Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I included emoji in my password and now I can't log in to my Account on Yosemite

apple.stackexchange.com

Post reply on HN
Print view View original

101–110 of 150 posts

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#101

Post by apozem »

TwoBit wrote: post #11
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

One of my neighbors when I was growing up worked in the FBI's cybercrime division. His wife always complained about how he never let her do any of their banking or serious financial transactions online. When I hear stuff like this, I get why.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#102

Post by dragontamer »

notfoss wrote: post #89
dlitz wrote: post #85

Earlier quoted context omitted.

Well, really, it should just work or OSX should prevent this from happening in the first place. Emoji are common among non-technical users---exactly the market that Apple supposedly caters to---and why would anyone expect a non-technical user to know that using emoji in a password would be considered "crazy", without knowing the extensive legacy of pre-Unicode systems, the location of many emoji outside the Basic Mul…

Not trying to excuse OSX's behaviour, but non-technical users are the ones who use passwords like: abcdef, 123456, password123, etc. In fact, using such characters (emojis, other unicode characters, etc.) in passwords should be considered a secure practice.

Technical users use Diceware because its the best way for the human mind to capture entropy.

https://en.wikipedia.org/wiki/Diceware

Its the non-technical users who try the silly stuff. A diceware password with 4 words is 51-bits of entropy. 5 Words gets you 64-bits of entropy.

For example, if you remember that "U+2708" is the Airplane emoji, why not just type the string "U2708" on the end of the password (ex: MyPasswordU2708). The longer password is going to add provably the same amount of entropy, and will work with virtually any system.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#103

Post by _asummers »

masklinn wrote: post #51
gambiting wrote: post #49

Earlier quoted context omitted.

Try to create a password at Jet2.com. A Password like: "SuperSecretPassword!" gives you an error "Your password must be at least six characters or more and is case sensitive.". It's idiotic.

Oh yes, I'd almost forgotten about the misleading, unhelpful or downright incorrect error messages. It's also fun when account creation and login form don't use the same validation rules, so you can create an account but then you can't log into it.

Even major sites suffer from this. Netflix web UI allows 60 character passwords, but their Roku app and I believe the Xbox One app only allow 50 character passwords.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#104

Post by valarauca1 »

dragontamer wrote: post #102
notfoss wrote: post #89

Earlier quoted context omitted.

Not trying to excuse OSX's behaviour, but non-technical users are the ones who use passwords like: abcdef, 123456, password123, etc. In fact, using such characters (emojis, other unicode characters, etc.) in passwords should be considered a secure practice.

Technical users use Diceware because its the best way for the human mind to capture entropy. https://en.wikipedia.org/wiki/Diceware Its the non-technical users who try the silly stuff. A diceware password with 4 words is 51-bits of entropy. 5 Words gets you 64-bits of entropy. For example, if you remember that "U+2708" is the Airplane emoji, why not just type the string "U2708" on the end of the password (ex: MyPassw…

The old bits of entropy count is based on extended ASCII. In reality we could count UFT-8 code points, with each code point having 1/#code_point entropy.

As a brute force guesser can throw UTF-8 chars instead of attempting to rebuild emoji from their underlying ASCII string.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#105

Post by aurelian15 »

ninov wrote: post #96
TwoBit wrote: post #11

Earlier quoted context omitted.

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

My bank (German "Sparkasse") only allows passwords with exactly 5 letters or numbers for their online banking. I asked why they're doing this, but didn't get a good response.

When I asked, I got the answer that I could chose an arbitrary 16 character long user name, that the password may contain special characters, that the number of allowed failures for logging in is limited and that any actual money transfers are protected by a TAN. So it may not be that bad, given that the PIN for my EC card has only four numbers.

Still, I agree that this scheme is somewhat odd and no limitation on the password length would be preferable.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#106

Post by Cyberdog »

someotheracct7 wrote: post #53
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

Would love it if there were some kind of markup standard that password managers could read to determine the site's password rules when generating strong passwords. I have the problem now with sites that don't tell you their password policy - I'll try several times to generate a password in LastPass and then end up with several entries for the same site, which I now need to inspect to determine which one is the one I…

There sort of is. In HTML5, text-based form elements have a new "pattern" attribute which takes a regular expression that matches valid input, so the browser can do client-side validation without using JavaScript to intercept the form before it's posted and such. Assuming the site developers have bothered to implement it on their site, then theoretically a password manager could use that to determine valid characters for generated passwords (or, at least, invalid ones). I don't know if any of them actually do this, though.

http://www.w3.org/wiki/HTML/Elements/input/password

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#107

Post by jerf »

valarauca1 wrote: post #104
dragontamer wrote: post #102

Earlier quoted context omitted.

