[deleted]
I included emoji in my password and now I can't log in to my Account on Yosemite
91–100 of 150 posts
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#92Earlier quoted context omitted.
Swedbank in Sweden have a feature where you can access an accounts entire balance by generating random CC#'s for online shopping and this service is protected by your social security number, a 6 character password, a-z, 0-9 and no special characters allowed. They've had this for at least 6 years now, maybe longer. Early on when I e-mailed them about it they simply stated that it's not their service, in other words; o…
Swedbank also requires two-factor authentication. You can bypasss this by calling them - they only ask for 1 thing to authenticate you. Two-factor authentication is rather useless if you can just bypass it like that.
>You can bypasss this by calling them - they only ask for 1 thing to authenticate you.
The domain for my personal site is shared with my family. My father registered the domain and all of the details in the account use his information. I had just created an AWS account and wanted to move the site's DNS to Route53.
I was able to call into the domain registrar and get exactly zero of the details correct, but they pointed the domain to Route53. It was hilarious how bad it was. I used my social, my name, my address, etc., none of which matched the info on file.
Even if I had used my father's info, it (except the social) would have been wrong because we lived overseas on a military base. When your system says Japan and someone from the US is calling, that should set off all sorts of alarm bells.
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#93Earlier quoted context omitted.
There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the…
VirginMedia (large ISP in the UK) won't accept passwords longer than 10 characters. No spaces or special characters allowed, must contain a number, must start with a letter etc.
Additionally, if you contact their customer support via the form they used to provide they ask for your password, which is them presented back to you in plain text when they reply.
Quoting from a reply I had: "As there's no account password quoted on the form you’ve filled in I'm unable to go in to any account specifics."
"accountPassword: I'm not giving you my password"
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#94Earlier quoted context omitted.
Swedish social security numbers are public information btw, just to clarify the insanity - I can call in to the government register and ask for anyone's number, there isn't even any obfuscation or semi-privacy about it like US SSNs.
there isn't even any obfuscation or semi-privacy about it like US SSNs. GOOD. The US "private" SSN system is completely messed up. You can't commit identity theft by just knowing a personnummer. Very, very much unlike the US...
But you can. People treat the full "personal numbers" as a secret and if you can recite one, nobody will think you're anyone different. It's not meant to be this way, but in my experience it is.
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#95Earlier quoted context omitted.
If you call in to your fidelity account, they ask you to type in your username and password with the keypad to authenticate yourself. I haven't given it much thought, so perhaps I'm wrong, but this struck me as probably based on some dicey insecure backend implementation.
More likely it is to prevent your having to say your password to the person on the phone. This protects you from a malicious bank employee.
That'd certainly make sense — a lot of what we see now are fossils like that, frozen in the amber of legacy systems.
That would be a reasonable precaution in the era before recording devices became cheap, tiny and ubiquitous (or capable of doing signal processing in real-time) – just as changing passwords monthly made more sense in the 1970s when shoulder-surfing was the major threat and lack of remote access throttled guessing rates even more than slow CPUs. (Repeat for plastic ID cards before you could buy a printer at Costco, etc.)
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#96A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…
That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.
My bank (German "Sparkasse") only allows passwords with exactly 5 letters or numbers for their online banking. I asked why they're doing this, but didn't get a good response.
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#97Sure it's a silly thing to try, but this is entirely an oversight on Apple's part and is squarely their fault. They had the power to make this situation impossible and they didn't.
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#98Earlier quoted context omitted.
I'm pretty sure the standard US layout offers more than enough symbols to write an excellent password. I tend to prefer extremely long passwords/phrases over things that require stupid characters (had trouble with WiFi keys using the French "é" back in 2008, all my passwords are ASCII since)
Of course, characters that I use in my everyday language aren't "stupid" to me .
That makes me wonder - how long before someone manages to put an emoji in their legal name?
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#99Earlier quoted context omitted.
If you call in to your fidelity account, they ask you to type in your username and password with the keypad to authenticate yourself. I haven't given it much thought, so perhaps I'm wrong, but this struck me as probably based on some dicey insecure backend implementation.
More likely it is to prevent your having to say your password to the person on the phone. This protects you from a malicious bank employee.
Right, but my point is the backend to make this work must be terribly insecure. I just did some reading, and apparently they take your password and just store the keypad equivalent (or more likely, a hash thereof). So you can login in to the website with your original password, the keypad mapping of that password, or any text password that maps to the same keypad digit mapping, and they all work.
Re: I included emoji in my password and now I can't log in to my Account on Yosemite
#100Earlier quoted context omitted.
There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the…
I enjoy seeding a random password generator with a bunch of non-ascii characters [1]. Often it fails telling me that I'm using unsupported characters, other times the form just doesn't return (or returns with a 5xx error), and even worse sometimes it lets me create the account but I can't login because they did something weird with those characters. I'd say less than 70% of sites let me login with one of these in my…
> Turns out HN strips a bunch of them, so my smilies and a bunch of others didn't make the cut!
Which is exactly why I'd be wary of such clever password schemes on any account I cared about.