12 ms·
I included emoji in my password and now I can't log in to my Account on Yosemite
- Johnny_Brahms 11y agoI have had something similar bite me, although mine was easily fixed. I used swedish (åäö) characters for my disk encryption password. This worked fine, until I did a dist-upgrade and had my boot keyboard reset to US QWERTY (using a custom swedish version of capewell-dvorak). The solution for me was to stick on LTS distros.
- Drakim 11y agoYou can still write åäö with the numpad if your keyboard has one. Alt + 134 = å
- Johnny_Brahms 11y agoI tried that. The LUKS password screen did not support it.
- cubitesystems 11y agoLUKS does not really have a password screen. It must have been your X-window session or terminal emulator that did not support it. LUKS can handle it!
- lwf 11y agoIt was actually neither, most probably. Rather, a prompt generated by https://wiki.freedesktop.org/www/Software/Plymouth/ https://wiki.freedesktop.org/www/Software/Plymouth/
- Johnny_Brahms 11y agoAh yes! Thanks for the correction.
- sbierwagen 11y agoIncorrect. Linux does not support alt codes. https://en.wikipedia.org/wiki/Alt_code https://en.wikipedia.org/wiki/Alt_code
- keithpeter 11y agoA quote from the Slackware README_CTYPT.txt "NOTE: if you use a non-US keyboard and need to enter a passphrase during boot, this may be problematic if the keyboard mapping is US while Slackware runs from the initrd filesystem. In this case, add support for your keyboard to the initrd image using this additional parameter to the 'mkinitrd' command above: "-l <language>". The string <language> is the same as the one you select in the installer when your keyboard is non-US. Example for a dutch keyboard: "-l nl"." Now I'm warned that other systems that use automated kernel updates may clobber the keyboard choice for the initrd.
- Johnny_Brahms 11y ago"May" as in "most certainly did", at least when you are lazy like me and use a GUI-centered distro. I ended up plugging the harddrive into another computer and fixing it from there. I never got that shit from slackware...
- notalaser 11y agoSlackware don't do shit. In fact, Slackware don't do anything unless it's told, which is not as bad a thing as it may seem.
- keithpeter 11y agoTook me some years to work it out but I have begun to appreciate Slackware since installing 14.1 summer before last.
- kuschku 11y agoI have to input a different keyboard when logging in through sddm vs. when using sudo, due to sddm refusing to accept non-US locales.
- keithpeter 11y agoI have that one when running init 4 but the encryption pass phrase is before that stage of the boot up the way my laptop is set up. I'll remember that though...
- moviuro 11y agoI'm pretty sure the standard US layout offers more than enough symbols to write an excellent password. I tend to prefer extremely long passwords/phrases over things that require stupid characters (had trouble with WiFi keys using the French "é" back in 2008, all my passwords are ASCII since)
- oneeyedpigeon 11y agoOf course, characters that I use in my everyday language aren't "stupid" to me.
- Johnny_Brahms 11y agoIt was a long password phrase. One of the words just happened to be in my mother tongue.
- creshal 11y agoEvery language that is not American English is "stupid"?
- umanwizard 11y agoNo diacritics in Latin, either!
- creshal 11y agoæ?
- rwmj 11y agoA similar problem is having a UK pound sign (£) or double quotes (") in your password. These are mapped differently in UK and US keyboards, and £ is sometimes not easily available at all.
- OSButler 11y agoA client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline password generators, there were cases where the suggested password was incompatible with the associated system.
- TwoBit 11y agoThat's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.
- INTPenis 11y agoSwedbank in Sweden have a feature where you can access an accounts entire balance by generating random CC#'s for online shopping and this service is protected by your social security number, a 6 character password, a-z, 0-9 and no special characters allowed. They've had this for at least 6 years now, maybe longer. Early on when I e-mailed them about it they simply stated that it's not their service, in other words; out-sourced.
- emerongi 11y agoSwedbank also requires two-factor authentication. You can bypasss this by calling them - they only ask for 1 thing to authenticate you. Two-factor authentication is rather useless if you can just bypass it like that.
- INTPenis 11y agoYes, and I had no idea they were that easy to bypass on a social level. Also this CC# generator falls outside of the 2FA scope, also something I asked them about several years ago and received the same reply "it's not our service". It's scary.
- BorisMelnik 11y agoWas really surprised to see such a great solution and walkthrough. I had no idea Mac's had "unicode text input" software on default machines. I wonder why Window's hasn't upgraded charmap.exe over the years? Ok and hear me out on this: a startup idea based on emoji passwords that encodes/decodes emojis into their hex/binary equivalent. takers?
