Apple update looks like Czech mate for locked-out iPhone user

A university student in the US is in data limbo after Apple removed a character from its Czech keyboard, preventing him from entering his iPhone passcode. Connor Byrne, 21, adopts the uncommon but security-minded approach to iPhone passcodes, using an alphanumeric string instead of the standard four-number passcode. He …

[Mike 125]

Apple. It's where convenience trumps agency. It batters it around the head, and finishes it off with a jackboot stamp.

[IGotOut]

Don't want to victim blame...

...but what would've happened if his phone had just died, got lost or stolen?

iCloud storage is free up to a point then so f'ing cheap it's hardly noticeable.

It absolutely sucks that this has happened, but if his phone is that knackered, I'd be thinking that I need to save my pictures regardless.

[blu3b3rry]

Re: Don't want to victim blame...

Doesn't matter what the device is, 1-2-3 backup strategies are always a good idea. My phone backs up to a Proton cloud storage drive once a day, and I tend to back it up to my PC every so often.

PC itself is also backed up to the Proton drive including an encrypted HDD in my desk drawer at work (although I'm not disciplined enough to remember to do it often)

[Esso]

Re: Don't want to victim blame...

"They're the main data that I care about and haven't backed up."

No, and Yes. If the first part was Yes, then the second part would likely have been No.

[Anonymous Coward]

Cloud storage

"iCloud storage is free up to a point then so f'ing cheap it's hardly noticeable."

Until it becomes very noticeable when $cloudprovider fucks up or changes their T&Cs or goes bust or....

All of your data are belong to us.

[tip pc]

Re: Cloud storage

Until it becomes very noticeable when $cloudprovider fucks up or changes their T&Cs or goes bust or....

yes but in the interim this guy woudl have access to his data,

All of your data are belong to us.

its 2026, i'd assume anything captured electronically is already known about by the relevant authorities, it'd be naive to assume they don't have access to it if you have access to it especially if you have remote access to it or even some of it.

if you have the free icloud tier then your photos captured today are uploaded to the cloud & iphoto on your mac can download it & back it up for you without needing TB's of icloud storage available.

once its been in the cloud its safe to assume some entity has a backup that you can't access!

[Bebu sa Ware]

Case of acute cleveritis ?

Stick with the 7 bit ASCII subset you will never go wrong. Apple is unlikely to remove the 'A' character. ;)

The "Principle of Least Surprise" when dealing with computers (and people) is usually the best policy - you don't want to over·tax the limited capacities of either.

Why cell phone users don't back up their prized photos - they don't - is beyond me. I can understand why you might not backup an iphone to iCloud etc but emailing etc your valued snaps to yourself is simple enough and restricts what is backed up. Personally I never had much time for photographs and with the advent of digital photography pretty much a Douglas Adams' Electric Monk^† for remembering places and events for you as I guess AI is one for thinking for you.

I wasn't going update my SE (~2017) from 18 in any case; doubly so now.

_{† I think the Electric Monk was Adams' extrapolation of the then current VCR which watched TV for you; the Electric Monk believed things for you.}

[Anonymous Coward]

Re: 7 bit ASCII

sorry but the era of 7 bit ASCII has long gone.

Perhaps in your part of the Trumpistan World, where US English is the only language allowed it might work but Apple (and the Android makers) are in the business of making a device for sale around the world. I'd wager that most of Gen-Z don't have a clue what 7 bit ASCII means.

[PB90210]

Re: 7 bit ASCII

Cisco router CLI is 7-bit ASCII. Took me a while to explain to a colleague that he could use £ in a network password because the router could never accept it ("but that's what the [server] uses")

Cisco also have the nasty habit of accepting trailing spaces on the end of passwords... great fun if you've just finished pasting in a config and find you can't get back in!

In the wider world, I've also created a login for a site but found I couldn't use it because I had used a 'special character' in the password that was valid during the creation process but invalid at login

[Neil Barnes]

Re: 7 bit ASCII

It's even more fun where you have a keyboard locale that has shifted number characters (e.g. French) which are not recognised until the OS wakes up and does the translation. It's bitten me a few times that a BIOS password has used characters which are only available by touch-typing a US-104 keyboard, not looking at what's on the keys... (also sometimes applies to UK keyboards with the proper locations for keys!)

