Earlier quoted context omitted.
Why would it have to be free?
Do you know what the cost of breaking into a fully up to date BFU iPhone is?
They're not breaking in; he knows the password. Also, it's not fully up-to-date; it's an iPhone 13.
Apple update looks like Czech mate for locked-out iPhone user
191–200 of 237 posts
Re: Apple update looks like Czech mate for locked-out iPhone user
#192Earlier quoted context omitted.
> Unicode was introduced to solve that very problem, and it largely does. What? Unicode doesn't address the problem at all. Your emoji password will look completely different depending on the encoding you use. We have multiple popular encodings right now... but instead of software that lets us specify which encoding we want to use to interpret a document, we have software that intentionally prohibits us from doing th…
Unicode is the code points. Of course you have to normalize on one encoding for password hashing (and UTF-8 is the canonical choice for that, because interfaces to hash implementations are byte-based), but that’s not an issue of end-user input. The goal of Unicode was to be able to roundtrip the existing encodings through it, and it achieved that goal. > That would have had no effect other than momentary user confusi…
> No. The analogon to TFA would be that the old keyboard would have a Yen key and no backslash key, and the new keyboard would have no Yen key and still no backslash key. The point is that the Yen key would be removed because its character code is not part of the shared common subset of ASCII. ASCII doesn’t imply that you have a keyboard capable of entering all 128 codes.
Are you sure you read the article? The key is still there.
> Of course you have to normalize on one encoding for password hashing (and UTF-8 is the canonical choice for that, because interfaces to hash implementations are byte-based)
This is pure gibberish. All encodings produce bytes. UTF-8 has no relationship to the concept that isn't shared by every other encoding.
Re: Apple update looks like Czech mate for locked-out iPhone user
#193after Apple removed a character from its Czech keyboard I wonder what the thought process (or perhaps lack thereof) at Apple was. Did no one of the likely-somewhat-large team who did that think "wait, this could lock out our users who may have used that character"? In the immortal words of Linus Torvalds: "WE DO NOT BREAK USERSPACE!" Now one of the ways in might be those companies who claim to be able to break iPhone…
[flagged]
> The Czech layout isn't exactly an obscure edge case.
From what I understand, the problem wasn't with typing characters actually used in the Czech language such as á, ř or ů. The problem was with typing the ˇ character by itself, which is normally encoded in Unicode as U+02C7 (CARON), but there also is a combining version (U+030C, COMBINING CARON), which is what gets printed if there is no precomposed character (e.g. š is both U+0161 and U+0073 U+030C). There is a thing called Unicode normalization that makes "identically looking" strings actually use the same codes, so maybe it was that thing that changed a bit (maybe even somewhere else and not in the lockscreen/keyboard logic), or they could have just removed the ability to type ˇ by itself altogether since it's not something actually used in any language or writing style and most often comes up as a result of a typo.
Re: Apple update looks like Czech mate for locked-out iPhone user
#194after Apple removed a character from its Czech keyboard I wonder what the thought process (or perhaps lack thereof) at Apple was. Did no one of the likely-somewhat-large team who did that think "wait, this could lock out our users who may have used that character"? In the immortal words of Linus Torvalds: "WE DO NOT BREAK USERSPACE!" Now one of the ways in might be those companies who claim to be able to break iPhone…
[flagged]
In my book this is proof that Apple has lost control over QA, which is a massive failure, not just some minor hiccup. This has degraded the iPhone from an important tool you rely on to a toy you can afford to lose any second. Everyone needs to draw their own conclusions from that.
Re: Apple update looks like Czech mate for locked-out iPhone user
#195Earlier quoted context omitted.
This feels like it's probably a stupid oversight chain like, keyboard layouts are user-specific data, so they're not decrypted before first unlock/set globally because the machine might have multiple users with different keyboard layouts.
Even if it is, why is there no way to change the system-wide settings? All other operating systems that I know either have an explicit button "Apply settings to login screen" or do it automatically (I'm sure 99% of the consumer-level computers sold worldwide never have more than one user on them, moreso with different keyboard layouts).
