7 ms·

Apple update looks like Czech mate for locked-out iPhone user

337 points by OuterVale 6mo ago

_vertigo 6mo ago
I lost all of my photos when I was a college student too. I was way too irresponsible to actually back anything up. Kind of a bitter lesson.
lilytweed 6mo ago
It’s an annoying workaround, but could he connect a USB keyboard (via a USB to lightning adapter) with the ability to enter the character? Does the passcode screen accept input from attached keyboards?
- sheept 6mo ago
  As mentioned in the article, > For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered.
- deleted 6mo ago
  [deleted]
- Deadsunrise 6mo ago
  It's mentioned in the article. USB devices are blocked until the passcode has been entered.
- Myzel394 6mo ago
  Why can't people read stuff before commenting?
  - BobBagwill 6mo ago
    Today's free verse: Why can't people read stuff before commenting? Why can't people read stuff before? Why can't people read stuff? Why can't people read? Why can't people? Why can't? Why? ?
  - HauntingPin 6mo ago
    I wish we could just have comments removed where it's clear the author didn't even put in the minimum effort of reading the article. It's disrespectful to the rest of us.
  - j16sdiz 6mo ago
    Why can't people read the HN guideline before commenting? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html > Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that".
deleted 6mo ago
[deleted]
userbinator 6mo ago
after Apple removed a character from its Czech keyboard I wonder what the thought process (or perhaps lack thereof) at Apple was. Did no one of the likely-somewhat-large team who did that think "wait, this could lock out our users who may have used that character"? In the immortal words of Linus Torvalds: "WE DO NOT BREAK USERSPACE!" Now one of the ways in might be those companies who claim to be able to break iPhone security for law enforcement and the like, but I'm not sure if they'd be willing to do it (at any price) unless you could somehow trick them into thinking you had some "interesting" data on there...
- shawnta 6mo ago
  [flagged]
  - Matl 6mo ago
    I agree with you and don't really get what Apple gets from removing a valid Czech character, but how would you test if all existing passcodes remain inputable without knowing the passcodes of all iPhone users? The one way to do this that I could see is to include both the new keyboard and the old one and if someone fails to unlock with the new one auto report that to Apple (not the code, just that the unlock failed and that the keyboard might be the problem), then auto revert to the old keyboard on the next unlock attempt...
    - brainwad 6mo ago
      You assume the worst case: every character that could ever have been entered is in use.
      - sheiyei 6mo ago
        Yes, it really is that simple. They chose that responsibility the moment they allowed those characters. Any deductions done after that need to have a failsafe with the expectation they will break a clueless user's device.
    - 6mo ago
eab- 6mo ago
I used to have an emoji password for my Android phone, and had the exact same issue after a reset! It's an odd but pretty terrible failure mode for locking oneself out...
- terribleperson 6mo ago
  You say locking oneself out, but I decline to consider any situation where a password can be set but not later entered as one where the user bears even a modicum of fault.
  - ddtaylor 6mo ago
    We're so far down this path the language around the problem is distorted. Ownership has been perverted and the only thing you control is the bill.
    - terribleperson 6mo ago
      Do we even control the bill? You could buy a annual-sub-paid-monthly, be unable to cancel it because you're locked out of your account, and then get taken to collections when you terminate it on the payment side.
  - Gander5739 6mo ago
    Relevant xkcd: https://xkcd.com/2700/ https://xkcd.com/2700/
  - medvidek 6mo ago
    I remember a website that silently removed everything but the first 8 characters from the "password" field upon registration but somehow didn't do the same on the login page. It took me several hours and several password resets to actually log in after registration, since for some reason the trimming happened client-side and only when typing the password manually (and I was pasting my password from a password manager).
    - 6mo ago
jychang 6mo ago
This is completely unacceptable from Apple. You CANNOT remove a key from the keyboard that's being used as a password.
- type0 6mo ago
  as if they cared
- halapro 6mo ago
  Turns out they CAN and they WILL. The character has always been special on all Apple OSes.
nasretdinov 6mo ago
As a non-English speaker I can really relate to this. I think the real mistake was Apple allowing to enter a non-ASCII password in the first place. E.g. on macOS the password fields have been locked to English character set, and I'm not sure why it changed on iOS.
- userbinator 6mo ago
  The "real mistake" is changing things that used to work.
  - halapro 6mo ago
    You can use emojis as passwords, do you think that's a good idea? They work now, there's a good chance that they won't be the same forever. See what happened to the family emojis
    - Y-bar 6mo ago
      Did the underlying bits (hex/oct/… or whatever representation) actually change or just the visuals?
      - halapro 6mo ago
        There's no way to enter the emoji "male adult female adult male child female child" but only "two adults two children". So it's kind of both. It's like they realized that emojis really shouldn't need to deal with color and gender.
    - thephyber 6mo ago
      Passwords are more secure if they are higher entropy, so it makes sense to support a larger variety of characters, Czech or emoji. It seems paramount that the OS should not allow password input of any characters which it theater takes away. At the very minimum if this is absolutely necessary to make this breaking change, the user should be warned several times that a character in the password is no longer valid and maybe even prevent the OS from upgrading before the password is changed to a forward-compatible one.
lousken 6mo ago
Apple should get sued for this to oblivion, this is unacceptable.
- dismalaf 6mo ago
  EU citizens have specific avenues to complain and get compensation for stuff like this so hopefully the user in question uses it.
N19PEDL2 6mo ago
> Byrne was hoping that the next update, 26.4.1, would introduce a fix for this, but its release this week has not helped. Even if Apple restores the háček in a future update, wouldn't he still need to unlock the iPhone to install it?
- bpavuk 6mo ago
