Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I included emoji in my password and now I can't log in to my Account on Yosemite

apple.stackexchange.com

Post reply on HN
Print view View original

141–150 of 150 posts

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#141

Post by tracker1 »

reinhardt wrote: post #80
grahamel wrote: post #66

Earlier quoted context omitted.

What is really frustrating about this is when I asked them why they reply "we've chosen these limits to make sure your online password is secure"

I can imagine your facepalm.. Wondering how many of these "up to N characters" rules are actually there because there is a `password CHAR(N)` DDL declaration for storing plaintext passwords...

I tend to set password fields to varchar(400), though it's encoding info and base64 hashes.

    encoding\options\base64-salt\base64-hash-of-normalized-utf8
I keep the encoding/options so it can be backwards compatible on change... when an encoding/options isn't the current when the user logs in, it will be re-encoded/saved in the current... this is so that security can be upgraded over time.

Run normalization on composite unicode characters & look-a-likes before encoding.

I do one thing some consider bad, which is strip leading/trailing whitespace which is more often a copy-paste error, not actual password entry.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#142

Post by jerf »

tracker1 wrote: post #140
dragontamer wrote: post #135

Earlier quoted context omitted.

> 1 char of password length === 8 bits of entropy Oh hell no. https://xkcd.com/936/ The "little obscure tricks" to increase the entropy of a password do NOT work well with human memory. If your template is "Uncommon Word + Emoji + 5 tweaks", your entropy is 50,000 (the uncommon word) x (number of Emojis) x 5 * 8 (there are roughly 8 ways to "tweak" a word). There are no more than 500 Emojis that people use. You're no…

The only down side to that, is when you're trying to enter it on your phone. I do use sentences, but generally not that long... usually wind up with 15-20 characters, which is long enough. LastPass helps with some instances. "F34r is the mind killer." as an example, does use replacement, but only in one of the words, it's short enough that phone entry isn't too bad, and is easy enough to remember. Given it's a phrase…

'"F34r is the mind killer." as an example, does use replacement,'

This is the sort of thing I mean, though, when I say we don't usually use fully random replacement. 3 for e, 4 for a, $ for s, these things add very little entropy overall because they are so common. We don't really use "symbols" in our passphrases; we use only !@$& probably overall, and those in highly stereotyped situations.

Suppose you know the first four characters of someone's password are "hous"; what's the next character? Big, big spikes around e and 3, maybe a smaller one on E and i/I, then "everything else".

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#143

Post by ufmace »

TwoBit wrote: post #11
OSButler wrote: post #4

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline…

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

Which makes you think - Schwab is keeping probably billions of dollars safe. I've never heard of a theft from them, including via online account compromise. Meanwhile, many other sites doing better jobs of following security best practices can't keep even email addresses secure.

Maybe we're the ones doing it wrong, and it's us that should be learning from them?

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#144

Post by euyyn »

dragontamer wrote: post #102
notfoss wrote: post #89

Earlier quoted context omitted.

Not trying to excuse OSX's behaviour, but non-technical users are the ones who use passwords like: abcdef, 123456, password123, etc. In fact, using such characters (emojis, other unicode characters, etc.) in passwords should be considered a secure practice.

Technical users use Diceware because its the best way for the human mind to capture entropy. https://en.wikipedia.org/wiki/Diceware Its the non-technical users who try the silly stuff. A diceware password with 4 words is 51-bits of entropy. 5 Words gets you 64-bits of entropy. For example, if you remember that "U+2708" is the Airplane emoji, why not just type the string "U2708" on the end of the password (ex: MyPassw…

Technical users that had never heard of Diceware before, because it's obscure, don't use it :)

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#146

Post by mcherm »

mcherm wrote: post #90
berberous wrote: post #84

Earlier quoted context omitted.

If you call in to your fidelity account, they ask you to type in your username and password with the keypad to authenticate yourself. I haven't given it much thought, so perhaps I'm wrong, but this struck me as probably based on some dicey insecure backend implementation.

More likely it is to prevent your having to say your password to the person on the phone. This protects you from a malicious bank employee.

I don't know what Fidelity does, but I work at a bank and if we were to implement such a feature we handle it securely. When you set your password we store a hash of the password, but we also store a hash of the keypad version of your password.

So logins to the website still use the full character set -- only logins via the phone are verified against the keypad mapping. That one has less entropy (because of the reduced character set) but attempts to brute-force it will QUICKLY be recognized and stopped, since each attempt is visible to a human being who is handling the phone call.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#147

Post by hahainternet »

philh wrote: post #57
hahainternet wrote: post #47

Earlier quoted context omitted.

I know of an online store that if you use a + in your email address, will fail to charge you for any goods you order. I'm assuming because something somewhere on their backend assumes that '+' is an invalid email character and refuses to process the job. This is unbelievably common.

I remember finding somewhere that let me sign up with a +, but not log in with it - unless I disabled client-side validation, at which point the server was happy to let me in.

If you ever order from HobbyKing (not the store I mentioned previously) do NOT have a plus in your email. It gets converted silently to a space in their internal systems and their customer support has absolutely 0 access or escalation.

They outsource everything, and ultimately it took me months to sort everything out.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#148

Post by biot »

j42 wrote: post #56
kgtm wrote: post #40

Earlier quoted context omitted.

Interesting. I would love to hear more details, like how much traffic you are bringing in total from these mini-apps and how much income from Adsense.

I have two books in my queue actually, and this is one of them. There are parts of my content-property model I'm not ready to share, but most of it has been structured into a cohesive framework of how I: 1. find niches 2. automate site creation 3. optimize w/ gpt (google publisher tag) I'm sorry to say I won't be releasing that first... The first is due within the next 12-14 days, after which it should take me 1-2 mo…

5 figures per day as in $10K+ every day? Impressive! How many of those tools require constant automation? Something like a CSS converter or JS beautifier should only need updating to fix bugs or due to updates of underlying libraries.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#149

Post by School-Cotton »

Tepix wrote: post #25
moviuro wrote: post #12

Earlier quoted context omitted.

I'm pretty sure the standard US layout offers more than enough symbols to write an excellent password. I tend to prefer extremely long passwords/phrases over things that require stupid characters (had trouble with WiFi keys using the French "é" back in 2008, all my passwords are ASCII since)

I'm baffled that the standard US keyboard layout doesn't even have the ° character, something I use all the time.

I think we typically get around this by writing things like "122 degrees", "50C", "122F", etc. in informal settings.

Re: I included emoji in my password and now I can't log in to my Account on Yosemite

#150

Post by Johnny_Brahms »

lwf wrote: post #43
cubitesystems wrote: post #37

Earlier quoted context omitted.

LUKS does not really have a password screen. It must have been your X-window session or terminal emulator that did not support it. LUKS can handle it!

It was actually neither, most probably. Rather, a prompt generated by https://wiki.freedesktop.org/www/Software/Plymouth/

Ah yes! Thanks for the correction.
Post reply on HN