Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I included emoji in my password and now I can't log in to my Account on Yosemite

apple.stackexchange.com

Post reply on HN
Print view View original

131–140 of 150 posts

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#131

Post by syntheticnature »

masklinn wrote: post #51
gambiting wrote: post #49

Earlier quoted context omitted.

Try to create a password at Jet2.com. A Password like: "SuperSecretPassword!" gives you an error "Your password must be at least six characters or more and is case sensitive.". It's idiotic.

Oh yes, I'd almost forgotten about the misleading, unhelpful or downright incorrect error messages. It's also fun when account creation and login form don't use the same validation rules, so you can create an account but then you can't log into it.

I ran into that once with my credit card company. I used a generator to create a maximum length password, only to discover that the Javascript managing the login had an off-by-one error and wouldn't accept that length. I was able to work around it through judicious use of browser inspection tools -- the change password page accepted it just fine.

I sent in a complaint and got something to the effect of "well, no one else reported it."

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#133

Post by j42 »

kgtm wrote: post #69
j42 wrote: post #56

Earlier quoted context omitted.

I have two books in my queue actually, and this is one of them. There are parts of my content-property model I'm not ready to share, but most of it has been structured into a cohesive framework of how I: 1. find niches 2. automate site creation 3. optimize w/ gpt (google publisher tag) I'm sorry to say I won't be releasing that first... The first is due within the next 12-14 days, after which it should take me 1-2 mo…

Thanks for the reply. Does site creation involve pure content sites as well as simple web apps? Or maybe some kind of hybrid for SEO purposes? I would love to read more once you have something published. You should consider adding some contact info in your profile so that people won't go on a stalking expedition to find you (as i did) :)

Hah, the way you phrase that makes me wonder what you found.

Right now really just web apps. Content sites are doable, and I know people running networks, but it's not possible to do profitably without clickbaiting, low-quality mass-produced content, and other greyhat techniques I don't particularly like.

I think it's fair to show you an ad if I save you 30 seconds to a minute of time. Creating garbage content slideshows with writers from the 3rd world countries to rack up pageviews is one step over the line for me...

Simple apps are great because they have utility (so google always approves your tag), and honestly the doubleclick exchange isn't so bad -- with enough simple single-page apps, it accrues pretty quickly.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#134

Post by bryankaplan »

TwoBit wrote: post #11
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

That used to be true, but Schwab has since removed their character limit. I just updated my password to one having more than sixty characters.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#135

Post by dragontamer »

valarauca1 wrote: post #108
jerf wrote: post #107

Earlier quoted context omitted.

"with each code point having 1/#code_point entropy." That requires that users be uniformly-randomly selecting Unicode characters. There's a number of problems with this idea, most notably that the resulting password would have an insanely high "difficulty to type"/"bit of entropy" ratio. By the time you're through your third keyboard mode switch or third character typed in via generic Unicode hex entry, a 4-word pass…

Users don't uniformly select ASCII characters but generally we accept 1 char of password length === 8 bits of entropy.

> 1 char of password length === 8 bits of entropy

Oh hell no. https://xkcd.com/936/

The "little obscure tricks" to increase the entropy of a password do NOT work well with human memory. If your template is "Uncommon Word + Emoji + 5 tweaks", your entropy is 50,000 (the uncommon word) x (number of Emojis) x 5 * 8 (there are roughly 8 ways to "tweak" a word).

There are no more than 500 Emojis that people use. You're not getting much entropy by choosing one. Now if you start choosing obscure Chinese words and Arabic symbols, maybe you'd be getting somewhere (It requires mastery of multiple languages to really exercise that UTF-8 dataset).

But honestly, an English-speaker will get far more entropy by just adding two more common words (top 5000) to their password. A new common word is worth a hell of a lot more than an Emoji. A phrase of 8 words (ie a sentence) is also very easy to memorize and contains a ton of entropy as well.

Even a simple sentence is impossible to brute force. The following sentence has probably never been said in the history of humanity:

"My long password to gmail.com is a passphrase, the current sentence that I just typed, lulz!"

That sentence is virtually unhackable and easy as heck to memorize. Sure, the entropy is only a few bits per character, but the length makes it better. And since it uses common letters, it is extremely quick to type.

So unless you plan on learning a new language to hit those obscure Unicode symbols, I think its best to just stick with what your brain is already wired to memorize: Words. Common English Words.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#136

Post by to3m »

hahainternet wrote: post #47
minikomi wrote: post #29

Hmm. Not really related, but now that it seems to be fixed - I discovered that using an equals sign in your name was enough to be "locked out" of Airbnb - it wrecked the cookie & every page would return 403. No bug bounty though haha. Guess it wasn't enough of an "attack vector" to try and convince someone to change their name.

I know of an online store that if you use a + in your email address, will fail to charge you for any goods you order. I'm assuming because something somewhere on their backend assumes that '+' is an invalid email character and refuses to process the job. This is unbelievably common.

I hope I get lucky with something like that one day!

It's more usual that the front end thinks '+' is invalid too. The usual result is that my signup attempt is blocked. And when I send them feedback about it, I'm roundly ignored.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#137

Post by rasz_pl »

INTPenis wrote: post #13
TwoBit wrote: post #11

Earlier quoted context omitted.

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

Swedbank in Sweden have a feature where you can access an accounts entire balance by generating random CC#'s for online shopping and this service is protected by your social security number, a 6 character password, a-z, 0-9 and no special characters allowed. They've had this for at least 6 years now, maybe longer. Early on when I e-mailed them about it they simply stated that it's not their service, in other words; o…

reminds me of this story http://www.windytan.com/2015/04/trackers-and-bank-accounts.h...

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#139

Post by msftie »

In college I worked at an Apple store. One day while on break in the back of the store, I changed my company account password to a lengthy sentence, something at least 30+ characters. The system accepted the change.

When I tried to log in to the timeclock application again using the password, it threw Null Pointer Exceptions (it was a Java app, incidentally). In order to get back on the clock and get paid again, I had to reset my password -- but entering my current password into the "old password" field caused the system to throw more Null Pointer Exceptions.

I called Apple IT to do a manual reset of my password, and after explaining my situation, the response a very cold, concise and condescending "why would you do this..."

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#140

Post by tracker1 »

dragontamer wrote: post #135
valarauca1 wrote: post #108

Earlier quoted context omitted.

Users don't uniformly select ASCII characters but generally we accept 1 char of password length === 8 bits of entropy.

> 1 char of password length === 8 bits of entropy Oh hell no. https://xkcd.com/936/ The "little obscure tricks" to increase the entropy of a password do NOT work well with human memory. If your template is "Uncommon Word + Emoji + 5 tweaks", your entropy is 50,000 (the uncommon word) x (number of Emojis) x 5 * 8 (there are roughly 8 ways to "tweak" a word). There are no more than 500 Emojis that people use. You're no…

The only down side to that, is when you're trying to enter it on your phone. I do use sentences, but generally not that long... usually wind up with 15-20 characters, which is long enough. LastPass helps with some instances.

"F34r is the mind killer." as an example, does use replacement, but only in one of the words, it's short enough that phone entry isn't too bad, and is easy enough to remember. Given it's a phrase from a movie/book, but probably good enough.

That said, I probably wouldn't have thought to use an emoji, I know some people hate it, but I do filter whitespace at the beginning/end of protected entry (reset codes, etc), as copy-paste + whitespace errors are more common than leading/trailing whitespace in a password.

Post reply on HN