2700: Account Problems - Revision history

FaviFake at 13:28, 29 July 2025

2025-07-29T13:28:21Z

FaviFake at 13:19, 29 July 2025

2025-07-29T13:19:03Z

Lettherebedarklight: /* Explanation */ fix link

2024-02-07T01:24:20Z

‎Explanation: fix link

Jkshapiro: /* Explanation */ clarify relationship between the scenario described and the scenario in the strip

2023-10-05T14:24:59Z

‎Explanation: clarify relationship between the scenario described and the scenario in the strip

ChristmasGospel: Edit by ClassicalGames

2023-05-09T07:23:04Z

Edit by ClassicalGames

Hddqsb: Move "Trivia" section to after "Transcript" for consistency with other pages

2023-04-01T11:36:43Z

Move "Trivia" section to after "Transcript" for consistency with other pages

No Idea If There's A Character Limit LMAO: am i doing something wrong? THERE ARE TWO MANY JOKE TAGS!

2023-02-12T22:40:18Z

am i doing something wrong? THERE ARE TWO MANY JOKE TAGS!

Hddqsb: /* Trivia */ rewrite business network example added by @162.158.91.102. I found the original version hard to understand, I hope my interpretation is correct.

2022-11-24T13:06:23Z

‎Trivia: rewrite business network example added by @162.158.91.102. I found the original version hard to understand, I hope my interpretation is correct.

Hddqsb: /* Trivia */ rewrite emoji example

2022-11-24T12:55:09Z

‎Trivia: rewrite emoji example

Hddqsb: /* Trivia */ edit Unicode/ASCII example (loosely based on the changes from Special:Diff/299765)

2022-11-24T12:34:20Z

‎Trivia: edit Unicode/ASCII example (loosely based on the changes from Special:Diff/299765)

@@ Line 11: / Line 11: @@
 ==Explanation==
-[[Cueball]] asks [[Ponytail]] to help him because he can't log in to his account. Having attempted to fix [[:Category:Cueball Computer Problems|Cueball's tech issues]] in the past, Ponytail replies with dread. Cueball promises that "It's a normal problem this time", and Ponytail agrees to look at it. But then Cueball reveals that he has included a {{w|Null character|null string terminator character}} in his password when creating an account and now he can't log in.
+[[Cueball]] asks [[Ponytail]] to help him because he can't log in to his account. Having attempted to fix [[:Category:Cueball's computer problems|Cueball's computer problems]] in the past, Ponytail replies with dread. Cueball promises that "It's a normal problem this time", and Ponytail agrees to look at it. But then Cueball reveals that he has included a {{w|Null character|null string terminator character}} in his password when creating an account and now he can't log in.
 In computer systems, every {{w|Character (computing)|"character"}} (letter, digit, punctuation, etc.) is represented as an integer. For example the lowercase letter 'a' is represented as the number 97, and the digit '1' is represented as the number 49 (when using the {{w|ASCII}} character encoding or {{w|Unicode}} character encoding). A {{w|String (computer science)|"string"}} refers to a sequence of characters, and can be used to store arbitrary text (for example names, messages, passwords). Strings can be arbitrarily long, so some mechanism must be used to record their length. One approach is to store the length explicitly ({{w|String_(computer_science)#Length-prefixed|Pascal string}}). Another approach is to mark the end of the string using a specific character, usually the {{w|null character}} (which is represented as the number 0); such strings are called {{w|null-terminated string}}s, and are used by the {{w|C (programming language)|C programming language}}. Both approaches have advantages and disadvantages. A limitation of null-terminated strings is that they cannot be used to represent text containing embedded null characters. This is usually not a problem, because normal text never contains null characters. However, if somehow a null character were to end up in the string, it would cause problems: any code that uses that string would assume this null character marks the end of the string, so the string would effectively be cut off.

@@ Line 61: / Line 61: @@
 [[Category:Comics featuring Cueball]]
 [[Category:Comics featuring Ponytail]]
-[[Category:Cueball Computer Problems]]
+[[Category:Cueball's computer problems]]