- biot 11y ago> a startup idea based on emoji passwords that encodes/decodes > emojis into their hex/binary equivalent. Is "startup" now synonymous with "thing that I built in 2 hours and have no ability to monetize"?
- umanwizard 11y agoI'm not sure he was being 100% serious.
- j42 11y agoWell, "startup" is a poor choice of words, but he actually has a half-decent idea. As someone who owns dozens of little "tool" sites (think less/scss converters, meme generators, JS beautifiers, etc), I can tell you each is probably 1-2 pages, took an hour to build and thankfully due to some domain squatting (kw in domain) and a low bounce rate I don't have to worry much about SEO. As for the Adsense revenue, I think you'd be quite surprised. One is an afternoon, not a startup idea. 50, on the other hand, could be passive income for a very long time. Just something to consider before jumping to negativity. ;)
- kgtm 11y agoInteresting. I would love to hear more details, like how much traffic you are bringing in total from these mini-apps and how much income from Adsense.
- j42 11y agoI have two books in my queue actually, and this is one of them. There are parts of my content-property model I'm not ready to share, but most of it has been structured into a cohesive framework of how I: 1. find niches 2. automate site creation 3. optimize w/ gpt (google publisher tag) I'm sorry to say I won't be releasing that first... The first is due within the next 12-14 days, after which it should take me 1-2 months to finish writing & editing the adsense-property-model guide. To leave you with something tangible, it's very feasible to produce 5-figures per day with only hosting cost as your overhead ($300/mo). [edit] without automation tools though, it would obviously be very tedious to produce the number of properties required to have that kind of income by hand. process flow & site generation/management is the crux of this strategy.
- drdeca 11y agoI had problems when I set my admin username on my windows laptop to when setting it up for the first time. It wouldn't let me do things which required admin, iirc.
- socket0 11y agoWell, the account is now secure. Objective achieved?
- golergka 11y agoOn one hand, I want to leave a witty comment in the line of "play stupid games, win stupid prizes". On the other hand, I'm sad that I didn't try to do that myself.
- bhaak 11y agoSuch problems are the reason why I never use anything but ASCII letters as passwords (if the system doesn't enforce arbitrary password policies). I'd rather have a longer ASCII-only password than a shorter one I might not be able to input. There's also the issue that often you are not sure what keyboard layout is current enabled and even such unsuspicious characters like ! or # are on completely different locations on different keyboard layouts (then there's the z-y swap on German derived keyboards and have you ever had a look at a French keyboard layout?). You can never be sure if a system locks you out after failed attempts, so I want to be sure that there are as few error sources as possible.
- danieltillett 11y agoI got bit by this problem before. I wrote a one liner to avoid generating passwords where the keyboard might be an issue [1]. 1. http://www.tillett.info/2013/05/29/letters-to-avoid-in-creating-passwords-for-non-english-keyboard-layouts/ http://www.tillett.info/2013/05/29/letters-to-avoid-in-creat...
- jbit 11y agoAs somebody who uses numerous keyboard layouts on a daily basis, this is an interesting idea! I wonder how hard it'd be to make a script where you specify which keyboard layouts you're likely to encounter and it finds the common symbols... Of course, if you specify dvorak it'd wreck everything :)
- ramses0 11y agoI got bit one time at work by setting a password as "$foo", instead of "foo$" or "fo$o" ... turns out the password-setting script was written in perl and Strange Things happened where only some systems got updated but not others. Honestly, probably exploitable now that I'm thinking about it... I'll have to stop by the security group and give them something to chew on over the holidays.
- realusername 11y agoI had the same problem at the university with a password with '*' in it. It was actually some old bash script behind it which would update random things.
- r00fus 11y agoReminds me of a time in France when someone at a customer site complained they were locked out of their laptop - his Win NT4 laptop had a QWERTY keyboard but he put his password in french using the keyboard switcher in the OS. Back then Windows didn't allow you to change keyboard type at the login screen - it kept what you were using when you logged off...
- minikomi 11y agoHmm. Not really related, but now that it seems to be fixed - I discovered that using an equals sign in your name was enough to be "locked out" of Airbnb - it wrecked the cookie & every page would return 403. No bug bounty though haha. Guess it wasn't enough of an "attack vector" to try and convince someone to change their name.
- hahainternet 11y agoI know of an online store that if you use a + in your email address, will fail to charge you for any goods you order. I'm assuming because something somewhere on their backend assumes that '+' is an invalid email character and refuses to process the job. This is unbelievably common.