  afaik you can update your locked iPhone with a Mac or Windows in iTunes... but it will still require a passcode after update, so ¯\_(ツ)_/¯
  - nikanj 6mo ago
    Nope, the ”trust this computer” dialog needs you to enter your passcode before any other actions are possible
    - cedws 6mo ago
      Probably the only hope is jailbreaking.
      - cachius 6mo ago
        Jailbreaking is dead.
      - sheiyei 6mo ago
        Jailbreaking a locked, inaccessible iphone?
        userbinator 6mo ago
        Keep in mind that everyone else is usually unaware (by design) of what all the intelligence agencies can do, but I doubt they would help in this scenario even if they could. On the other hand, if this happens to a far more important person...
    - yangm97 6mo ago
freehorse 6mo ago
> During in-house testing, which involved taking an iPhone 16 from iOS 18.5 to iOS 26.4.1, The Register found that Apple has kept the háček in the Czech keyboard, but removed the ability to use it in a custom alphanumeric passcode. The OS will not allow users to input the háček as a character. The key's animation triggers, as does the keyboard's key-tap sound, but the character is not entered into the string. Sounds more like an actual bug than a decision to change the keyboard layout, if this happens only in the passcode screen?
- ape4 6mo ago
  Good on El Reg for doing some actual hands on fact finding.
- trymas 6mo ago
  I remember something like 10 years ago there was an article here in HN, where someone created a user on macOS with password out of emojis. Then he couldn’t login, because login screen does not have a special character keyboard. EDIT: found it https://news.ycombinator.com/item?id=10742351 https://news.ycombinator.com/item?id=10742351 (apparently I remember it slightly wrong, but idea still the same)
_the_inflator 6mo ago
Well I only use alphanumeric US keyboard standards ever since I found out, that certain characters unique to a language different from yours causes you lock out or massive headaches on a used keyboard with almost no print ink left on the keyboard in a Internet cafe in an other country around 2002. Be aware of characters not passwords. I feel bad for the guy but not really blame Apple here. English is my second language and ANSI etc is following a basic character usage. Everything must boil down to 0 and 1 in the end or American English. It is a de facto standard and maybe knowing about it is as crucial as recognizing the difference between the imperial and metric system before heading for the moon. It is a life saver.
- tsimionescu 6mo ago
  I agree with the recommendation, but it's absurd to not blame Apple here. There is absolutely nothing acceptable about what Apple did in this case, it's a major fuck-up to break password input in this way, and for no reason whatsoever.
PufPufPuf 6mo ago
I think the biggest lesson here is to back up. The reason for losing access to the phone is amazingly dumb but it could have fallen down the stairs for basically the same effect. And do your could backups cross-provider. You never know what the "big players" are going to pull, and your lifetime customer value is less than the cost of a single support call.
- anal_reactor 6mo ago
  This is exactly the reason why I keep all my shit on an SD card despite Google deliberately making the external storage experience as painful as possible: slow access, broken writes, failed unmounts, no filesystem repair. Literally every time I restart my phone I need to put the card to my PC and repair the filesystem. Also, same card works extremely well when plugged into PC via random cheap USB card reader. On PCs you still have Linux that resists enshittification and you can pick your own hardware, but it's a really sad state of affairs that there is literally no meaningful mobile system that isn't actively hostile to the user.
  - yangm97 6mo ago
    There’s a number of mobile Linux distributions around, some even run Android apps. People need to wake up to the fact that Android has become iOS but worse.
  - CTDOCodebases 6mo ago
    The thing that bothers me about Android is the gimped file manager. You wan't to access some files off your network using smb? Here install this third party tool and don't forget to give it full read/write access to your device.
  - nirava 6mo ago
    I just have a cheap second hand PC with a couple of good drives running LAN only Immich and a few other backup tools. This, in parallel to cloud backup, makes the setup both mobile and reasonably fault tolerant. I'm quite wary of using SD card for backup. Too easy for me to lose.
  - 6mo ago
donatj 6mo ago
I assume you can use a physical keyboard on an iPhone like I can on Android via USB? Presumably you could buy a wired Czech keyboard to access the device? Twice I have had the touchscreen fail on Android devices and been able to get what I needed off them using a USB mouse.
- GrayShade 6mo ago
  You can, after you unlock it.
  - m463 6mo ago
    I was guessing this - need to unlock to use USB devices. sigh.
- tmjwid 6mo ago
  For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered. Makes sense why he didn't do this.
PlunderBunny 6mo ago
Even if he did have a Mac with the continuity feature enabled, I suppose the lock-screen won’t accept a paste from the clipboard of a Mac. (If it did, he could enter the correct passcode in any text editor on his Mac, copy it to the clipboard on the Mac, then paste it into the lock-screen on his iPhone)
- Shank 6mo ago
  Continuity has never worked on the lock screen and certainly not in the BFU state.
wolfi1 6mo ago
there was a time when I used a simple "§" in my password. turned out, some Android keyboards don't have the "§". Since then I play it safe with my passwords, using only characters I don't need a specialized keyboard for
inglor_cz 6mo ago
This really reads like a modern Ancient-Greek story about inscrutable gods who suddenly decide to complicate your life for some unclear reason and don't respond to any prayers and rituals. People are afraid of AI, but human organizations can be quite opaque as well. That said, as a Czech, I wouldn't use any accentuated characters in my passwords. Anything beyond 7-bit ASCII is just asking for trouble.
- thaumasiotes 6mo ago
  > This really reads like a modern Ancient-Greek story about inscrutable gods who suddenly decide to complicate your life for some unclear reason If you read the ancient Greek stories, a consistent theme is that, if you offend the gods, they will punish you... ...but they're at least as likely to do it by cursing someone blameless who will then have an effect on you as they are by cursing you directly.
formvoltron 6mo ago
if you remove the hachek, there will be MANY locked out czech users. It's a symbol of national pride!
- 404mm 6mo ago
