Sounds more like an actual bug than a decision to change the keyboard layout, if this happens only in the passcode screen?
And do your could backups cross-provider. You never know what the "big players" are going to pull, and your lifetime customer value is less than the cost of a single support call.
Or release some sort of open version once device is EOL'd.
Also people find exploits on newer OS versions as well. Downgrading makes it easier but not downgrading doesn’t make the device unhackable.
It’s also my right as an owner to have good security practices available on my system. If I want to protect my computer with a BIOS password or full disk encryption I do want to be able to do that.
Shame on Apple for having such lazy software development practices for their OS that they managed to brew something as simple as password input.
The percent that might want to choose a different-than-latest version of OS would also of course be quite small, but I suspect it would be orders of magnitude larger than the other group we're speaking of just because that group of people is going to be so absurdly tiny.
On PCs you still have Linux that resists enshittification and you can pick your own hardware, but it's a really sad state of affairs that there is literally no meaningful mobile system that isn't actively hostile to the user.
People need to wake up to the fact that Android has become iOS but worse.
You wan't to access some files off your network using smb? Here install this third party tool and don't forget to give it full read/write access to your device.
Steve Jobs would be rolling in his grave if he could see the software quality of the products that Apple releases today.
lol, nah he wouldn't. He would of upgraded his coffin to plush and got a big screen to watch the money roll in.
I recommend reading up on his 80/90's antics. All he cared about was money and that the world was crafted by him.
He was widely known for intense bullying, lacking empathy, and ruthless manipulation, combined with a "productive narcissism" that fueled his obsessive drive for perfection.
Incorrect. Read the David Pogue Apple book. For example, after the iMac was released, the Apple board of directors offered Jobs a million shares and six million options if he switched from interim to permanent CEO. Jobs continued to refuse. “This is not about money. I have more money than I’ve ever wanted in my life.”
Most of Steve's wealth came from Pixar, which he ultimately sold to Disney, rather than from Apple.
His vision of perfection didn't always match common sense. There are quite a few examples of this.
I always cringe a little when I read these "jobs would have rolled over in his grave" comments.
Even if Apple restores the háček in a future update, wouldn't he still need to unlock the iPhone to install it?
I wonder what the thought process (or perhaps lack thereof) at Apple was. Did no one of the likely-somewhat-large team who did that think "wait, this could lock out our users who may have used that character"?
In the immortal words of Linus Torvalds: "WE DO NOT BREAK USERSPACE!"
Now one of the ways in might be those companies who claim to be able to break iPhone security for law enforcement and the like, but I'm not sure if they'd be willing to do it (at any price) unless you could somehow trick them into thinking you had some "interesting" data on there...
The USB keyboard suggestion mentioned in the other comments likely won't work either because of USB Restricted Mode. After an hour of being locked, iOS disables data over the Lightning/USB-C port until the device is unlocked. It’s a perfect, recursive failure: you can't unlock the phone because the character is missing, and you can't plug in a hardware keyboard because the phone is locked.
Treating the passcode keyboard as a transient UI element that can be "cleaned up" rather than a hard security dependency is a massive architectural oversight. If the OS allows a character to be used in a passcode, that glyph needs to be permanently accessible in a fallback mode, no matter what the localization team decides to prune.
The one way to do this that I could see is to include both the new keyboard and the old one and if someone fails to unlock with the new one auto report that to Apple (not the code, just that the unlock failed and that the keyboard might be the problem), then auto revert to the old keyboard on the next unlock attempt...
If allowing that character in the first place was a mistake, then Apple has pushed the consequences of their mistake onto the users instead of owning the mistake and keeping that character available forever on existing devices.
Just have an automated keyboard test for every new release to ensure those characters aren't broken.
You basically can't ever remove an available character.
That includes emojis if they're allowed in IOS passwords.
The iOS emoji selector is close in UI/UX already, but the search is restricted to the emoji range of Unicode.