[Potty Professor]

Re: 7 bit ASCII

The WiFi password on my BT router contained spaces as the special character, but when they dumped me onto EE, the new EE router wouldn't accept spaces as a special character, so I had to replace them with underline characters, and then had to go round every device I or my family have to reset their passwords. A complete faff and so unnecessary.

[Mishak]

Re: 7 bit ASCII

I've has similar with devices not accepting ~

[molletts]

Re: 7 bit ASCII

Similar for me with a Netgear small-business WiFi AP at my parents' place. The long passphrase used on the router (which serves one end of the house) and thus on the AP (serving the other end) and all the devices used spaces as its "special character". A firmware update that got automatically installed on the AP changed the rules and no longer accepts space as a special character. Instead of grandfathering it in and maybe requiring a change at the next login, it silently reset the password for the SSID to "password" (or maybe it was "admin" or "netgear", I can't remember now), which doesn't meet either the length or complexity requirements but is allowed regardless.

I only discovered it when I visited and found that I had no working WiFi in my bedroom. Apparently, the TV had been doing a lot of buffering for some weeks (pulling a faint signal from the router at about 1-2Mbps) so it had probably been like it for a while.

[Twilight]

Re: 7 bit ASCII

I just hit this recently with the old DDO and LotRO MMOs. The account site lets you create passwords that can't be entered in the game launcher.

[Anonymous Coward]

Re: valid during the creation process but invalid at login

It took me and the bank a few tries to realize why I kept having trouble logging in after a forced password change. I make my important passwords fairly long now days. So for banks accounts and such, I want at least 16 characters in my password. I use a password safe so no problems remembering it.

So each time I wanted to sign in, I'd have to use the "I forgot may password" routine. And then I would create a new proper long password before I signed out. And that wouldn't work the next time I signed in weeks/months later.

Well it turned out the bank's web page password change code would happily accept my long password, but to sign in, the password was limited to something shorter, more like 12 characters. So my long password wouldn't work. And of course you can't have an error message saying it's too long as that would help hackers.

[Martin-R]

Re: valid during the creation process but invalid at login

Metrobank per chance? Had exact same problem with them :-(

[Anonymous Coward]

Re: valid during the creation process but invalid at login

NatWest - had the same problem. After a very very long time, months and months, they diagnosed the problem. "Oh you have two entries under your email address, that shouldn't happen oops, lets delete one" - every time I did a forgot password reset and then logged in apparently it reset one of the entries, but then next time used the other one to log in....

[Anonymous Coward]

Re: 7 bit ASCII

A system that we use cannot accept trailing spaces in certain fields. This causes problems when you have a word which is on the predicted text line of an iPad for example. Clicking on the word automatically adds a space at the end. That has and does still catch quite a few people out.

[R Soul]

Re: 7 bit ASCII

"I'd wager that most of Gen-Z don't have a clue what 7 bit ASCII means."

And this Grumpy Old Fart says fuck 'em.

[ergethrtj6]

Re: 7 bit ASCII

can you explain the threat model here: dude needs a long and complex password to protect his broke-ass phone that he cant be bothered to backup

if he'd been a bit smarter he'd have an at-most 8 digit pin with max 10 retries and an encrypted backup (or 3)

but no, he is bleating at apple instead of owning his fkups

[Casca]

Re: 7 bit ASCII

How would you like it if apple removes the e character?

[Anonymous Coward]

Re: 7 bit ASCII

H would crtainly b misrable :)

[Benny Cemoli]

Re: 7 bit ASCII

If he'd been smarter he'd have actually backed-up his photos from his broke-ass phone before he updated iOS eight freaking major versions (from iOS 18 to iOS 26.4). That kind of thing is only asking for trouble, that's for sure. And if you don't take proper precautions then any problems are your own fault. But no, he's bleating at Apple instead of owning up to his own fkups.

[Simon Harris]

Re: 7 bit ASCII

iOS18 to 26 is only one major version change. They changed the numbering system from incremental to year-based after 18.

[Phil O'Sophical]

Re: 7 bit ASCII

7-bit ASCII is tautological. ASCII is a 7-bit code by definition, to ensure reliable information interchange.

[MrZoolook]

Re: 7 bit ASCII

"Perhaps in your part of the Trumpistan World, where US English is the only language allowed"

Such as..?

[Anonymous Coward]

Re: 7 bit ASCII

sorry but the era of 7 bit ASCII has long gone

Really?

Look at the message source of any email with attachment or images in it. Still 7 bit, even after all those decades..

[FrogsAndChips]

Re: 7 bit ASCII

Really?

