Do not use emoji in your passwords

“I’m a big fan of pushing emoji to their limits in weird places, but this guy learnt the hard way when he took it too far and used one as his password,” Owen Williams reports for TNW. “Turns out, OS X doesn’t like it if you use an emoji password, as you’re banned from entering an emoji password on the login screen so the poor guy was locked out of his computer.”

I wanted to check if it’s possible to use emoji in a password for my Account on OS Yosemite. It worked but I didn’t realize that the login screen has only native keyboards, so I can’t type emoji there. So the situation is that I know my password but I can’t type it. The machine has rebooted to the Recovery HD and I don’t see a way to enable the emoji keyboard there. In effect, since FileVault was turned on, I can’t restore the password easily.Ask Different user

Williams reports, “In the end he resolved it by jumping into recovery mode, booting from an external drive, installing an emoji keyboard, disabling encryption and waiting a number of hours before he was able to log in again.”

Read more in the full article here.

MacDailyNews Take: Don’t stick butter knives into electrical outlets, either.

Apple’s “OS X El Capitan: Tips for creating secure passwords” is here.

12 Comments

  1. We ran into an interesting situation where an end user had entered an ASCII character as part of their password.

    Everything was fine until one legacy system we rely on interpreted the character as a control code and crashed hard.

    Took us a bit to figure out that the crash happened every time this guy entered his password.

    We put the word out to our users on passwords and are looking to migrate to a newer system sooner than later. Good times. lol.

      1. Extended ASCII, which you can technically use in an active directory domain password.

        The system we discovered this issue on is a really old legacy app that used to rely on serial communications over a modem. Its for dialing into field equipment and doing maint.

        It was updated in 2001 and now its utilized over the internet, but the update was a software layer that mimics a modem and feeds a stream of data to the server.

        It was a kludge to keep the old system going longer. Its capable of authenticating to active directory provided the tech uses their downlevel NT userid and domain password. It won’t recognize a more modern UPN.

        There are 3 characters that we assume are used for flow control or some other function that causes the whole show to come to an abrupt end if they are passed over as part of a password to the legacy app.

        Luckily for us we have very few systems in the field that still rely on this old beast. It ended up being a good reminder that we need to finish updating our field equipment and deep six this old monster.

      1. Is not there some standard equivalent of emoji in plain ASCII?

        For example, instead of a smile, you could write “{:smile:}” or something.

        The only issue with this would be that Apple’s password entry system would need to somehow differentiate that this is not literal password, but an emoji.

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.