Or wait until a future OS version that will not support any device currently in existence.
Then you wait. Then you roll out a version where the new functionality is flipped on by default, but where you still allow to explicitly toggle to the old one. Then you wait some more.
And then - only then - you roll out a release where the old functionality has been removed entirely.
There should be migration taken into consideration that is kept to any previous version allowed to be upgraded from.
I don't think we can assume the team is large.
Sure they have most of their stuff translated but some rough edges make me feel they do the bare minimum:
- Their ISO keyboard sucks. Sure their overall quality makes it good but of the major brands their Enter key is the most flimsy attempt at it
- Some long standing bugs https://discussions.apple.com/thread/250299816?sortBy=rank (which I had the impressions they were made worse in localized version or at least if you used a non American date format)
- General weirdness with translation missing sometimes
And from what I've seen, Apple's always supported fewer languages and input methods than Google/Microsoft, like they simply cant be bothered.
Since the user doesn't speak Czech, I promptly removed the Czech layout and installed two other layouts, US English and Hebrew, for the languages that the relative uses to type on the computer.
For some reason, login screen just after boot still uses Czech layout, which means Z and Y are swapped and numbers must be typed with Shift (just pressing numbers outputs Czech letters like ěščř). So when booting up the machine (remember that you can't use fingerprint during first unlock), the user must type the password in whatever layout is physically printed on the keys, even though the rest of the OS doesn't even have a mention of that layout. Somehow afterwards the OS "can" see the list of the layouts and lock screen correctly chooses the English US layout.
Alongside of that, for some reason, the key that's supposed to type ` and ~ in the US layout types some nonsense instead (a plus-minus sign and a section sign), whereas the backtick key is for some reason located between left Shift and Z (good luck unlearning years of muscle memory typing ~/Documents in the terminal)
That may be generally true, in this case Apple actually has an engineering team in Czechia that works on biometrics and authentication:
https://zpravy.aktualne.cz/ekonomika/apple-posili-v-praze-ty...
https://jobs.apple.com/en-gb/details/200636301-2611/software...
Alexa has an experimental bilingual mode but it's nerfed by its general failure to understand well.
Only thing I can think of is some features being available later in danish compared to the English release like the swipe keyboard in iOS.
Language support is still such an enigma.
Twice I have had the touchscreen fail on Android devices and been able to get what I needed off them using a USB mouse.
Makes sense why he didn't do this.
As a comparison, if all Vietnamese people had three feet and three arms, would they all be walking around with two left and a single right Nike shoe while wearing a Champion shirt with an extra arm thrust through the sleeve?
At what point do customers and users realize they are responsible for giving consent?
As a non-English speaker (Czech, actually), it is clear to me to not use non-ASCII characters in passwords, or generally not use characters that are at different position on default English keyboard and locally used keyboards, i.e. use only ASCII alphanumeric chars except 'Y' and 'Z'.
As keyboard setting is per-user setting, keyboard may be different on login screen than on regular desktop (and once-login password prompts).
That's just excuses for moronic decisions of trillion dollar companies.
It seems paramount that the OS should not allow password input of any characters which it theater takes away. At the very minimum if this is absolutely necessary to make this breaking change, the user should be warned several times that a character in the password is no longer valid and maybe even prevent the OS from upgrading before the password is changed to a forward-compatible one.
But there is already a known pattern on how to handle this which I was taught (before the original iPhone even) in university CS studies:
If the manner of entering credentials has to change,
Then on first entry, offer the old method,
And, because you now (temporarily) have the plaintext credentials, you can now inspect it and test if anything need to change for the future,
And then set a flag, or require user action , or just re-encode, to use the new method as inspection determines.
In the olden times, even ASCII wasn’t necessarily a safe bet, as many countries used their own slight variation of ASCII. For example, Japan had the Yen sign in place of the backslash. In a fictional ASCII world, Apple could have decided to remove the Yen key from the Japanese lockscreen keyboard.