SMTP servers and clients have accepted 8-bit without alteration for decades.

[Anonymous Coward]

Re: 7 bit ASCII

... and allowing 8-bit characters in your SMTP data segment is still a fairly reliable way to lose mail when some intermediate "security" appliance monkeys with commands, encoding, and $dog only knows what all else.

Standards. The big players have heard of them....

[FrogsAndChips]

Re: 7 bit ASCII

Lose mail? At worst the 8th bit will be truncated or it will be interpreted in a different charset than the one you intended, or the character will be replaced by a question mark.

There may not be a standard for 8-bit SMTP, but the W3C defined long ago ways to transmit non-ASCII in emails, and for everyday use it just works.

[Anonymous Coward]

Re: 7 bit ASCII

You haven't tried this, have you? Accepting <> processing with any degree of success.

I've been working on email since FidoNet was a thing, including fun things like email conversions.

[FrogsAndChips]

Re: 7 bit ASCII

As a matter of fact yes, I have used it for a long time, and with 99.99% success.

I'm old enough to remember when email clients wouldn't specify the correct headers when sending 8-bit or wouldn't interpret them correctly, which could give funny results. Today it's hassle-free.

[Anonymous Coward]

Re: Case of acute cleveritis ?

I wasn't going update my SE (~2017) from 18 in any case; doubly so now.

How have you managed to put iOS 18 on a 1st gen SE when updates for that device stopped at iOS 15?

Are you sure you're not using a 2nd gen unit from 2020?

[Anonymous Coward]

Re: Case of acute cleveritis ?

@Bebu_sa_Ware

Agree about backups! But there's another ALMOST ALWAYS missing step!

How many users TEST THEIR BACKUP to see that it will ACTUALLY RESTORE?

Once upon a time, when replacing an AS/400, I found that ALL THE BACKUP TAPES were corrupt!

No restore tests ever done!

[Anonymous Coward]

Re: Case of acute cleveritis ?

I once discovered a 'backup script' that would rewind the tape, and then overwrite the backup. Apparently rotating tapes was too much effort.

[Christopher Lane]

Re: Case of acute cleveritis ?

Ditto on a S/36. I travelled all the way to Birmingham to install a new voice coil and this didn't resolve the issue. Got the backup tapes from "the lady in accounts" who had dilligently backed up their accounts system for many, many years. Tapes were blank; nada; diddly squat! The biggest kicker? They need one last data transfer before turning off the system for ever more a few days later! Their entire data set had to be rebuilt from all the day end, month end, quarter end and year end print outs she had (also) idlligently printed out and stored "just in case"!

[redpola]

Re: Case of acute cleveritis ?

True story:

I once worked for a large international IT company. We moved into a bigger office, and had to fit out the new premises such that they were suitable for our needs. We installed fast Ethernet everywhere, WiFi, a keycard entry system, a server room, etc. Unfortunately there was an anomaly with the shape of the server room, so there was no space for the roughly-1m-cube UPS that would keep everything running if our main power went down.

So it was installed in a corner of the office, and THEN WALLS WERE BUILT AROUND IT.

That’s right. No access/maintenance door, because that wouldn’t fit in with the aesthetic of the smooth cream walls of the office that surrounded it. The two plasterboard walls that were built to house it were painted and, for all I know, had art hung on them.

Maybe a year on, our power went out. Really out. It was winter and dark and we just had a few emergency lights that stayed on. Not one computer in the building remained powered-up.

We called our IT maintenance company. They asked if we had a UPS. We said yes. They asked where it was. Luckily someone remembered that it was behind a wall. They tore the wall down.

The company that installed this very-expensive industrial UPS had… not connected its batteries. Yeah, that means that they also hadn’t tested the damn thing either.

To absolutely nobody’s surprise, after new batteries were installed (and connected this time), and after the UPS was actually tested, a new wall was built to replace the destroyed one- without an access hatch.

[ergethrtj6]

Re: Case of acute cleveritis ?

yep - the guy was "too secure" to backup precious data on a pailing phone

hence he lost his data, cos all he cared about was confidentiality, no clue about availability

need to find that XKCD about the $4 wrench

[Anonymous Coward]

Re: Case of acute cleveritis ?

This one?

Inflation has struck: the wrench is now $5

:)

[herman]

Re: Case of acute cleveritis ?

Hmm, that is why my user names and passwords are all Apple. ;)

[Paul Herber]

Re: Case of acute cleveritis ?