  I’m willing to bet a significant portion of the passwords start with the letter “p”.
  - silon42 6mo ago
    paššWord1!
thephyber 6mo ago
The side of my brain that manages organizational changes wonders: how does Apple, a 50 year old company of tens of thousands of engineers and over a trillion USD market cap, manage to keep feature velocity high while not making more of these types of errors? The bug seems low likelihood but high severity for the few affected users. Other than simply never changing the login keyboard (or any of the keyboard code) or having nearly 100% test coverage, how does a company not accidentally have more of these types of issues?
- compounding_it 6mo ago
  They do. It’s just that the people using these devices won’t go public with it. I’ve seen so many bizarre bugs in my own experience but I’ve gotten zero articles on them by popular tech journals. This bug got popularity that’s all.
- fg137 6mo ago
  They do. Companies mess things up all the time. But only a fraction of bugs get discovered and then reported, so it appears that their quality is ok. I have recently discovered several bugs in different products created by different companies. And none has been reported so far in my research despite the products' popularity. I am not surprised, since those bugs require specific combination of conditions to be triggered, which most people have never run into, like in this article. And I don't even blame them -- the engineers probably could never think of such use cases and don't have those workflows themselves. You'd have to really go out of your way to use obscure workflows to discover them. Although in this case Apple dropped the ball by locking user out and not providing any alternatives.
- lxgr 6mo ago
  > how does Apple, a 50 year old company of tens of thousands of engineers and over a trillion USD market cap, manage to keep feature velocity high while not making more of these types of errors? They don't. If you're anything other than an extremely casual user of iOS or macOS for a couple of years, you'll encounter things that really make you pull your hair out by shear magnitude of "how on Earth can anyone miss this!?". The same goes for feature velocity.
latexr 6mo ago
[dead]
icfly2 6mo ago
Majority of California based companies employee English only or English and Spanish speakers possibly with some Indian language as well. This leads to lots of problems when you are bilingual or bilingual in other languages such as German in French. Neither Apple nor Microsoft under this sort of language swapping well. Never mind rarer languages like Czech or Greek.
- msh 6mo ago
  I use danish and English and I must admit I don’t really encounter issues switching between them on apple or Microsoft operating systems. Only thing I can think of is some features being available later in danish compared to the English release like the swipe keyboard in iOS.
- projektfu 6mo ago
  I'm a little impressed with Google. Recently the assistant started understanding when I speak Portuguese or when my wife switches to it in a text message. I hadn't had that experience before, the assistants would pick one language and mispronounce the other. Alexa has an experimental bilingual mode but it's nerfed by its general failure to understand well.
  - CTDOCodebases 6mo ago
    This is a pet peeve of mine that makes it so annoying to communicate with friends and family who live in other countries.
- dzhiurgis 6mo ago
  Netflix can't even auto-translate subtitles (in the age of genai where we are close to generating entire movies from scratch). Let alone ever imagine that you'd want to see subtitles in two languages at once. Language support is still such an enigma.
  - brookman64k 6mo ago
    We run into this issue when watching Korean movies/dramas. My wife prefers Japanese subtitles and I prefer English/German. I haven’t found a way to enable two subtitles in Firefox (via extensions). So in those cases I usually download a release which contains subtitles in both languages and use a script to extract them via ffmpeg and then combine them into a single srt. Now the issue is that the lines of the different languages don’t always appear/disappear at the same time. This leads to text jumping up and down. I have tried to mitigate it by injecting white space where only one line is visible, but this again fails when the video player breaks long lines or when the location of the subs change to the top (because there is hard-coded text in the image). I feel like there must be a better way…
0x3f 6mo ago
Seems like a front-end bug? So just access the API directly, or ask someone who knows how to do that? Plenty of iOS-focused reverse engineers out there.
- mkroman 6mo ago
  How? The article states: > For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered. The user can't even enter their passcode, how do you expect them to perform code execution?
  - 0x3f 6mo ago
    Plugging in a USB keyboard is way higher level than what I'm talking about. You can contact a digital forensics firm, and they'll do it for you. It'd be custom hardware. Cellebrite-type stuff.
    - saagarjha 6mo ago
      Why would they do it for free?
      - 0x3f 6mo ago
        Why would it have to be free?
        saagarjha 6mo ago
        Do you know what the cost of breaking into a fully up to date BFU iPhone is?
        0x3f 6mo ago
        They're not breaking in; he knows the password. Also, it's not fully up-to-date; it's an iPhone 13.
nalekberov 6mo ago
"Never do a major OS update on any Apple product" - this is the mantra I am telling myself always.
ddtaylor 6mo ago
I feel bad for the guy and all the Apple users constantly sharing stories of being mistreated and abused. Stop giving these companies your money and consent. I'm basically numb to it at this point though. Every few days we read on this site small permutations of the same story. Sometimes people here get a little extra backchannel support, but that's a token prize for the jester who made a king chuckle. Then a few more days go by and everyone upvotes a new iWidget to oblivion because it has 0.1 new gigablahs or takes up a milliblah less of some bullshit nobody was asking for. All while we collectively virtue signal that people are spending too much time and relying on technology too much. Well, it's almost Monday let's see what new bullshit convinces everyone to keep getting fucked and pay for the privilege. I basically have turned into this guy: https://youtu.be/8AyVh1_vWYQ https://youtu.be/8AyVh1_vWYQ
- lapcat 6mo ago
