Locked-out iPhone user tells The Reg that Apple is scrambling to fix character flaw passcode bug

Apple is finally working on a fix for a bug that has locked some users out of their iPhones for months, The Register understands. Cupertino's iOS engineers apparently became aware of the Czech keyboard blunder last week via university student Connor Byrne's Reddit post and set out to fix it in an upcoming iOS 26 release. …

[K555]

Silly question as a non iPhone user

Can you update an iPhone without unlocking it?

[Headley_Grange]

Re: Silly question as a non iPhone user

In theory you can by connecting it to a Mac or PC and running recovery/DFU mode. I say "in theory" because Apple these days seems to have moved off the 'reliably boring" step onto the "break things" step. If the user hasn't got a Mac or PC then they ought to be able to get it sorted out in an Apple shop.

It's hard to understand how this change survived any sort of requirements review or design review but the good old reliable Upsilon testing picked it up.

[Andy A]

Re: Silly question as a non iPhone user

But the phone would need to be unlocked before responding to the PC or Mac. Otherwise anyone could break in to any old locked iPhone.

[Headley_Grange]

Re: Silly question as a non iPhone user

No - the phone will recover but Activation Lock means it can only be activated by the owner logging in with their Apple ID.

[Andy Taylor]

Re: Silly question as a non iPhone user

I would imagine that the user unlocked their phone with the password on the working version of iOS then updated it to the broken one.

Since the update process reboots the device, it will disable Face/Touch ID and require the PIN or password to be entered to re-enable it. This was now an impossible task because of the missing character.

Plugging in to a computer would not work either because that requires the PIN/Password too.

The only way out is a factory reset and then restore from backup.

Back up your data folks.

[alain williams]

Re: Silly question as a non iPhone user

>> Back up your data folks.

That must be the lesson to learn. He could equally well have: lost it; had it stolen; had it run over by a car; ...

[ChrisC]

Re: Silly question as a non iPhone user

But he didn't, he lost access to the phone he STILL had in his possession, solely because Apple pushed an update rendering useless certain previously valid passwords...

Yes, as several of us pointed out in the comments for the original article, it's not unreasonable to use this as another real world example of where having good backups would have helped, but please let's not continue falling into the trap so many others did in those comments of focussing *solely* on the lack of any backups and ignoring the rather significant part Apple played in this user losing access to their data. Because this is a rather salient point - even if you ARE performing good backup policy, there's a good chance access to your data will STILL be at the mercy of the manufacturer of whatever system is required to access the backup.

So unless your backups are being made in a form that you can guarantee will remain readable no matter how badly someone else might mess things up, then are they actually backups at all?

[Lusty]

Re: Silly question as a non iPhone user

Quite right. And what happens when trying to access iCloud backups and 2FA insists you use your phone to confirm it’s you? No usable backups.

[cyberdemon]

Re: Silly question as a non iPhone user

Could he not plug in an external USB keyboard to unlock the phone? This works on my (Android) phone

[MonkeyJuice]

Re: Silly question as a non iPhone user

I believe the issue is that until the pin is entered, iOS doesn't initialize any connected USB devices. The fact that Apple themselves are actually addressing this bug implies that even their support engineers fell off the flowchart into "Buy a new phone" territory.

[MachDiamond]

Re: Silly question as a non iPhone user

"Because this is a rather salient point - even if you ARE performing good backup policy, there's a good chance access to your data will STILL be at the mercy of the manufacturer of whatever system is required to access the backup."

A backup that requires a third party to be useful is not a good backup. Sure, it can be handy if you are traveling and want/need to back things up to a 'cloud' drive as a safety measure, that's not a bad idea. To rely on that full time is silly. I have several backups of my critical data both inside my computers and out, on and off site. None of those require internet access, a subscription or the benevolence of some company to make use of them (unless I need to get to a family member's house to retrieve drives as a last resort and need to fill up with petrol and have working roads).

[Anonymous Coward]

Re: Silly question as a non iPhone user

The whole backup thing depends on the scale you are working at. For backing up the work data, with multiple VMs and cloudy stuff, there really is no option but to use backup services and products where it's possible something could go wrong, rendering backups unrecoverable. Unlikely, if you use reputable services, but still possible.

For home computer backups of files I have a simple Robocopy script which copies the lot to a USB SSD. Basic files, so highest chance of them remaining readable. I also back up the non-confidential stuff (music library, etc) to a cloudy service as a fallback, but I certainly wouldn't trust said cloudy service as my only backup!

[MachDiamond]

Re: Silly question as a non iPhone user

">> Back up your data folks.

That must be the lesson to learn. He could equally well have: lost it; had it stolen; had it run over by a car; ..."