Well, doesn't that take the pip!

[David 132]

Re: Case of acute cleveritis ?

What a bunch of Cox...

[Tron]

Moral.

Always save your mobile device content on a memory card. If it doesn't have a memory card slot, don't buy it.

He could always go through airline security acting suspiciously. They would hack his phone for him.

[Androgynous Cupboard]

Re: Moral.

Have a downvote - memory card? What is this, the nineties?

Mine is backed up to my laptop, which is backed up to my RAID-Z2 server, which is backed up to tarsnap. No memory card.

[Dan 55]

Re: Moral.

Never underestimate the bandwidth of a 2TB SD card.

[Anonymous Coward]

Re: Moral.

How do you back up your photos when you are outside of the signal coverage? It's not uncommon one goes hiking for weeks without getting reception good enough for transferring photos to a cloud and having them on an SD card makes rescue way easier if the phone gets damaged on the way.

[Androgynous Cupboard]

Re: Moral.

"It's not uncommon one goes hiking for weeks" - I would think that's a pretty good definition of uncommon for most people.

[Anonymous Coward]

Re: Moral.

It doesn't have to be a week, one gets annoyed even by losing files from a weekend trip.

[Simon Harris]

Re: Moral.

Nineties?

The first phone with a memory card slot was the Siemens SL45 which debuted in late 2000.

[An_Old_Dog]

Flash Card Backup

I back my Android 13 phone's pics to a flash card.

For the past few days, reboots and powerups give me this notification: "Issue with flash card 64GB" / "Tap to fix".

Tapping takes me to a screen where Android offers to re-format the card!! No other option is given.

This is a new definition of the word "fix" which I previously was unaware of.

"We had to destroy reformat the village flash card in order to save it."

(I terminated the app, and will power down the phone, pull the card, and try mounting it read-only on my Linux box. If that fails, I'll be running TESTDISK/PHOTOREC on it.)

[Paul Herber]

What happens then if you have a password set in your own language, using characters only found in that language.

You then move to a different country and as most of your interaction is in a different language you change your default keyboard.

[Dan 55]

Then you are at the mercy of US software developers who barely understand what localisation is and think accent characters are used for making emoticons. Either that or cheap outsourced labour which doesn't give a damn and will follow stupid requirements to the letter.

Apple's official response to a previous similar episode was the user should have made backups in case they fuck around with the keyboard because they don't know what they're doing.

[Dagg]

mercy of US software developers

Are these also the same ones that don't understand metric and think that everyone else works in inches, miles and fahrenheit.

[Esso]

AI, what's FAFO in Norwegian (Nyorski)?

[bemusedHorseman]

This is precisely why I have always, and will always, maintain the belief that usernames, passwords, email addresses, and website domains, should have been restricted to exclusively ASCII from the start (and for websites and emails, to actually enforce the "lowercase only" part of the relevant RFCs). If you limit identifiers and login creds to exclusively the character set guaranteed to be typeable on literally every keyboard on the planet, Original OP wouldn't be in this mess in the first place, do prdele!

[Dan 55]

So your answer is "sucks to be you for being born in the wrong country or speaking the wrong language, if you were born in the right one you would have used ' instead of ˇ or you if you were a nerd you would have known which characters to avoid on the keyboard?" Have you thought of working at Apple?

[Anonymous Coward]

No, it's accepting that there are limitations which are imposed by the US's inability to comprehend that there are other nations with other languages on this planet.

Given the way their country and its educational system is going this is not going to go away soon.

[doublelayer]

So the ASCII characters can be typed on every keyboard on the planet? How certain are you about that? Non-Latin languages where some of those punctuation marks are unused and nobody uses the ^ or ~ for anything. Still certain? For that matter, find the ` character on the US English IOS keyboard; it might be a long press on something, but otherwise, that's not there despite it's nice 96 value. What you mean is that they're easy to type on your keyboard.

[Shropshire Lad]

Keymaps - here be dragons

A long time ago in a galaxy far, far away, I did a job where the client had bought a job lot of quite respectable PCs for a cracking price, and required them to be commissioned. They had been destined for the Eastern European market and were provided with UK keyboards. While the Windows activation codes used Latin characters, the default keymap wasn’t, and couldn’t be changed at this point in the installation. A great deal of Alt+???? sequences ensued.