  > I feel bad for the guy and all the Apple users constantly sharing stories of being mistreated and abused. Stop giving these companies your money and consent. Here's a challenge: walk into a store and attempt to buy a smartphone that is not iPhone or Android. This is the situation that consumers face. Some alternatives exist, but most consumers are completely unaware of them, because the alternatives have no advertising budget or retail presence. I think it's quite similar to the political duopoly. Third parties exist, but they have no advertising budget, and moreover, in a Catch-22 situation, they get little or no news coverage, precisely because they have no advertising budget, and thus the news media considers them "not viable." That's a self-fulfilling prophesy. Actually the same situation exists in tech: Apple and Google get huge amounts of free news coverage in addition to their paid advertising. The media appears to feel no obligation to help people escape from duopolies; guess who pays for their advertising...
  - ddtaylor 6mo ago
    Yes, the phone market is bad. But, you know you don't have to do everything in a phone, right? Want to take pictures? Use a camera. If it somehow auto updates your photos are still on an SD card. I get convenience has led everyone to expect their phone to do everything for them, but it's not working. When you're in a pinch you will go to a 7-Eleven and grab food, but everyone would agree that buying everything there instead of real groceries is a terrible strategy. Just because something is convenient doesn't mean it's good.
cromka 6mo ago
This is why DIY is important: it's an operational risk mitigation measure.
josefrichter 6mo ago
Since the beginning, iPhone keyboard is wrong in entering a character first, háček second. It has been the other way around on typewriters and then computers for decades. Then some smart guy at apple thought he knows better. One of those never-fixed-bugs.
- lxgr 6mo ago
  Wait, really? I thought "dead keys" being diacritics prefixes, not suffixes, was pretty universal. At least that's how it works with ^, ´, and ` on macOS for me.
- toast0 6mo ago
  > It has been the other way around on typewriters and then computers for decades. On a typewriter, I would expect one to type the latin character, hit backspace, and then add the mark? Or if using a typewriter without the necessary mark, just type the latin characters, then add the marks with a pen to the full sheet.
  - gardenerik 6mo ago
    Diacritics usually did not advance paper on typewriters, hence their name "dead keys". [0] https://en.wikipedia.org/wiki/Dead_key https://en.wikipedia.org/wiki/Dead_key
s0ulf3re 6mo ago
Just one more good reason to be doing unit tests
commandersaki 6mo ago
This really should be escalated to the point where Apple engineers build a one-off / custom iOS so that this person can unlock their phone and change their passcode. I'm sure this is in the realm of possibilities. It is such a bad look.
- rincebrain 6mo ago
  That seems very unlikely if only because Apple probably has the equivalent of big flashing nuclear stockpile grade warning signs internally around anything that involves the phrase "one off firmware release", since they have every interest in convincing any nation-state or anyone else that it would be quite difficult and something they have no interest in to do if they ever try to compel them to make one.
medvidek 6mo ago
Tangentially related, a relative bought a new Apple laptop a few weeks ago, and I was tasked with setting it up. The computer came pre-equipped with a Czech keyboard (apparently the US models weren't in stock and that relative needed a new computer as soon as possible, so they bought a Czech one). Since the user doesn't speak Czech, I promptly removed the Czech layout and installed two other layouts, US English and Hebrew, for the languages that the relative uses to type on the computer. For some reason, login screen just after boot still uses Czech layout, which means Z and Y are swapped and numbers must be typed with Shift (just pressing numbers outputs Czech letters like ěščř). So when booting up the machine (remember that you can't use fingerprint during first unlock), the user must type the password in whatever layout is physically printed on the keys, even though the rest of the OS doesn't even have a mention of that layout. Somehow afterwards the OS "can" see the list of the layouts and lock screen correctly chooses the English US layout. Alongside of that, for some reason, the key that's supposed to type ` and ~ in the US layout types some nonsense instead (a plus-minus sign and a section sign), whereas the backtick key is for some reason located between left Shift and Z (good luck unlearning years of muscle memory typing ~/Documents in the terminal)
- rincebrain 6mo ago
  This feels like it's probably a stupid oversight chain like, keyboard layouts are user-specific data, so they're not decrypted before first unlock/set globally because the machine might have multiple users with different keyboard layouts.
  - medvidek 6mo ago
    Even if it is, why is there no way to change the system-wide settings? All other operating systems that I know either have an explicit button "Apply settings to login screen" or do it automatically (I'm sure 99% of the consumer-level computers sold worldwide never have more than one user on them, moreso with different keyboard layouts).
    - rincebrain 6mo ago
      Evidently you can, though in traditional macOS fashion, you exploit Apple secretly changing the setting for you if you do a magic dance.[1][2] I've never had a reason to try it, but there's also a remark that 99% of the Macs sold probably don't need to change the system-wide keyboard layout defaults, either... [1] - https://heylon.ca/how-to-permanently-switch-default-keyboard-at-login-for-macos/ https://heylon.ca/how-to-permanently-switch-default-keyboard... [2] - https://support.apple.com/guide/mac-help/change-the-system-language-mh26684/mac https://support.apple.com/guide/mac-help/change-the-system-l...
mckeed 6mo ago
Someone on twitter had the idea that he could use the camera to take a picture of the character (or his whole password) and copy/paste it using the built-in ocr feature. I don't have a text password on my iphone so I don't know whether you can paste into that field.
- rincebrain 6mo ago
  The article mentions that he tried that and it scans as a different character.
cjbarber 6mo ago
Surprised that no one commented on the clever title!
- sph 6mo ago
  I had to read it 15 times to understand what it was trying to say. There is such a thing as trying too hard at being clever.
mdavid626 6mo ago
I wonder were are the software engineers. No senior devs at Apple anymore? Just interns pushing to prod without any review? What the hell is going on in the software industry? Such mistakes a trillion dollar company can not allow to happen.
felishiagreen12 6mo ago
[dead]