No that's obviously crazy!
People are afraid of AI, but human organizations can be quite opaque as well.
That said, as a Czech, I wouldn't use any accentuated characters in my passwords. Anything beyond 7-bit ASCII is just asking for trouble.
The bug seems low likelihood but high severity for the few affected users. Other than simply never changing the login keyboard (or any of the keyboard code) or having nearly 100% test coverage, how does a company not accidentally have more of these types of issues?
They don't. If you're anything other than an extremely casual user of iOS or macOS for a couple of years, you'll encounter things that really make you pull your hair out by shear magnitude of "how on Earth can anyone miss this!?".
The same goes for feature velocity.
This bug got popularity that’s all.
I have recently discovered several bugs in different products created by different companies. And none has been reported so far in my research despite the products' popularity. I am not surprised, since those bugs require specific combination of conditions to be triggered, which most people have never run into, like in this article.
And I don't even blame them -- the engineers probably could never think of such use cases and don't have those workflows themselves. You'd have to really go out of your way to use obscure workflows to discover them.
Although in this case Apple dropped the ball by locking user out and not providing any alternatives.
> For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered.
The user can't even enter their passcode, how do you expect them to perform code execution?
> For the same reason, plugging in an external keyboard is also a no-go since freshly updated iPhones are placed in what's known as a Before First Unlock state, which prevents wired accessories from working until the passcode is entered.
Why can't people read stuff before commenting?
Why can't people read stuff before?
Why can't people read stuff?
Why can't people read?
Why can't people?
Why can't?
Why?
?
I'm basically numb to it at this point though. Every few days we read on this site small permutations of the same story. Sometimes people here get a little extra backchannel support, but that's a token prize for the jester who made a king chuckle.
Then a few more days go by and everyone upvotes a new iWidget to oblivion because it has 0.1 new gigablahs or takes up a milliblah less of some bullshit nobody was asking for.
All while we collectively virtue signal that people are spending too much time and relying on technology too much.
Well, it's almost Monday let's see what new bullshit convinces everyone to keep getting fucked and pay for the privilege.
I basically have turned into this guy: https://youtu.be/8AyVh1_vWYQ
Here's a challenge: walk into a store and attempt to buy a smartphone that is not iPhone or Android.
This is the situation that consumers face. Some alternatives exist, but most consumers are completely unaware of them, because the alternatives have no advertising budget or retail presence.
I think it's quite similar to the political duopoly. Third parties exist, but they have no advertising budget, and moreover, in a Catch-22 situation, they get little or no news coverage, precisely because they have no advertising budget, and thus the news media considers them "not viable." That's a self-fulfilling prophesy. Actually the same situation exists in tech: Apple and Google get huge amounts of free news coverage in addition to their paid advertising. The media appears to feel no obligation to help people escape from duopolies; guess who pays for their advertising...
Want to take pictures? Use a camera. If it somehow auto updates your photos are still on an SD card.
I get convenience has led everyone to expect their phone to do everything for them, but it's not working. When you're in a pinch you will go to a 7-Eleven and grab food, but everyone would agree that buying everything there instead of real groceries is a terrible strategy. Just because something is convenient doesn't mean it's good.
It's mostly working, though. For every story of someone experencing a severe problem, there are millions of non-stories of people not experiencing the problem.
Inconveniencing yourself every day just to avoid the rare situation is not necessarily a great life strategy. Furthermore, most consumers are not as aware of these problem cases as we are. They don't expect the worst until it's too late.
Admittedly, failing to back up is just dumb, and everyone should know that by now. On the other hand, nobody should be expecting that a software update will kill their passcode.
Be aware of characters not passwords. I feel bad for the guy but not really blame Apple here.
English is my second language and ANSI etc is following a basic character usage. Everything must boil down to 0 and 1 in the end or American English.
It is a de facto standard and maybe knowing about it is as crucial as recognizing the difference between the imperial and metric system before heading for the moon. It is a life saver.