More recently, I tried to sign up on the Aldi recruitment site (yeah, I know, but times are tough). When entering my email address it wouldn’t validate my personal domain, which has the temerity to contain a hyphen. The support droid was of no assistance, despite my protestations that this was all defined in RFC 1035, some millennia before the bright-eyed developer who likely ‘vibe-coded’ the UI was born.

I could have used an alternative address, but my late-stage boomer curmudgeonliness came to the fore, and I moved swiftly on.

[Dan 55]

Re: Keymaps - here be dragons

It's a technical test before the interview, you're supposed to hit F12 and mess around with the front end so the hypen is allowed.

[Winkypop]

He needs to ask a Leet háčker

OK

Im going

[Esso]

Re: He needs to ask a Leet háčker

Mutley Kruh

[Steve Davies 3]

re: I don't consider Face ID secure enough

About time too. It isn't secure enough. You only have one face yet 10 digits on your hands (ok, some might lose a few over time) but there is more choice and less chance of it being cracked on the first attempt.

[The Organ Grinder's Monkey]

Re: re: I don't consider Face ID secure enough

Fingerprints are OK, but by no means secure, & the advent of "under screen" fingerprint readers means that those of us that work with their hands can't use them reliably.

I found the old hardware 'print readers completely usable, (eg Samsung 9 series / Lenovo X220) but have always assumed that that meant that they were more easily fooled?

[Wenlocke]

Re: re: I don't consider Face ID secure enough

A lot of this isn't even about cracking.

In some jurisdictions, you cannot be compelled to give up a password or enter one (sometimes this is "without a court order or warrant").

However in those places, waving a phone in front of someones face to trigger faceid or sticking their finger against a screen to trigger a password tends to be A-OK)

[Anonymous Coward]

Re: re: I don't consider Face ID secure enough

I think the difference between waving the phone at you for face unlock or putting your finger on it to unlock it being ok but not being able to force you to enter a code / password / pattern etc stems from the latter being knowledge vs something physical.

Of course most places that have this distinction also have laws in place that can jail you for not unlocking a device on demand (from memory for up to 60 days, after which they can ask you again and stick you back in if you refuse again as it's a fresh offence)

[PB90210]

Re: re: I don't consider Face ID secure enough

At the start of COVID there was a site that claimed it could create a facemask that could be used to unlock your phone without the need to remove your mask

[Anonymous Coward]

Re: re: I don't consider Face ID secure enough

The problem I have there is with Windows systems, because I only have two middle fingers. Not much in the way of backup..

[Anonymous Coward]

...But Wait....There's More....

Link - https://tech.yahoo.com/cybersecurity/articles/fbi-just-recovered-disappearing-signal-152709903.html

Report from three days past!

User removes Signal app.......but the FBI recovers messages from an internal Apple database on the phone anyway!!!

Huh!!??? Secure!!?? And then of course there's NSO Pegasus and Paragon Graphite also burrowing into iPhones.

How may other ways to undermine the privacy of Apple users?

Remember Jamal Khashoggi!

[Anonymous Coward]

Re: ...But Wait....There's More....

This proves that Apple could bypass the lock screen of the Czech guy if they wanted to. However, he's an idiot for not backing up precious data residing on a mobile device that could be lost or stolen at any moment and was, in his own words, "very cracked".

[cd]

Re: ...But Wait....There's More....

Can one mount the file system on another device with those? Or does Apple helpfully block that for security and AI-stuffing-via-cloud purposes?

Also, external bluetooth keyboard?

[Anonymous Coward]

Re: ...But Wait....There's More....

The onboard storage is encrypted by default, as it should be.

[Anonymous Coward]

Re: ...But Wait....There's More....

Quote: "...onboard storage is encrypted...."

......except that that the FBI seem to know more than you (or Apple HQ) actually know!

[Anonymous Coward]

Re: ...But Wait....There's More....

It can still be encrypted, but with a backdoor...

[doublelayer]

Re: ...But Wait....There's More....

There are exploits. Apple keeps patching them in updates, but even assuming that the providers of spyware tools to governments have ones Apple hasn't fixed or is deliberately not fixing yet, all this proves is that neither the FBI nor Apple has offered to use their tools to help this user. This is, of course, surprising, as both organizations are well-known for jumping at the chance to help fix a tricky technical issue without making people buy new hardware or having a person whose data they want to copy.

[Mishak]

No

They got the data by recovering the deleted notification text that Signal had been asked to show for received messages.

The FBI did not break Signal or device encryption, and only got the parts of received messages that were included in the notifications that were presented to the user.