337 points by OuterVale 6mo ago

I lost all of my photos when I was a college student too. I was way too irresponsible to actually back anything up. Kind of a bitter lesson.

lilytweed 6mo ago

It’s an annoying workaround, but could he connect a USB keyboard (via a USB to lightning adapter) with the ability to enter the character? Does the passcode screen accept input from attached keyboards?

sheept 6mo ago
As mentioned in the article, > For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered.
deleted 6mo ago
[deleted]
Deadsunrise 6mo ago
It's mentioned in the article. USB devices are blocked until the passcode has been entered.
Myzel394 6mo ago
Why can't people read stuff before commenting?
- BobBagwill 6mo ago
  Today's free verse: Why can't people read stuff before commenting? Why can't people read stuff before? Why can't people read stuff? Why can't people read? Why can't people? Why can't? Why? ?
- HauntingPin 6mo ago
  I wish we could just have comments removed where it's clear the author didn't even put in the minimum effort of reading the article. It's disrespectful to the rest of us.
- j16sdiz 6mo ago
  Why can't people read the HN guideline before commenting? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html > Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that".

deleted 6mo ago

[deleted]

userbinator 6mo ago

after Apple removed a character from its Czech keyboard I wonder what the thought process (or perhaps lack thereof) at Apple was. Did no one of the likely-somewhat-large team who did that think "wait, this could lock out our users who may have used that character"? In the immortal words of Linus Torvalds: "WE DO NOT BREAK USERSPACE!" Now one of the ways in might be those companies who claim to be able to break iPhone security for law enforcement and the like, but I'm not sure if they'd be willing to do it (at any price) unless you could somehow trick them into thinking you had some "interesting" data on there...

shawnta 6mo ago
[flagged]
- Matl 6mo ago
  I agree with you and don't really get what Apple gets from removing a valid Czech character, but how would you test if all existing passcodes remain inputable without knowing the passcodes of all iPhone users? The one way to do this that I could see is to include both the new keyboard and the old one and if someone fails to unlock with the new one auto report that to Apple (not the code, just that the unlock failed and that the keyboard might be the problem), then auto revert to the old keyboard on the next unlock attempt...
  - brainwad 6mo ago
    You assume the worst case: every character that could ever have been entered is in use.
    - sheiyei 6mo ago
      Yes, it really is that simple. They chose that responsibility the moment they allowed those characters. Any deductions done after that need to have a failsafe with the expectation they will break a clueless user's device.
  - 6mo ago

eab- 6mo ago

I used to have an emoji password for my Android phone, and had the exact same issue after a reset! It's an odd but pretty terrible failure mode for locking oneself out...

terribleperson 6mo ago
You say locking oneself out, but I decline to consider any situation where a password can be set but not later entered as one where the user bears even a modicum of fault.
- ddtaylor 6mo ago
  We're so far down this path the language around the problem is distorted. Ownership has been perverted and the only thing you control is the bill.
  - terribleperson 6mo ago
    Do we even control the bill? You could buy a annual-sub-paid-monthly, be unable to cancel it because you're locked out of your account, and then get taken to collections when you terminate it on the payment side.
- Gander5739 6mo ago
  Relevant xkcd: https://xkcd.com/2700/ https://xkcd.com/2700/
- medvidek 6mo ago
  I remember a website that silently removed everything but the first 8 characters from the "password" field upon registration but somehow didn't do the same on the login page. It took me several hours and several password resets to actually log in after registration, since for some reason the trimming happened client-side and only when typing the password manually (and I was pasting my password from a password manager).
  - 6mo ago

jychang 6mo ago

This is completely unacceptable from Apple. You CANNOT remove a key from the keyboard that's being used as a password.

type0 6mo ago
as if they cared
halapro 6mo ago
Turns out they CAN and they WILL. The character has always been special on all Apple OSes.

nasretdinov 6mo ago

As a non-English speaker I can really relate to this. I think the real mistake was Apple allowing to enter a non-ASCII password in the first place. E.g. on macOS the password fields have been locked to English character set, and I'm not sure why it changed on iOS.

userbinator 6mo ago
The "real mistake" is changing things that used to work.
- halapro 6mo ago
  You can use emojis as passwords, do you think that's a good idea? They work now, there's a good chance that they won't be the same forever. See what happened to the family emojis
  - Y-bar 6mo ago
    Did the underlying bits (hex/oct/… or whatever representation) actually change or just the visuals?
    - halapro 6mo ago
      There's no way to enter the emoji "male adult female adult male child female child" but only "two adults two children". So it's kind of both. It's like they realized that emojis really shouldn't need to deal with color and gender.
  - thephyber 6mo ago
    Passwords are more secure if they are higher entropy, so it makes sense to support a larger variety of characters, Czech or emoji. It seems paramount that the OS should not allow password input of any characters which it theater takes away. At the very minimum if this is absolutely necessary to make this breaking change, the user should be warned several times that a character in the password is no longer valid and maybe even prevent the OS from upgrading before the password is changed to a forward-compatible one.

lousken 6mo ago

Apple should get sued for this to oblivion, this is unacceptable.

dismalaf 6mo ago
EU citizens have specific avenues to complain and get compensation for stuff like this so hopefully the user in question uses it.