Technical users use Diceware because its the best way for the human mind to capture entropy. https://en.wikipedia.org/wiki/Diceware Its the non-technical users who try the silly stuff. A diceware password with 4 words is 51-bits of entropy. 5 Words gets you 64-bits of entropy. For example, if you remember that "U+2708" is the Airplane emoji, why not just type the string "U2708" on the end of the password (ex: MyPassw…

The old bits of entropy count is based on extended ASCII. In reality we could count UFT-8 code points, with each code point having 1/#code_point entropy. As a brute force guesser can throw UTF-8 chars instead of attempting to rebuild emoji from their underlying ASCII string.

"with each code point having 1/#code_point entropy."

That requires that users be uniformly-randomly selecting Unicode characters. There's a number of problems with this idea, most notably that the resulting password would have an insanely high "difficulty to type"/"bit of entropy" ratio. By the time you're through your third keyboard mode switch or third character typed in via generic Unicode hex entry, a 4-word passphrase user already has logged in and opened their browser.

Mixing in a single Unicode character into your password might be sorta clever, but you probably shouldn't rely on getting a lot more "bits" out of it.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#108

Post by valarauca1 »

jerf wrote: post #107
valarauca1 wrote: post #104

Earlier quoted context omitted.

The old bits of entropy count is based on extended ASCII. In reality we could count UFT-8 code points, with each code point having 1/#code_point entropy. As a brute force guesser can throw UTF-8 chars instead of attempting to rebuild emoji from their underlying ASCII string.

"with each code point having 1/#code_point entropy." That requires that users be uniformly-randomly selecting Unicode characters. There's a number of problems with this idea, most notably that the resulting password would have an insanely high "difficulty to type"/"bit of entropy" ratio. By the time you're through your third keyboard mode switch or third character typed in via generic Unicode hex entry, a 4-word pass…

Users don't uniformly select ASCII characters but generally we accept 1 char of password length === 8 bits of entropy.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#109

Post by jerf »

Klathmon wrote: post #76
masklinn wrote: post #27

Earlier quoted context omitted.

There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the…

I enjoy seeding a random password generator with a bunch of non-ascii characters [1]. Often it fails telling me that I'm using unsupported characters, other times the form just doesn't return (or returns with a 5xx error), and even worse sometimes it lets me create the account but I can't login because they did something weird with those characters. I'd say less than 70% of sites let me login with one of these in my…

The first "smiley face" on ALT-1 is actually the ASCII character SOH "start of heading"; many things that might otherwise accept Unicode will properly filter that out because ASCII control codes are illegal in a wide variety of otherwise-accepting contexts.

But it is a great QA check on any text field, which should either cleanly reject it in some manner [1] XOR accept it and process it "correctly" for whatever that means locally, but not something in between.

[1]: A lot of Unicode processing nowadays puts in the Unicode replacement character for unknown characters, but for the ASCII control codes I'd say you've often got a solid security case to say "Someone's just trying to screw with the system, we'll just filter it out entirely" for them. Excepting the ones we still use, basically \r \n \t, there's not much reason to keep them. (Think twice about \v "vertical tab" and think three times about letting \b "backspace"s through. Inconsistent behaviors by various layers of code are scary.)

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#110

Post by jerf »

valarauca1 wrote: post #108
jerf wrote: post #107

Earlier quoted context omitted.

"with each code point having 1/#code_point entropy." That requires that users be uniformly-randomly selecting Unicode characters. There's a number of problems with this idea, most notably that the resulting password would have an insanely high "difficulty to type"/"bit of entropy" ratio. By the time you're through your third keyboard mode switch or third character typed in via generic Unicode hex entry, a 4-word pass…

Users don't uniformly select ASCII characters but generally we accept 1 char of password length === 8 bits of entropy.

No, we do not. Six is a much better estimate (26 times 2+10 = 62, close to 64), and that's still for a uniformly-random selection, which many passwords are not even close to.
Post reply on HN