I have Signal set to only show who a message is from (and I would also disable that if I was trying to be invisible).

[Anonymous Coward]

Re: No

@Mishak

.....and your point is......exactly what??

(1) Hidden copies engineered by Apple.

(2) Hidden copies exposed in court by the FBI.

.....you think this makes "Apple Privacy" look wonderful?

Please keep drinking the Kool-Aid!!

[doublelayer]

Re: No

Their point is more complex than your reductive statements meaning either:

1. You don't understand why what you said and what they said are different, so you should learn why, something that people sufficiently interested about their privacy already considered, which is why Signal has UI settings explicitly to cover this situation.

2. You do understand but want to overstate what significance that has to make a point that you know is weak which is why, instead of stating it, you're using assumptions about what breaking encryption is and isn't and constantly inviting us to draw the extra lines for you.

[Anonymous Coward]

Re: No

Maybe you should actually read Apple's documentation of encryption and how their security containers work (profile installs).

It would tell you that you've just shown yourself to be an ignorant spork..

[Anonymous Coward]

Re: No

Quote from Apple documentation: "Intro to Profile Manager

Important: Apple has discontinued macOS Server and Profile Manager. The app will not be compatible with future versions of macOS after macOS Monterey."

[Eclectic Man]

Age-old problem

Back in the Dark Ages (late 1980's) I tested a password change system on a computer. I discovered that the change software would allow a new password that started with a 'space' character " ", but the log on screen would ignore leading spaces in the password field.

Fortunately I did not lock myself out of anything genuinely important.

[tiggity]

Re: Age-old problem

Anyone who has been in IT for a while will have encountered all sorts of quirks.

e.g.

Systems that let you enter a character on initial password setup, but when you go to actually login it turns out it was "unsupported" & silently translated to a different character & you have to play guess what it converted to,

Systems with different whitespace approach on initial setup & subsequent screens.

Oddest one was where (deliberately using "simple" ASCII characters as too many bad experiences with Unicode characters silently not correctly supported) initial screen happily let me type in my long password (because "simple" chars used, so length for better security), but behind the scenes it had truncated it to a measly 10 characters. That took a bit of investigation to sort out!

[Boothy]

Re: Age-old problem

The joys of poorly implemented password, and login processes!

Back in the late 90s, not long after starting my IT journey I was tasked with trying to hunt down a potential bug in some custom 'software' we were using. (Quotes, as it was mostly just shell scripts on an AIX UNIX box connected to a rack of diail-in modems (we were still a year or two away from starting using this new fangled thing called the Internet).

Anyway, it was a login process, using a simple username and a password, all over an old dial-up system, to download customer specific data. No encryption, no security of any sort really!

Somehow someone had noticed a certain user was accessing other customers data (they could see files being downloaded in the logs), and no one could figure out how. So I was asked to have a look, as I knew my way around shell scripts, and these had been written years earlier by someone long since retired.

I found out that the usernames were all assigned to customers, and they were all a simple 4 character ASCII, and uppercase only. e..g. ABCD

The customer data was all held in a directory structure that also matched this user ID, e.g. /path/path/abcd and files in there used the same ID in the name, e.g. abcd123456.csv which is how someone noticed files being downloaded by the wrong person. The issue was they couldn't figure out who the person was, they could see files being downloaded in the logs, but not which username was associated with the down-loader, as that field was blank!

I noticed on login the script would 'cd' into the users data directory, so for example an 'ls' would only show what was inside the abcd directory, but...

I found a few major issues:

1. The script did not check that the 'username' field being passed in, actually contained anything!

Plus worse still the 'test' the script did to see if they were a valid user, was to see if that user had a corresponding directory. i.e. If you log in as ABCD does /path/path/abcd exist? If not exit.

So passing nothing (e.g. "") would test for, and drop them into /path/path/!!

2. The login was not locked down in anyway, you could even use cd .. to move up the tree!

3. There was zero restrictions at the file system level, no assigning usernames to actual system users, the file and directory permissions were all set to full read for everyone!

So as this was the bad/good old days of 'just fix it', I added a null/empty check, and a 4 character length check for the username, and a 'chroot' to the script to lock users into just their own directory.

This was meant to be a tactical quick fix, whilst someone else would look at a more strategic solution, which of course never happened. The system chugged on like this for another 3 years or so, before it was replaced with something a bit more modern (it was already about 5 years at the time I joined the team).