N19PEDL2 6mo ago

> Byrne was hoping that the next update, 26.4.1, would introduce a fix for this, but its release this week has not helped. Even if Apple restores the háček in a future update, wouldn't he still need to unlock the iPhone to install it?

bpavuk 6mo ago
afaik you can update your locked iPhone with a Mac or Windows in iTunes... but it will still require a passcode after update, so ¯\_(ツ)_/¯
- nikanj 6mo ago
  Nope, the ”trust this computer” dialog needs you to enter your passcode before any other actions are possible
  - cedws 6mo ago
    Probably the only hope is jailbreaking.
    - cachius 6mo ago
      Jailbreaking is dead.
    - sheiyei 6mo ago
      Jailbreaking a locked, inaccessible iphone?
      - userbinator 6mo ago
        Keep in mind that everyone else is usually unaware (by design) of what all the intelligence agencies can do, but I doubt they would help in this scenario even if they could. On the other hand, if this happens to a far more important person...
  - yangm97 6mo ago

freehorse 6mo ago

> During in-house testing, which involved taking an iPhone 16 from iOS 18.5 to iOS 26.4.1, The Register found that Apple has kept the háček in the Czech keyboard, but removed the ability to use it in a custom alphanumeric passcode. The OS will not allow users to input the háček as a character. The key's animation triggers, as does the keyboard's key-tap sound, but the character is not entered into the string. Sounds more like an actual bug than a decision to change the keyboard layout, if this happens only in the passcode screen?

ape4 6mo ago
Good on El Reg for doing some actual hands on fact finding.
trymas 6mo ago
I remember something like 10 years ago there was an article here in HN, where someone created a user on macOS with password out of emojis. Then he couldn’t login, because login screen does not have a special character keyboard. EDIT: found it https://news.ycombinator.com/item?id=10742351 https://news.ycombinator.com/item?id=10742351 (apparently I remember it slightly wrong, but idea still the same)

_the_inflator 6mo ago

Well I only use alphanumeric US keyboard standards ever since I found out, that certain characters unique to a language different from yours causes you lock out or massive headaches on a used keyboard with almost no print ink left on the keyboard in a Internet cafe in an other country around 2002. Be aware of characters not passwords. I feel bad for the guy but not really blame Apple here. English is my second language and ANSI etc is following a basic character usage. Everything must boil down to 0 and 1 in the end or American English. It is a de facto standard and maybe knowing about it is as crucial as recognizing the difference between the imperial and metric system before heading for the moon. It is a life saver.

tsimionescu 6mo ago
I agree with the recommendation, but it's absurd to not blame Apple here. There is absolutely nothing acceptable about what Apple did in this case, it's a major fuck-up to break password input in this way, and for no reason whatsoever.

PufPufPuf 6mo ago

I think the biggest lesson here is to back up. The reason for losing access to the phone is amazingly dumb but it could have fallen down the stairs for basically the same effect. And do your could backups cross-provider. You never know what the "big players" are going to pull, and your lifetime customer value is less than the cost of a single support call.

anal_reactor 6mo ago
This is exactly the reason why I keep all my shit on an SD card despite Google deliberately making the external storage experience as painful as possible: slow access, broken writes, failed unmounts, no filesystem repair. Literally every time I restart my phone I need to put the card to my PC and repair the filesystem. Also, same card works extremely well when plugged into PC via random cheap USB card reader. On PCs you still have Linux that resists enshittification and you can pick your own hardware, but it's a really sad state of affairs that there is literally no meaningful mobile system that isn't actively hostile to the user.
- yangm97 6mo ago
  There’s a number of mobile Linux distributions around, some even run Android apps. People need to wake up to the fact that Android has become iOS but worse.
- CTDOCodebases 6mo ago
  The thing that bothers me about Android is the gimped file manager. You wan't to access some files off your network using smb? Here install this third party tool and don't forget to give it full read/write access to your device.
- nirava 6mo ago
  I just have a cheap second hand PC with a couple of good drives running LAN only Immich and a few other backup tools. This, in parallel to cloud backup, makes the setup both mobile and reasonably fault tolerant. I'm quite wary of using SD card for backup. Too easy for me to lose.
- 6mo ago

donatj 6mo ago

I assume you can use a physical keyboard on an iPhone like I can on Android via USB? Presumably you could buy a wired Czech keyboard to access the device? Twice I have had the touchscreen fail on Android devices and been able to get what I needed off them using a USB mouse.

GrayShade 6mo ago
You can, after you unlock it.
- m463 6mo ago
  I was guessing this - need to unlock to use USB devices. sigh.
tmjwid 6mo ago
For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered. Makes sense why he didn't do this.

PlunderBunny 6mo ago

Even if he did have a Mac with the continuity feature enabled, I suppose the lock-screen won’t accept a paste from the clipboard of a Mac. (If it did, he could enter the correct passcode in any text editor on his Mac, copy it to the clipboard on the Mac, then paste it into the lock-screen on his iPhone)

Shank 6mo ago
Continuity has never worked on the lock screen and certainly not in the BFU state.

wolfi1 6mo ago

there was a time when I used a simple "§" in my password. turned out, some Android keyboards don't have the "§". Since then I play it safe with my passwords, using only characters I don't need a specialized keyboard for

inglor_cz 6mo ago

This really reads like a modern Ancient-Greek story about inscrutable gods who suddenly decide to complicate your life for some unclear reason and don't respond to any prayers and rituals. People are afraid of AI, but human organizations can be quite opaque as well. That said, as a Czech, I wouldn't use any accentuated characters in my passwords. Anything beyond 7-bit ASCII is just asking for trouble.

thaumasiotes 6mo ago
> This really reads like a modern Ancient-Greek story about inscrutable gods who suddenly decide to complicate your life for some unclear reason If you read the ancient Greek stories, a consistent theme is that, if you offend the gods, they will punish you... ...but they're at least as likely to do it by cursing someone blameless who will then have an effect on you as they are by cursing you directly.

formvoltron 6mo ago

if you remove the hachek, there will be MANY locked out czech users. It's a symbol of national pride!

