Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I included emoji in my password and now I can't log in to my Account on Yosemite

apple.stackexchange.com

Post reply on HN
Print view View original

111–120 of 150 posts

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#111

Post by masklinn »

berberous wrote: post #99
mcherm wrote: post #90

Earlier quoted context omitted.

More likely it is to prevent your having to say your password to the person on the phone. This protects you from a malicious bank employee.

Right, but my point is the backend to make this work must be terribly insecure. I just did some reading, and apparently they take your password and just store the keypad equivalent (or more likely, a hash thereof). So you can login in to the website with your original password, the keypad mapping of that password, or any text password that maps to the same keypad digit mapping, and they all work.

> they take your password and just store the keypad equivalent (or more likely, a hash thereof)

That's… not exactly more likely. These are commonly systems predating the internet, from a time when connected networks were trade-specific and Very Expensive, storage security was a lesser concern (and CPU-expensive) when the system could only be accessed on dedicated lines only accessible to employees.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#112

Post by jdmichal »

berberous wrote: post #99
mcherm wrote: post #90

Earlier quoted context omitted.

More likely it is to prevent your having to say your password to the person on the phone. This protects you from a malicious bank employee.

Right, but my point is the backend to make this work must be terribly insecure. I just did some reading, and apparently they take your password and just store the keypad equivalent (or more likely, a hash thereof). So you can login in to the website with your original password, the keypad mapping of that password, or any text password that maps to the same keypad digit mapping, and they all work.

> So you can login in to the website with your original password, the keypad mapping of that password, or any text password that maps to the same keypad digit mapping, and they all work.

I'd have to see this to believe it. I would hope that they would at least store it as two separate entries, and only use the phone one during the phone process. And the person on the phone will likely still ask you some less-sensitive verification questions.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#113

Post by sbierwagen »

tbabb wrote: post #55
someotheracct7 wrote: post #53

Earlier quoted context omitted.

Would love it if there were some kind of markup standard that password managers could read to determine the site's password rules when generating strong passwords. I have the problem now with sites that don't tell you their password policy - I'll try several times to generate a password in LastPass and then end up with several entries for the same site, which I now need to inspect to determine which one is the one I…

I would love it if there were FCC-mandated password handling standards, like a (long) minimum max length, a (wide) mimimum permissible charset, and forbidden plaintext storage. It's arguably an issue of national security. (Or some other appropriate regulatory agency).

Jurisdiction over which agency gets to do "cyber" stuff has been an open question for the last thirty years. You can make good arguments that it should be covered by the FBI, NSA, DHS, ATF, the secret service, etc etc.

(Yes, the Secret Service! The famous raid on Steve Jackson Games back in 1990 was actually carried out by Secret Service agents, who thought that GURPS Cyberpunk was an actual hacking manual.)

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#114

Post by sbierwagen »

Drakim wrote: post #3
Johnny_Brahms wrote: post #2

I have had something similar bite me, although mine was easily fixed. I used swedish (åäö) characters for my disk encryption password. This worked fine, until I did a dist-upgrade and had my boot keyboard reset to US QWERTY (using a custom swedish version of capewell-dvorak). The solution for me was to stick on LTS distros.

You can still write åäö with the numpad if your keyboard has one. Alt + 134 = å

Incorrect. Linux does not support alt codes.

https://en.wikipedia.org/wiki/Alt_code

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#115

Post by sbierwagen »

j42 wrote: post #56
kgtm wrote: post #40

Earlier quoted context omitted.

Interesting. I would love to hear more details, like how much traffic you are bringing in total from these mini-apps and how much income from Adsense.

I have two books in my queue actually, and this is one of them. There are parts of my content-property model I'm not ready to share, but most of it has been structured into a cohesive framework of how I: 1. find niches 2. automate site creation 3. optimize w/ gpt (google publisher tag) I'm sorry to say I won't be releasing that first... The first is due within the next 12-14 days, after which it should take me 1-2 mo…

Automated site creation... what, you're taking some public domain content, loading it up with ads, then hoping it ends up higher in the SERP than the original source?

How is this different than filling amazon with autogenerated kindle "books" made from Wikipedia articles?

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#116

Post by gutnor »

DonHopkins wrote: post #86

You can use Emoji characters in Wifi network names. My network name is [POOP]. See what kind of fun you can have at the airport by making an ad-hoc network called [AIRPLANE][BOMB].

Seems to be a good way to be exempted of business trip to/from the US for the rest of your life. Too bad it also affects leisure trips.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#117

Post by Klathmon »

jerf wrote: post #109
Klathmon wrote: post #76

Earlier quoted context omitted.

I enjoy seeding a random password generator with a bunch of non-ascii characters [1]. Often it fails telling me that I'm using unsupported characters, other times the form just doesn't return (or returns with a 5xx error), and even worse sometimes it lets me create the account but I can't login because they did something weird with those characters. I'd say less than 70% of sites let me login with one of these in my…

The first "smiley face" on ALT-1 is actually the ASCII character SOH "start of heading"; many things that might otherwise accept Unicode will properly filter that out because ASCII control codes are illegal in a wide variety of otherwise-accepting contexts. But it is a great QA check on any text field, which should either cleanly reject it in some manner [1] XOR accept it and process it "correctly" for whatever that…

It makes sense that control characters are removed (or replaced). I didn't know the ALT-1 was SOH, so that's good to know. (I guess I'm showing my age a bit there)

Thanks for the info!

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#118

Post by berberous »

jdmichal wrote: post #112
berberous wrote: post #99

Earlier quoted context omitted.

Right, but my point is the backend to make this work must be terribly insecure. I just did some reading, and apparently they take your password and just store the keypad equivalent (or more likely, a hash thereof). So you can login in to the website with your original password, the keypad mapping of that password, or any text password that maps to the same keypad digit mapping, and they all work.

> So you can login in to the website with your original password, the keypad mapping of that password, or any text password that maps to the same keypad digit mapping, and they all work. I'd have to see this to believe it. I would hope that they would at least store it as two separate entries, and only use the phone one during the phone process. And the person on the phone will likely still ask you some less-sensitiv…

I had googled just now and read that somewhere else, but you are right, I just tested it, and it does not work as I described on the website itself.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#119

Post by zhte415 »

Twisell wrote: post #78

And this is a perfect reminder that you should never try some crazy things on your only administrator account on your production machine. Had he test his point on a dummy account : delete account = problem solved

Sometimes it's not a crazy thing to do. I'm writing in ASCII not, but my input format isn't always set to this.

Depending on combination of input method and storage method, especially when the screen doesn't display the number of characters being inputted, it is a mild pain. One to learn from, but a pain.

Working with colleagues don't use English regularly and that have a variety of IMEs (that in most cases display an identical result) and don't expect to hit Ctrl+Space, or whatever shortkey is being used for every input form... input tools that expect ASCII but don't return feedback are huge levels of pain.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#120

Post by thisjustinm »

Twisell wrote: post #78

And this is a perfect reminder that you should never try some crazy things on your only administrator account on your production machine. Had he test his point on a dummy account : delete account = problem solved

And this is a perfect reminder that if you allow some crazy input in your system you will eventually get someone who inputs something crazy.

Had Apple properly validated the input and accounted for this case or disallowed it entirely they could have avoided this.

Don't mean to troll but there are two sides to every issue like this: blame the user or blame the developer.

Post reply on HN