@@ Line 19: / Line 19: @@
 It's unclear how that particular situation might arise in real software, but here is a similar situation that can easily happen in practice: Suppose a website's registration form allows the user's new password to have up to 20 characters, but due to a programmer error the login page only accepts passwords with up to 18 characters. If the user picks a medium-length password (say with 12 characters), all is well. But if the user picks a password with 20 characters, they will find themselves in the same position as Cueball, being able to register but not able to log in. Some additional situations are described [[#Trivia|below]].
-The title text describes a password which is "just" every Unicode character concatenated into a single string. {{w|Unicode}} is a standard for representing characters from many writing systems, and it has 149,186 characters[https://en.wikipedia.org/wiki/Unicode#Versions] as at the time of this comic (with new characters being added over time). A password consisting of all of those characters would be extremely long; it would be impractical to type by hand, and would be too long for pretty much all account registration systems. (A "codepoint" is the number assigned to a character, and {{w|UTF-8}} is a common encoding system for representing each Unicode codepoint as a sequence of {{w|byte}}s.) Also, since Unicode includes the null character, the password would have the same issue as Cueball's password. Further, if the account registration system treats the null character as a string terminator (as in C), then the password would be equivalent to an empty password (assuming it contains the Unicode codepoints in order, starting with the null character).
+The title text describes a password which is "just" every Unicode character concatenated into a single string. {{w|Unicode}} is a standard for representing characters from many writing systems, and it has {{w|Unicode#Versions|149,186 characters}} as at the time of this comic (with new characters being added over time). A password consisting of all of those characters would be extremely long; it would be impractical to type by hand, and would be too long for pretty much all account registration systems. (A "codepoint" is the number assigned to a character, and {{w|UTF-8}} is a common encoding system for representing each Unicode codepoint as a sequence of {{w|byte}}s.) Also, since Unicode includes the null character, the password would have the same issue as Cueball's password. Further, if the account registration system treats the null character as a string terminator (as in C), then the password would be equivalent to an empty password (assuming it contains the Unicode codepoints in order, starting with the null character).
 ==Transcript==

@@ Line 17: / Line 17: @@
 Account registration systems often place requirements on passwords in an attempt to encourage users to pick stronger passwords. For example, they might ask that the password include at least one "special character" (such as <code>!@#$%^&*</code>). Cueball misunderstood this requirement as referring to characters such as the null character (which is more accurately referred to as a {{w|ASCII#Control_characters|control character}}). Cueball managed to type the null character as part of his password somehow (on some systems it is possible to type the null character using {{w|Null_character#Representation|certain keyboard shortcuts}} such as <code>Ctrl</code>+<code>Space</code>, <code>Ctrl</code>+<code>@</code>, <code>Ctrl</code>+<code>2</code>, or <code>Alt+0</code> {{w|Alt_code|using the number pad}}), but the software running the registration system was poorly written and could not cope with this &ndash; it allowed him to create an account with that password, but then when he tried to log in with the same password the system didn't accept it.
-It's unclear how that particular situation might arise in real software, but here is a similar situation that can easily happen in practice: Suppose a website's registration form allows the user's new password to have up to 20 characters, but due to a programmer error the login page only accepts passwords with up to 18 characters. If the user picks a medium-length password (say with 12 characters), all is well. But if the user picks a password with 20 characters, they will be able to register but they won't be able to log in (which is what happened to Cueball). Some additional situations are described [[#Trivia|below]].
+It's unclear how that particular situation might arise in real software, but here is a similar situation that can easily happen in practice: Suppose a website's registration form allows the user's new password to have up to 20 characters, but due to a programmer error the login page only accepts passwords with up to 18 characters. If the user picks a medium-length password (say with 12 characters), all is well. But if the user picks a password with 20 characters, they will find themselves in the same position as Cueball, being able to register but not able to log in. Some additional situations are described [[#Trivia|below]].
 The title text describes a password which is "just" every Unicode character concatenated into a single string. {{w|Unicode}} is a standard for representing characters from many writing systems, and it has 149,186 characters[https://en.wikipedia.org/wiki/Unicode#Versions] as at the time of this comic (with new characters being added over time). A password consisting of all of those characters would be extremely long; it would be impractical to type by hand, and would be too long for pretty much all account registration systems. (A "codepoint" is the number assigned to a character, and {{w|UTF-8}} is a common encoding system for representing each Unicode codepoint as a sequence of {{w|byte}}s.) Also, since Unicode includes the null character, the password would have the same issue as Cueball's password. Further, if the account registration system treats the null character as a string terminator (as in C), then the password would be equivalent to an empty password (assuming it contains the Unicode codepoints in order, starting with the null character).

@@ Line 22: / Line 22: @@
 ==Transcript==
-:[Cueball carries an open laptop over to Ponytail, holding in in both hands. The screen shows a box filling the screen with some text on lines. Ponytail is sitting in an office chair with her laptop at her desk. She has turned her head away from the computer looking at Cueball's screen.]
+:[Cueball carries an open laptop over to Ponytail, holding it in both hands. The screen shows a box filling the screen with some text on lines. Ponytail is sitting in an office chair with her laptop at her desk. She has turned her head away from the computer looking at Cueball's screen.]
 :Cueball: Can you help me with my account?
 :Ponytail: Oh no.

