Radek Průša
Anna Anthro
Edwin G. 
@AnnaAnthro Apple should be able to unlock the device they forcibly locked.
And prevent future updates that break secure passwords like this. 😡
Heliomass@EdwinG @AnnaAnthro Epic. I once got caught out setting a Mac password with accented characters. Turns out the keyboard layout was different at boot, so it took a lot of trial and error to work out which was the right key.
@EdwinG @AnnaAnthro Unfortunately, I think that this person might not be able to get their data back. As far as I remember, the device passcode has to be entered before any OS update/downgrade, and I don't think it's even possible to downgrade iOS versions anymore. Maybe a physical keyboard connected to the phone, but I think iPhones block any USB devices when in BFU, and even then, switching they physical keyboard layout might not be possible from the BFU lock screen.
@prusa @AnnaAnthro IIRC, the phone’s paired computer should be able to update their iPhone to a fixed iOS version (e.g.: iOS 42.23.4)
@AnnaAnthro I'm a native Czech speaker, and I've seen so many strange issues when using accented characters (ú,ů,ý,ž,ř,č,ó, etc.) in passwords. The worst kind is when the service says that my password was changed successfully, then I go to try and login, and get errors because the password hashing process made some changes to the password because of the accented characters, and I have to reset it.
Some services also silently truncate passwords over 56 and 72 characters.
@AnnaAnthro I don't know all that much about password hashing algorithms, but I have a theory that some hashing algorithms might turn a character like "č" into some other representation like punycode "xn--bea", which might make the password character counter on some websites get a count different from the hashing algorithm, which would then silently truncate my passwords when they go over the upper character limit. Instagram has been having issues like this since like 2016.
@prusa Really interesting stuff.
@AnnaAnthro I put this theory together after reading an article (https://soatok.blog/2024/11/27/beyond-bcrypt/) about bcrypt, and started thinking that since most sites have a max allowed length for passwords to prevent a DOS from having to hash extremely long passwords, they might only enfore the max length on the password form, and not the hashing and salting process.
@prusa I actually find the ethno-linguistics around passwords really interesting.
English-speakers apparently use phrases more frequently, ie ThisIsMyPassword. While Mandarin-speakers tend to use number puns or their telephone numbers.
This is article from 2019 but you might find it interesting
https://spectrum.ieee.org/how-language-shapes-chinese-and-english-password-security
@AnnaAnthro That is really interesting, I definitely have a different process for choosing passwords in different languages, and never even thought about something like this.
Jessie Nabein 
@AnnaAnthro everyone reading should apply the tvOS beta profile to prevent forced updates: