed. They've had this for at least 6 years now, maybe longer. Early on when I e-mailed them about it they simply stated that it's not their service, in other words; o…

Swedbank also requires two-factor authentication. You can bypasss this by calling them - they only ask for 1 thing to authenticate you. Two-factor authentication is rather useless if you can just bypass it like that.

Yes, and I had no idea they were that easy to bypass on a social level.

Also this CC# generator falls outside of the 2FA scope, also something I asked them about several years ago and received the same reply "it's not our service".

It's scary.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#76

Post by Klathmon »

masklinn wrote: post #27
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the…

I enjoy seeding a random password generator with a bunch of non-ascii characters [1]. Often it fails telling me that I'm using unsupported characters, other times the form just doesn't return (or returns with a 5xx error), and even worse sometimes it lets me create the account but I can't login because they did something weird with those characters. I'd say less than 70% of sites let me login with one of these in my password...

At the very least try to use one of them (generally a simple alt-code works, the first smiley face is just alt+1), it's a pretty good indicator of which sites are mucking with your passwords.

[1]•◘○◙►◄↕‼¶§▬↨↑↓

Edit: Turns out HN strips a bunch of them, so my smilies and a bunch of others didn't make the cut!

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#77

Post by SmellyGeekBoy »

Angostura wrote: post #52
masklinn wrote: post #27

Earlier quoted context omitted.

There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the…

VirginMedia (large ISP in the UK) won't accept passwords longer than 10 characters. No spaces or special characters allowed, must contain a number, must start with a letter etc.

Same with the Virgin Atlantic Flying Points site (usernames and passwords). Infuriating thing is the points are worth real money and can be transferred to other users so there is a real incentive to break in.

I guess it's a problem across the entire Virgin group of companies?

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#79

Post by toxik »

philh wrote: post #74
arthurcolle wrote: post #73

Earlier quoted context omitted.

That's insanely insecure. Can't believe client side validation would be used for a login system other than as a first check

I still needed the password (or so I assume). It was just a first check that was stricter than it should have been.

This is why backend and frontend need to share code!

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#80

Post by reinhardt »

grahamel wrote: post #66
Angostura wrote: post #52

Earlier quoted context omitted.

VirginMedia (large ISP in the UK) won't accept passwords longer than 10 characters. No spaces or special characters allowed, must contain a number, must start with a letter etc.

What is really frustrating about this is when I asked them why they reply "we've chosen these limits to make sure your online password is secure"

I can imagine your facepalm.. Wondering how many of these "up to N characters" rules are actually there because there is a `password CHAR(N)` DDL declaration for storing plaintext passwords...
Post reply on HN