I enjoyed the problem solving at lease :-)

[PRR]

Re: Age-old problem

> ...did not check that the 'username' field ....actually contained anything!

Another modem pool, shortly before the spread of AOL diskettes (so dial-up still slightly precious). Floyd had a problem in email so I asked him to log in. He typed his username normally, then got past the password prompt much too quick. He had discovered that a blank password worked fine. And had been that way for years!

[Anonymous Coward]

The character is not entered into the string.

Anyone who's bought an Apple product should be familiar with writing a blank háček.

[herman]

Re: The character is not entered into the string.

European banks do not accept čeks anymore.

[mark l 2]

Mostly likely an Apple dev who had no familiarity with the Czech language decided that that character was unnecessary as it made the lock screen keyboard too cluttered so removed it without thinking of any of the consequences, Sounds like probably another case of form over function to make something look pretty.

[Phil O'Sophical]

form over function to make something look pretty.

Standard Apple design philosophy.

[ChrisC]

"Standard Apple design philosophy"

FTFY - Apple may have pioneered the concept, but sadly far too many others have drunk the koolaid, hopped aboard that graphic-designer-led train, and foisted upon the world an ever increasing series of products with user interfaces which, not to put any sort of fine point on it, suck.

[Anonymous Coward]

It just works, until it doesn't.

[DS999]

It is hard to feel sorry

For someone who did not backup the important stuff on their phone. If those photos held value for him he should have had them somewhere else. iCloud, iTunes backup, some other cloud service for photos, email them to himself, connect a USB cable and copy them to a PC, whatever.

If his phone had been lost, stolen or broken he would have lost those photos just the same, and the odds of any of those happening are orders of magnitude higher than "iOS update prevents me from entering a special character in my password". So while yeah it would be nice if this is in fact a bug (rather than some sort of poorly documented change made for security reasons) that they would fix it, he has to shoulder a lot of the blame for not caring about his data enough to have a second copy of it ANYWHERE other than one breakable and losable piece of technology.

He can switch to Android and solve the problem of being able to enter that password (if he sticks with it) but if he continues to not back up stuff he considers important in any way odds are pretty good he'll be in the same position at some point in his life due to a lost/stolen/broken phone.

[NapTime ForTruth]

Re: It is hard to feel sorry

Eh... Let he who is without sin cast the first stone.

We've all cocked it up on occasion, we've all gotten it wrong. If we've been lucky, good on us that we got a second chance; if we've not been lucky, maybe someone else stepped in to assist.

Disappointed that the nominally elite, or at least hypothetically competent members of this august community are more concerned with shaming than with helping.

[ChrisC]

Re: It is hard to feel sorry

Whilst I don't mind the responses pointing out how foolish he's been for not having these seemingly important photos backed up somewhere, to act as a reminder to anyone reading the comments just how important it is to have a good backup/recovery plan for stuff like this, like you I do mind how many of these responses seem to be solely focused on this aspect of the story, completely ignoring the IMO far more important point of this story...

...namely that Apple have, knowingly or otherwise, released an update which removes the ability to enter passwords if they contain a certain character previously deemed entirely acceptable to include in a password, and without (so it would appear) any forewarning to the user that once their phone reboots after applying this update, they're at risk of being locked out forever.

Because despite all the comments in those shaming posts along the lines of "well, if your phone had been lost/stolen/damaged even further, then you'd be in the same position you are now", the simple, inescapable fact is that he ISN'T in this position because one of those other things has happened. He still has his phone, it still works well enough to be accessible, and had it not been for the actions of Apple themselves in releasing an update which has bricked his phone, then he wouldn't be in this position now.

So yeah, sure, if he'd just backed up those photos then this would be a non-issue. But that doesn't mean the role Apple played in it becoming anything other than a non-issue for him should be so quickly glossed over.

[Jim 68]

iPhone linguistics fail

I don't understand how a company claiming at times to have the highest capital valuation in the world can't help this guy.

I had two backups of my Samsung phone, one to my laptop and one to a separate hard drive.

Unfortunately I had a home invasion robbery and lost everything.

As for cloud backup, it's not practical for most people because Internet access is too slow and too expensive to back up hundreds of gigabytes of data.

[NapTime ForTruth]

Re: iPhone linguistics fail

"...can't help this guy..."

Correction: WON'T help this guy. It's not an impossible feat, Apple just doesn't care and can't be bothered.