404mm 6mo ago
I’m willing to bet a significant portion of the passwords start with the letter “p”.
- silon42 6mo ago
  paššWord1!

thephyber 6mo ago

The side of my brain that manages organizational changes wonders: how does Apple, a 50 year old company of tens of thousands of engineers and over a trillion USD market cap, manage to keep feature velocity high while not making more of these types of errors? The bug seems low likelihood but high severity for the few affected users. Other than simply never changing the login keyboard (or any of the keyboard code) or having nearly 100% test coverage, how does a company not accidentally have more of these types of issues?

compounding_it 6mo ago
They do. It’s just that the people using these devices won’t go public with it. I’ve seen so many bizarre bugs in my own experience but I’ve gotten zero articles on them by popular tech journals. This bug got popularity that’s all.
fg137 6mo ago
They do. Companies mess things up all the time. But only a fraction of bugs get discovered and then reported, so it appears that their quality is ok. I have recently discovered several bugs in different products created by different companies. And none has been reported so far in my research despite the products' popularity. I am not surprised, since those bugs require specific combination of conditions to be triggered, which most people have never run into, like in this article. And I don't even blame them -- the engineers probably could never think of such use cases and don't have those workflows themselves. You'd have to really go out of your way to use obscure workflows to discover them. Although in this case Apple dropped the ball by locking user out and not providing any alternatives.
lxgr 6mo ago
> how does Apple, a 50 year old company of tens of thousands of engineers and over a trillion USD market cap, manage to keep feature velocity high while not making more of these types of errors? They don't. If you're anything other than an extremely casual user of iOS or macOS for a couple of years, you'll encounter things that really make you pull your hair out by shear magnitude of "how on Earth can anyone miss this!?". The same goes for feature velocity.

latexr 6mo ago

[dead]

icfly2 6mo ago

Majority of California based companies employee English only or English and Spanish speakers possibly with some Indian language as well. This leads to lots of problems when you are bilingual or bilingual in other languages such as German in French. Neither Apple nor Microsoft under this sort of language swapping well. Never mind rarer languages like Czech or Greek.

msh 6mo ago
I use danish and English and I must admit I don’t really encounter issues switching between them on apple or Microsoft operating systems. Only thing I can think of is some features being available later in danish compared to the English release like the swipe keyboard in iOS.
projektfu 6mo ago
I'm a little impressed with Google. Recently the assistant started understanding when I speak Portuguese or when my wife switches to it in a text message. I hadn't had that experience before, the assistants would pick one language and mispronounce the other. Alexa has an experimental bilingual mode but it's nerfed by its general failure to understand well.
- CTDOCodebases 6mo ago
  This is a pet peeve of mine that makes it so annoying to communicate with friends and family who live in other countries.
dzhiurgis 6mo ago
Netflix can't even auto-translate subtitles (in the age of genai where we are close to generating entire movies from scratch). Let alone ever imagine that you'd want to see subtitles in two languages at once. Language support is still such an enigma.
- brookman64k 6mo ago
  We run into this issue when watching Korean movies/dramas. My wife prefers Japanese subtitles and I prefer English/German. I haven’t found a way to enable two subtitles in Firefox (via extensions). So in those cases I usually download a release which contains subtitles in both languages and use a script to extract them via ffmpeg and then combine them into a single srt. Now the issue is that the lines of the different languages don’t always appear/disappear at the same time. This leads to text jumping up and down. I have tried to mitigate it by injecting white space where only one line is visible, but this again fails when the video player breaks long lines or when the location of the subs change to the top (because there is hard-coded text in the image). I feel like there must be a better way…

0x3f 6mo ago

Seems like a front-end bug? So just access the API directly, or ask someone who knows how to do that? Plenty of iOS-focused reverse engineers out there.

mkroman 6mo ago
How? The article states: > For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered. The user can't even enter their passcode, how do you expect them to perform code execution?
- 0x3f 6mo ago
  Plugging in a USB keyboard is way higher level than what I'm talking about. You can contact a digital forensics firm, and they'll do it for you. It'd be custom hardware. Cellebrite-type stuff.
  - saagarjha 6mo ago
    Why would they do it for free?
    - 0x3f 6mo ago
      Why would it have to be free?
      - saagarjha 6mo ago
        Do you know what the cost of breaking into a fully up to date BFU iPhone is?
        0x3f 6mo ago
        They're not breaking in; he knows the password. Also, it's not fully up-to-date; it's an iPhone 13.

nalekberov 6mo ago

"Never do a major OS update on any Apple product" - this is the mantra I am telling myself always.

ddtaylor 6mo ago

I feel bad for the guy and all the Apple users constantly sharing stories of being mistreated and abused. Stop giving these companies your money and consent. I'm basically numb to it at this point though. Every few days we read on this site small permutations of the same story. Sometimes people here get a little extra backchannel support, but that's a token prize for the jester who made a king chuckle. Then a few more days go by and everyone upvotes a new iWidget to oblivion because it has 0.1 new gigablahs or takes up a milliblah less of some bullshit nobody was asking for. All while we collectively virtue signal that people are spending too much time and relying on technology too much. Well, it's almost Monday let's see what new bullshit convinces everyone to keep getting fucked and pay for the privilege. I basically have turned into this guy: https://youtu.be/8AyVh1_vWYQ https://youtu.be/8AyVh1_vWYQ