@@ Line 20: / Line 20: @@
 The title text describes a password which is "just" every Unicode character concatenated into a single string. {{w|Unicode}} is a standard for representing characters from many writing systems, and it has 149,186 characters[https://en.wikipedia.org/wiki/Unicode#Versions] as at the time of this comic (with new characters being added over time). A password consisting of all of those characters would be extremely long; it would be impractical to type by hand, and would be too long for pretty much all account registration systems. (A "codepoint" is the number assigned to a character, and {{w|UTF-8}} is a common encoding system for representing each Unicode codepoint as a sequence of {{w|byte}}s.) Also, since Unicode includes the null character, the password would have the same issue as Cueball's password. Further, if the account registration system treats the null character as a string terminator (as in C), then the password would be equivalent to an empty password (assuming it contains the Unicode codepoints in order, starting with the null character).
 ==Trivia==
@@ Line 42: / Line 56: @@
 * The number of the xkcd comic is 2700. When interpreting this as two concatenated octal numbers \27 + \00 it represents both the {{w|End-of-Transmission-Block_character|ETB}} as well as the null character, both of these characters possibly leading to problems when processed in legacy systems (e.g. mainframe computers). When interpreting 2700 as hexadecimal 0x27 + 0x00 numbers it represents the ' character and the null character - a sequence that could lead to [[327: Exploits of a Mom|SQL injection]] when it is placed in unescaped form inside of a SQL command.
 {{comic discussion}}

← Older revision		Revision as of 22:40, 12 February 2023
Line 10:		Line 10:

	==Explanation==		==Explanation==
−	~~{{incomplete\|Created by a VISIBLE ZERO WIDTH SPACE. Please change this comment when editing this page. Do NOT delete this tag too soon.}}~~

	[[Cueball]] asks [[Ponytail]] to help him because he can't log in to his account. Having attempted to fix [[:Category:Cueball Computer Problems\|Cueball's tech issues]] in the past, Ponytail replies with dread. Cueball promises that "It's a normal problem this time", and Ponytail agrees to look at it. But then Cueball reveals that he has included a {{w\|Null character\|null string terminator character}} in his password when creating an account and now he can't log in.		[[Cueball]] asks [[Ponytail]] to help him because he can't log in to his account. Having attempted to fix [[:Category:Cueball Computer Problems\|Cueball's tech issues]] in the past, Ponytail replies with dread. Cueball promises that "It's a normal problem this time", and Ponytail agrees to look at it. But then Cueball reveals that he has included a {{w\|Null character\|null string terminator character}} in his password when creating an account and now he can't log in.

@@ Line 30: / Line 30: @@
 ** The password system accepts Unicode characters at first, but is later changed to only accept ASCII passwords. Users who included non-ASCII characters like é or ö in their password become locked out of their account because they are no longer allowed to submit those characters.
 ** Passwords containing non-ASCII characters are in general problematic, because it might not be possible to type them on the keyboard used for logging in. For example, on Mac OS a logged-in user can change their password to one that contains emojis, but the keyboard on the login screen does not have good support for typing emojis.[https://medium.com/@hvost/why-you-should-not-use-emojis-in-your-passwords-b8db0607e169][https://apple.stackexchange.com/questions/202143/i-included-emoji-in-my-password-and-now-i-cant-log-in-to-my-account-on-yosemite].
-** If, in the context of a business network, multiple systems with different password handling were set by the same central program that allows characters that some systems allow, but others don't
+** A business network may have multiple systems that connect to a central database of usernames and passwords. If the systems have different password handling rules, a user might find that some of the systems don't support their password (for example because the password contains a character which is forbidden on a particular system).
 * There are several techniques that can be used to safely handle passwords and other user inputs that might contain unsafe characters such as the null character:

@@ Line 28: / Line 28: @@
 * Here are some additional situations where passwords with special characters might stop working:
 ** The registration form allows passwords to contain null characters, but the login form strips null characters (for example because it was written by a different developer/team, or because it has been updated over time). When Cueball tries to log in, the login form strips the null characters, so the resulting password can ''never'' match such a stored password (which contains a null character).
-** The password system allows the input of Unicode characters at first, but is later changed to only accept ASCII passwords. Users who included non-ASCII characters like é or ö in their password are locked out of their account because they are no longer allowed to submit those characters.
+** The password system accepts Unicode characters at first, but is later changed to only accept ASCII passwords. Users who included non-ASCII characters like é or ö in their password become locked out of their account because they are no longer allowed to submit those characters.
 ** The password system allows choosing a password with Unicode characters at first, but the user is later on unable to enter those characters. Users who included non-ASCII characters like é or ö in their password are thus locked out of their account because they are no longer allowed to submit those characters. This was an issue that an Apple programmer encountered when they [https://medium.com/@hvost/why-you-should-not-use-emojis-in-your-passwords-b8db0607e169 set emoji as their log-on password for their Mac], only to find that for security reasons Apple restricts the keyboard on the log-on screen to the default keyboard, which is unable to enter emoji.
 ** If, in the context of a business network, multiple systems with different password handling were set by the same central program that allows characters that some systems allow, but others don't