Evidently you can, though in traditional macOS fashion, you exploit Apple secretly changing the setting for you if you do a magic dance.[1][2]
I've never had a reason to try it, but there's also a remark that 99% of the Macs sold probably don't need to change the system-wide keyboard layout defaults, either...
[1] - https://heylon.ca/how-to-permanently-switch-default-keyboard...
[2] - https://support.apple.com/guide/mac-help/change-the-system-l...
Re: Apple update looks like Czech mate for locked-out iPhone user
#196Earlier quoted context omitted.
This fails if they let you keep your password migrating between devices, though, so you probably need a version somewhere in the middle that flags it as an issue and flags it as not allowing migration without changing the passphrase.
Yeah, they could force a password update at some point to ensure passwords meet the new requirements.
You need to not just force the update, but also forbid using pre-updated ones in migration, since someone might conceivably have an off-for-many-years device they wake up and want to migrate.
The long tail of stupid edge cases is very long indeed.
Re: Apple update looks like Czech mate for locked-out iPhone user
#197Earlier quoted context omitted.
In this world stolen iPhones are mostly worthless because they can’t easily be wiped without the password. In your world, they could be. I imagine iPhone thefts would go way up. They’re worth $1000 and we just carry them everywhere - if they were easily resellble it would be a very obvious quick-money theft opportunity.
iPhones are currently the primary target of thieves by an overwhelmingly wide margin. There are many ways to wipe them and its an industry in its own right. One of the most common, as always, is simple social engineering. They contact the victim posing as Apple, convince them to reveal their credentials in this way or that, wipe the device and away they go. If that fails they're stripped down and sold for parts, whic…
That’s all true, but it is also true that iPhone theft is relatively rare.
My assertion is that there would be way, way more theft if you could just downgrade and wipe.
Re: Apple update looks like Czech mate for locked-out iPhone user
#198I think the biggest lesson here is to back up. The reason for losing access to the phone is amazingly dumb but it could have fallen down the stairs for basically the same effect. And do your could backups cross-provider. You never know what the "big players" are going to pull, and your lifetime customer value is less than the cost of a single support call.
Biggest lesson is Apple should allow you to downgrade OS, especially on old devices. Or release some sort of open version once device is EOL'd.
Even if they did, would you recommend them allowing the downgrade without the passcode? Any action that requires a passcode doesn't help this user.
Re: Apple update looks like Czech mate for locked-out iPhone user
#199Earlier quoted context omitted.
Then an attacker could load an older, exploitable OS and gain access.
Not allowing downgrades is the biggest contributor to smartphones becoming e-waste. Apple should be forced to do this by law, but only after they discontinue software support. If they're willing to continue making small, incremental patches when necessary ( such as to fix this obvious bug ) then it's fine that they can still block downgrades. But at EOL? They should be legally required to allow old software to be ins…
> Not allowing downgrades is the biggest contributor to smartphones becoming e-waste.
Citation needed. My guess is the biggest contributor to smartphones becoming e-waste is gravity.
Re: Apple update looks like Czech mate for locked-out iPhone user
#200Earlier quoted context omitted.
Not allowing downgrades is the biggest contributor to smartphones becoming e-waste. Apple should be forced to do this by law, but only after they discontinue software support. If they're willing to continue making small, incremental patches when necessary ( such as to fix this obvious bug ) then it's fine that they can still block downgrades. But at EOL? They should be legally required to allow old software to be ins…
> Not allowing downgrades is the biggest contributor to smartphones becoming e-waste. Citation needed. My guess is the biggest contributor to smartphones becoming e-waste is gravity.
I have heard many replace their phones due to dropping them and becoming unusable. But everyone uses a case now and the build quality is generally better that one mishap does trash the phone. Most people I know getting new phones now did so bc their old phone "got too slow to be usable." I believe that's a matter of new OS versions really are much heavier. Both my last 2 phones I had upgraded bc I went one version too far and had a nearly bricked phone.