lapcat 6mo ago
> I feel bad for the guy and all the Apple users constantly sharing stories of being mistreated and abused. Stop giving these companies your money and consent. Here's a challenge: walk into a store and attempt to buy a smartphone that is not iPhone or Android. This is the situation that consumers face. Some alternatives exist, but most consumers are completely unaware of them, because the alternatives have no advertising budget or retail presence. I think it's quite similar to the political duopoly. Third parties exist, but they have no advertising budget, and moreover, in a Catch-22 situation, they get little or no news coverage, precisely because they have no advertising budget, and thus the news media considers them "not viable." That's a self-fulfilling prophesy. Actually the same situation exists in tech: Apple and Google get huge amounts of free news coverage in addition to their paid advertising. The media appears to feel no obligation to help people escape from duopolies; guess who pays for their advertising...
- ddtaylor 6mo ago
  Yes, the phone market is bad. But, you know you don't have to do everything in a phone, right? Want to take pictures? Use a camera. If it somehow auto updates your photos are still on an SD card. I get convenience has led everyone to expect their phone to do everything for them, but it's not working. When you're in a pinch you will go to a 7-Eleven and grab food, but everyone would agree that buying everything there instead of real groceries is a terrible strategy. Just because something is convenient doesn't mean it's good.

cromka 6mo ago

This is why DIY is important: it's an operational risk mitigation measure.

josefrichter 6mo ago

Since the beginning, iPhone keyboard is wrong in entering a character first, háček second. It has been the other way around on typewriters and then computers for decades. Then some smart guy at apple thought he knows better. One of those never-fixed-bugs.

lxgr 6mo ago
Wait, really? I thought "dead keys" being diacritics prefixes, not suffixes, was pretty universal. At least that's how it works with ^, ´, and ` on macOS for me.
toast0 6mo ago
> It has been the other way around on typewriters and then computers for decades. On a typewriter, I would expect one to type the latin character, hit backspace, and then add the mark? Or if using a typewriter without the necessary mark, just type the latin characters, then add the marks with a pen to the full sheet.
- gardenerik 6mo ago
  Diacritics usually did not advance paper on typewriters, hence their name "dead keys". [0] https://en.wikipedia.org/wiki/Dead_key https://en.wikipedia.org/wiki/Dead_key

s0ulf3re 6mo ago

Just one more good reason to be doing unit tests

commandersaki 6mo ago

This really should be escalated to the point where Apple engineers build a one-off / custom iOS so that this person can unlock their phone and change their passcode. I'm sure this is in the realm of possibilities. It is such a bad look.

rincebrain 6mo ago
That seems very unlikely if only because Apple probably has the equivalent of big flashing nuclear stockpile grade warning signs internally around anything that involves the phrase "one off firmware release", since they have every interest in convincing any nation-state or anyone else that it would be quite difficult and something they have no interest in to do if they ever try to compel them to make one.

medvidek 6mo ago

Tangentially related, a relative bought a new Apple laptop a few weeks ago, and I was tasked with setting it up. The computer came pre-equipped with a Czech keyboard (apparently the US models weren't in stock and that relative needed a new computer as soon as possible, so they bought a Czech one). Since the user doesn't speak Czech, I promptly removed the Czech layout and installed two other layouts, US English and Hebrew, for the languages that the relative uses to type on the computer. For some reason, login screen just after boot still uses Czech layout, which means Z and Y are swapped and numbers must be typed with Shift (just pressing numbers outputs Czech letters like ěščř). So when booting up the machine (remember that you can't use fingerprint during first unlock), the user must type the password in whatever layout is physically printed on the keys, even though the rest of the OS doesn't even have a mention of that layout. Somehow afterwards the OS "can" see the list of the layouts and lock screen correctly chooses the English US layout. Alongside of that, for some reason, the key that's supposed to type ` and ~ in the US layout types some nonsense instead (a plus-minus sign and a section sign), whereas the backtick key is for some reason located between left Shift and Z (good luck unlearning years of muscle memory typing ~/Documents in the terminal)

rincebrain 6mo ago
This feels like it's probably a stupid oversight chain like, keyboard layouts are user-specific data, so they're not decrypted before first unlock/set globally because the machine might have multiple users with different keyboard layouts.
- medvidek 6mo ago
  Even if it is, why is there no way to change the system-wide settings? All other operating systems that I know either have an explicit button "Apply settings to login screen" or do it automatically (I'm sure 99% of the consumer-level computers sold worldwide never have more than one user on them, moreso with different keyboard layouts).
  - rincebrain 6mo ago
    Evidently you can, though in traditional macOS fashion, you exploit Apple secretly changing the setting for you if you do a magic dance.[1][2] I've never had a reason to try it, but there's also a remark that 99% of the Macs sold probably don't need to change the system-wide keyboard layout defaults, either... [1] - https://heylon.ca/how-to-permanently-switch-default-keyboard-at-login-for-macos/ https://heylon.ca/how-to-permanently-switch-default-keyboard... [2] - https://support.apple.com/guide/mac-help/change-the-system-language-mh26684/mac https://support.apple.com/guide/mac-help/change-the-system-l...

mckeed 6mo ago

Someone on twitter had the idea that he could use the camera to take a picture of the character (or his whole password) and copy/paste it using the built-in ocr feature. I don't have a text password on my iphone so I don't know whether you can paste into that field.

rincebrain 6mo ago
The article mentions that he tried that and it scans as a different character.

cjbarber 6mo ago

Surprised that no one commented on the clever title!

sph 6mo ago
I had to read it 15 times to understand what it was trying to say. There is such a thing as trying too hard at being clever.

mdavid626 6mo ago

I wonder were are the software engineers. No senior devs at Apple anymore? Just interns pushing to prod without any review? What the hell is going on in the software industry? Such mistakes a trillion dollar company can not allow to happen.

felishiagreen12 6mo ago

[dead]