By comparison, other tech companies across the board differ significantly in the sense that... just kidding, no tech company will reliably help its users.

Farmers take care of their cattle because that's how they get future food. It's not because they love and want to help the cattle.

Tech companies are farmers. We are the cattle.

[theloon]

If the photos where that important...back them up fool!

So he was assuming the phone:

never failed

never got stolen

never got damaged

and soooo on.

Not a good decision

[Terry 6]

Only stored on phone ffs!!

When I'm doing my volunteering teaching basic IT skills to disadvantaged adults I always cover this as part of several of the sessions, in case anyone missed it, forgot, didn't listen.

If it's only on the phone it might as well not exist.

I am horrified, and tell them so, when I hear or read a story of someone who's lost precious memories, because they were all stored on a single phone.. Which said phone then dies/been stolen/dropped off a pier/etc.

ON TV the story will be that they'll be sobbing about how their wedding photos, or all the pictures of a child growing up were on that phone. Often the subject of the photos has died.

And I feel so sorry for them, but also rather cross that they were so stupid. Even if the phone with all the wedding photos hadn't fallen into the lions' enclosure during feeding time at the zoo it would have come to some sort of terminal event eventually.

[Crimliar]

So you can't just connect a physical keyboard like on most other OSs?

[geoff61]

That was stated in the penultimate paragraph of the article: "For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered."

[redpola]

A story as old as computers themselves…

"They're the main data that I care about and haven't backed up."

[Anonymous Coward]

reminds me

of when we had a security appliance shipped from the US to a factory in the UK. It had been pre-configured with a password that contained the @ symbol. No matter how many attempts, my boss at the time could not log in.....

[Mishak]

Could have been worse...

They could have been reading the password over the phone:

US "Pound symbol" (#)

UK "Not working" (£)

At least the Gen-Z "hash tag" gets you there ;-)

[Bill Gray]

Re: Could have been worse...

I'd go with 'octothorpe'.

[Maurice Mynah]

Re: reminds me

Reminds me of trying to use the DOS/Windows CLI with an "emergency" keyboard missing the \ key...

[MattieD]

Not just Apple

One trend I've come across recently is a lot of apps and websites won't allow you to use a quotation mark - either single or double - as part of a password. The cynic in me thinks they're trying to avoid something like a SQL injection attack - but that then raises the thought that they're passing credentials unencrypted.

Also, to keep this on track with the original story, Ricoh's on-screen keyboard on their MFDs don't contain the £ symbol. Which makes using AD authentication with them an issue.

[tiggity]

Some unsympathetic people

Unless it has changed, you could use an iPhone without an apple ID (similar to how you can use an android without a Google account) & its similar scenario - no cloud backup etc. (unless you set up your own)

If user was privacy focused then possible they did not have apple ID and thus no auto iCloud backup etc.

Or maybe it was a cost issue, you only get a small amount of iCloud backup for free, then you have to pay (partner is an Apple user who makes heavy use of photos & so I am aware of cost escalation as you increase amount of iCloud storage).

IIRC without iCloud its a pain to get photos off an iPhone (photos are held in some weird DB storage rather than simple folder of JPEGs as it is on an Android))

[Simon Harris]

Re: Some unsympathetic people

You can plug a USB cable between the PC and an iPhone (I can only speak for Windows, but I presume other OSes let you do the same) and the pictures/videos appear in a DCIM folder that you can copy across (although don't try to copy them all in one go as it tends to time-out and drop the connection after a while if you're not paying attention). IIRC, there are sub-folders within the DCIM folder, labelled by year and month, but the order within each folder can be a bit scrambled.

[Simon Harris]

standard four-number passcode

The default, at least since I got an iPhone SE in 2020 (which I'm still using), is 6 digits, although there is an option to reduce it back to the old standard of 4 digits.

[DS999]

Re: standard four-number passcode

Yes that's the default but it lets you use a password which many of us have chosen to do.

[bitwise]

Plug in a keyboard?

You can get lightning to USB adapters, I haven't tested a keyboard but the mouse works on the iPad at home.

[Sleep deprived]

Google keyboard (Gboard) not much smarter

In the Google keyboard with a language layout other than English, holding down the letter o opens a popup of 10 variants of the letter o (on 2 lines of 5 variants), including the degree symbol. In the English layout, only 9 variants are shown, while the top-left square is left empty, thus skipping º (I just switched to French to type it). I already reported the problem, but the Automsted Dumb agent doesn't understand my bug report.