- omnibrain 11y agoI had all kinds of trouble trouble with my abc@firstname.lastname.name mailadress. Some did not recognize .name. Others had trouble with the third level domain. Sometimes the sign-up worked but something in the backend broke...
- dewey 11y agoI can't even change my email adress to my .me domain on facebook because they keep telling me it's an invalid domain ending.
- philh 11y agoI remember finding somewhere that let me sign up with a +, but not log in with it - unless I disabled client-side validation, at which point the server was happy to let me in.
- arthurcolle 11y agoThat's insanely insecure. Can't believe client side validation would be used for a login system other than as a first check
- paines 11y agoMany Linux installers suffered for years the situation that you would enter you password in the setup process with a different keymap than the one you got once the system then loaded, e.g. y-z were mismatched cause I was using QWERTZ instead of QWERTY. I think I saw something similar lately with on of the OSX'es.
- deleted 11y ago[deleted]
- coderdude 11y agoShit at least have them cats work for it. Can't wait till someone handles their own gf before they invoke me. Fun stuff this goes unpoorly undo only them poors
- coldtea 11y agoYou try to make things idiot-proof and they bring in better idiots. 1) The user tried to see if emoji can be used for the password. 2) Without checking on the web/forums/etc first. 3) On their main user account (not a disposable one). 4) With FileVault turned on. I can't even...
- Twisell 11y agoAnd this is a perfect reminder that you should never try some crazy things on your only administrator account on your production machine. Had he test his point on a dummy account : delete account = problem solved
- dlitz 11y agoWell, really, it should just work or OSX should prevent this from happening in the first place. Emoji are common among non-technical users---exactly the market that Apple supposedly caters to---and why would anyone expect a non-technical user to know that using emoji in a password would be considered "crazy", without knowing the extensive legacy of pre-Unicode systems, the location of many emoji outside the Basic Multilingual Plane, their relatively recent inclusion in Unicode 8.0, etc etc.? It is a mistake to blame the user for something like this.
- notfoss 11y agoNot trying to excuse OSX's behaviour, but non-technical users are the ones who use passwords like: abcdef, 123456, password123, etc. In fact, using such characters (emojis, other unicode characters, etc.) in passwords should be considered a secure practice.
- dragontamer 11y agoTechnical users use Diceware because its the best way for the human mind to capture entropy. https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware Its the non-technical users who try the silly stuff. A diceware password with 4 words is 51-bits of entropy. 5 Words gets you 64-bits of entropy. For example, if you remember that "U+2708" is the Airplane emoji, why not just type the string "U2708" on the end of the password (ex: MyPasswordU2708). The longer password is going to add provably the same amount of entropy, and will work with virtually any system.
- valarauca1 11y agoThe old bits of entropy count is based on extended ASCII. In reality we could count UFT-8 code points, with each code point having 1/#code_point entropy. As a brute force guesser can throw UTF-8 chars instead of attempting to rebuild emoji from their underlying ASCII string.
- DonHopkins 11y agoYou can use Emoji characters in Wifi network names. My network name is [POOP]. See what kind of fun you can have at the airport by making an ad-hoc network called [AIRPLANE][BOMB].
- gutnor 11y agoSeems to be a good way to be exempted of business trip to/from the US for the rest of your life. Too bad it also affects leisure trips.
- deleted 11y ago[deleted]
- nkrisc 11y agoSure it's a silly thing to try, but this is entirely an oversight on Apple's part and is squarely their fault. They had the power to make this situation impossible and they didn't.
- RUG3Y 11y agoThis is the funniest thing I've read in a while.
- grapeshot 11y agoThe Chrome password manager still crashes the entire browser when trying to save any password with emoji in it on Windows. Firefox works perfectly fine.
- msftie 11y agoIn college I worked at an Apple store. One day while on break in the back of the store, I changed my company account password to a lengthy sentence, something at least 30+ characters. The system accepted the change. When I tried to log in to the timeclock application again using the password, it threw Null Pointer Exceptions (it was a Java app, incidentally). In order to get back on the clock and get paid again, I had to reset my password -- but entering my current password into the "old password" field caused the system to throw more Null Pointer Exceptions. I called Apple IT to do a manual reset of my password, and after explaining my situation, the response a very cold, concise and condescending "why would you do this..."
- TazeTSchnitzel 11y agoI used ® as my password during (what Americans would call) middle school. Alt+numpad works on the Windows XP login screen. It never caused me any trouble.