Or the phone bricked by a software change by Apple, but how likely would that be?

[Korev]

Re: Silly question as a non iPhone user

> The only way out is a factory reset and then restore from backup.

It said in the original story that he deliberately didn't enable cloud backups

[Andy Mac]

Re: Silly question as a non iPhone user

I don’t have iCloud backups enabled either, but I still back up my phone to my home machine and it’s something I do before applying any major update

[Anonymous Coward]

Re: Silly question as a non iPhone user

Yes, put it into DFU mode, connect it to a PC with iTunes or a Mac, it will be detected and you get the choice of updating without erasing anything or a full factory reset (but it doesn't remove the activation lock)

As always, FFS people, back up your data, especially from easily damaged, lost or nickable gear like a phone

[iron]

Re: Silly question as a non iPhone user

After an update iPhones go into a locked down "first boot" mode that requires unlocking.

[Necrohamster]

Re: Silly question as a non iPhone user

No. you need to input your PIN as part of the update process.

Someone mentioned DFU mode, but updating the phone by DFU mode will wipe it.

So it depends on whether you want to retain your data or not.

[Davegoody]

As per other comment - how is a new iOS release going to fix this, when the user is locked out of their iPhone, and they can't upgrade the OS when they can't get into the phone to install the update?

[Anonymous Coward]

Czechmate

[may_i]

Only the lucky get fixes

Here we are with another perfect example of how people are powerless against corporations unless they are lucky enough to get the press interested.

[Dan 55]

Re: Only the lucky get fixes

Well it did affect customers from an entire country, not just one person.

[Bebu sa Ware]

Re: Only the lucky get fixes

"Well it did affect customers from an entire country, not just one person."

Only those Czechs who didn't use the four or six digit pin and did include the Czech háček in their passcode. Probably the one in a million chance that is a certainty. It's only the unlock screen that is affected - the Czech keyboard is fine once unlocked.

Apple is a bit buggered here. If they can break into this phone they have been lying for years to one party or other. If they cannot (or wiil not) then they get slammed for a fairly foolish breaking change.

I guess the world is still ASCII - Make Ascii Great Again.

[Dan 55]

Re: Only the lucky get fixes

That would be like confidently asserting that some other bug only affects the apostrophe on the English lock screen keyboard and who uses that. So what - it can still screw people who log in with a password and used that character and it shouldn't have happened.

Broken software localisation by US software developers (stupid dumb drooling puzzle.jpg) is precisely why it's still an ASCII world.

[LoonyToonz]

Wouldnt an external keyboard work

Its been several years since I last had to do this with an iPhone but using the official camera adapter allowed you to plugin a a USB keyboard so you could enter the pin to enable it to talk to a connected computer.

Had to do it a few times when people broke their iPhone screens so much that they couldn't enter the pin that was required to connect to a PC or Mac to back it up, prior to it been taken to a genius bar for repair.

[Andy A]

Re: Wouldnt an external keyboard work

But the phone will ignore the character typed on any keyboard, because the Czech character no longer exists in that version of iOS.

[LoonyToonz]

Re: Wouldnt an external keyboard work

Oh I must have misunderstood, as I though in the earlier report it mentioned it was still on the main keyboard in iOS once logged in but not available on the lock screen keyboard.

[Solviva]

Re: Wouldnt an external keyboard work

Security means you need to unlock the phone before any USB devices can be used...

[bemusedHorseman]

Re: Wouldnt an external keyboard work

And even if it allowed an external USB keyboard, it wouldn't change anything because the keyboard sends key code numbers, not actual text characters (unicode or ascii), and it's entirely dependent on the current locale on the main device to contextually interpret. "Hmm, keycode 35 was pressed while 58 was held. Current environment says this combination corresponds to character č, transmit č to active input field."

The special hat letter was deleted from the locale data itself, so even if it allowed an external keyboard input, there is no combination of keystrokes on any keyboard - not US English, not Czech, not even Korean - that would be parsed as the missing character.

[Anonymous Coward]

Apple...Or Someone Else?

Link: https://tech.yahoo.com/cybersecurity/articles/fbi-just-recovered-disappearing-signal-152709903.html

Maybe the unlucky user should have enlisted the FBI?

[QET]

Re: Apple...Or Someone Else?

Would be mighty embarrassing if a 3LA can fix a obscure yet monumental fuckup on Apple's part, and at the same time, point out more security flaws.

Though I'd bet the agencies in question would really prefer to keep those known software loopholes for juicier targets.

[Clausewitz4.1]

Re: Apple...Or Someone Else?

” Maybe the unlucky user should have enlisted the FBI?”

Those juicy and expensive local exploits are hoarded by 3LA/Cellebrite to use against terrorists, political opponents and the like…

[retiredFool]

Re: Apple...Or Someone Else?

So maybe if the guy makes public shaming trump comments and really piss him off, the fbi would be willing to engage 3LA? Worth a shot. It does seem trivial to piss off the orange clown. Just have him take out an ad about epstein/trump at the NYT.

[Doctor Syntax]

Re: Apple...Or Someone Else?

FBI is a 3LA

[ravenviz]

Re: Apple...Or Someone Else?

There are far too many TLA's in this world!

[Anonymous Coward]

Making the impossible possible ....

Back in2021, when MS were fucking around with their printer privilege problem, their "fix" borked every computer in our network.

"Don't worry" said the support agent "You just need to log into each machine, apply this fix, and good as gold. There is no other way".

"That's nice" I said. "And seeing as you paid to support us, when will you be doing that ?"

48 hours later it was all fixed.

[Social Ambulator]

iPhone XS

Blessed are the paranoid for they shall find the world is truly against them.

[IGotOut]

Bug?

No.

This was a deliberately taken out. That's a choice, not a bug.

[MadeInNY]

Re: Bug?

I've been an engineer for a LONG time, and we rarely deliberately take out things. We do however neglect to put back some things.

Perhaps not much of a difference but never attribute to malice that which can be blamed on incompetence (or more realistically, lack of forethought.) -- My variation on Hanlon's Razor.

[Anonymous Coward]

Re: Bug?

Aha "putting things back" is the big problem with Microsoft rewriting the basic stuff, like notepad.

More concerned with adding co-pilot than making it work like the original did.

[MadeInNY]

Cameras?!

How much better are the cameras? Really.

[Dinanziame]

Re: Cameras?!

I'll purchase an Android soon because of how much better the cameras are

I suspect it's not the camera itself so much as the software filters that replace your shitty picture of the moon by a better one

[MadeInNY]

USB Keyboard?

I suspect he might have been able to generate the keystroke needed if he plugged a keyboard into the USB-C port. If I understand correctly, they didn't remove the character completely, just from those available on the on-screen keyboard.

[Solviva]

Re: USB Keyboard?

But said Iphone needs to be unlocked before any USB devices can be used.

[DS999]

Re: USB Keyboard?

I wonder if you could use a BT keyboard if it had been previously paired? Haven't ever checked to see if my iPhone connects with BT devices it is paired when in 'before first unlock' mode.

[Richard 12]

You cannot

After a power-cycle or firmware update, you must unlock using the onscreen pin or password before any external devices will connect.

I don't think FaceID or fingerprint reader work either until you've unlocked it once. (Certainly this is the case on Android)

I am wondering how the OP is going to install this update, given that it cannot be unlocked. Maybe there is a force firmware update if booted in the recovery/wipe mode.

[Eric 9001]

I remember reading about

Another used facing the same issue after using an emoji in their password - when apple decided to introduce emoji modifier characters, the extra bytes inserted made it impossible to login.

The current used seems to plan to go out of the fire (iOS) and into the frying pan (Android) huh?

[Necrohamster]

"The student, 21, used the unconventional method of authentication for his iPhone 13. Instead of using the four-number PIN that most iPhone users opt for"

Speak for yourself. I thought the setup process steered the user towards 6-digit PIN for several IOS generations?

"The only issue was that he used the caron/háček (ˇ) on the iPhone's Czech keyboard as one of his special characters - a character Apple removed in iOS 26, which became generally available to iDevices in September 2025."

You can use an external keyboard over USB-C or a lightning-to-USB adapter, and enter the alt code for the háček

[NetMage]

How will you get the UsB keyboard recognized when you are locked?

[NetMage]

The real question is why did anyone think it was a good idea to have separate keyboards for the password entry and the general OS - that is just asking for this kind of issue.

[hugo tyson]

Password validation before verification = FAIL

I wish I wish I wish all password entry pages/dialogs/apps would have a popup telling you what their password requirements are. That way I would know which password to use there. For unimportant but an-account-is-handy places, I mean, not for anything serious.

I've once experienced something similar on a proper important finance website login. They changed the password requirements "to improve security" by requiring more variety of course. And then put the check in the password entry dialog. So it refused to pass on my actual simple password to the authenticator because it didn't meet the requirements, FFS.

Obviously the check for pw requirements should be in, and only in, the change password routine.

Fortunately the "forgot pw" dance with emails and that sorted it out in that case....

[Dinanziame]

Can't believe that Apple pushed a new keyboard that is unable to write Strč prst skrz krk

[Yeti]

Or "Příšerně žluťoučký kůň". Just imagine.