Unreasonable Limit on Open Firmware Passwords

← Back to Stories (view on slashdot.org)

Unreasonable Limit on Open Firmware Passwords

Posted by pudge on Wednesday September 10, 2003 @03:44PM from the oh-yeah-there-are-26-letters-not-25 dept.

Lawrence Person writes "Well, this has to be one of the stranger bugs in recent memory: 'If you used Open Firmware Password utility to create a password that contains the capital letter "U", your password will not be recognized during the startup process.' Straight from the mothership. I'm guessing that not too many people use Open Firmware Passwords, but it's a very nasty bug for those who do. Props to the always great As The Apple Turns for pointing this one out."

27 of 82 comments (clear)

Enter password: by Anonymous Coward · 2003-09-10 15:50 · Score: 2, Funny

UR70457

....
hah! by revmoo · 2003-09-10 15:59 · Score: 4, Funny

My trusty password "god" triumphs again!

--
I would expect such blatant racism on Fark, but on Slashdot? Mods please ban this asshole.
1. Re:hah! by Anonymous Coward · 2003-09-10 21:43 · Score: 4, Funny
  
  [RegularStormy:~] miller% ssh 146.35.3.123 -l revmoo
  Enter password: god
  Welcome to Darwin!
  %
  
  ---
  
  Thanks!
Slashdot's running on a Mac, right? by NanoGator · 2003-09-10 16:00 · Score: 4, Funny

Hmm.. this explains why my STFU posts always disappear.

--
"Derp de derp."
Re:Care to speculate? by setzman · 2003-09-10 16:07 · Score: 5, Informative

Could it be the following (copied from here),
When turned on, Open Firmware Password Protection:
* blocks the ability to use the "C" key to start up from a CD-ROM disc.
* blocks the ability to use the "N" key to start up from a NetBoot server.
* blocks the ability to use the "T" key to start up in Target Disk Mode (on computers that offer this feature).
* blocks the ability to start up in Verbose mode by pressing the Command-V key combination during startup.
* block the ability to start up a system in Single-user mode by depressing the Command-S key combination during startup.
* blocks a reset of Parameter RAM (PRAM) by pressing the Command-Option-P-R key combination during startup.
* requires the password to use the Startup Manager, accessed by pressing the Option key during startup (Figure 1).
* requires the password to enter commands after starting up in Open Firmware, which is done by depressing the Command-Option-O-F key combination during startup.

Doesn't mention the U key in the features list, but I'm going speculate that something in the keyboard handling code is buggy...

--
C:\>
Speculation by Mikey-San · 2003-09-10 16:08 · Score: 4, Interesting

It sounds like this isn't a bug in Open Firmware (thankfully), but Apple's OF Password app. If so, we just need to wait for an update to the app, and can still set passwords with "U" manually.

Does anyone have more info regarding where this bug originates?

--
Mikey-San
Karma: +Eleventy billion (mostly affected by watching Celebrity Jeopardy)
1. Re:Speculation by Mikey-San · 2003-09-10 21:00 · Score: 4, Informative
  
  Ask and ye shall receive.
  
  http://www.securemac.com/openfirmwarepasswordpro te ction.php
  
  --
  Mikey-San
  Karma: +Eleventy billion (mostly affected by watching Celebrity Jeopardy)
Um...I figured out why 'U' by Anonymous Coward · 2003-09-10 16:08 · Score: 5, Funny

Note the linked article How to setup up password protection
Among other things, it:

blocks the ability to use the "C" key to start up from a CD-ROM disc.
blocks the ability to use the "N" key to start up from a NetBoot server.
blocks the ability to use the "T" key to start up in Target Disk Mode (on computers that offer this feature).

Posting this anonymously, since I don't want to be known as the one who figured this out.
I know nothing about Open Firmware, but: by jazir1979 · 2003-09-10 16:10 · Score: 2, Insightful

Do you need your password to be accepted in order to change the password?

The "solution" in the article is to "change your password if necessary". But how do you change your password when your previous password is not accepted?

--
What's your GCNSEQNO?
Can't spell 1234 with a "U" by one9nine · 2003-09-10 16:12 · Score: 4, Funny

I pity the fool who has a wife or daughter named Ursila. :-(
careful, now by Tumbleweed · 2003-09-10 16:23 · Score: 2, Funny

That may be Praetorian code. I wouldn't mess with it.
Blame SCO. by FFFish · 2003-09-10 16:26 · Score: 4, Funny

They're the ones that want to claim copyright on that letter, so that talking about *nix requires paying a licensing fee.

It also means we can't call them a b*nch of motherf*cking f*ckwits, which is a real shame.

--

--
Don't like it? Respond with words, not karma.
Re:Alrighty men.. by YouHaveSnail · 2003-09-10 16:45 · Score: 5, Insightful

No, wait. This is Apple, not Microsoft. Bugs like this are acknowledged, with workarounds and/or patches supplied quickly, and this gives the company character and credibility.
The solution would be by coolmacdude · 2003-09-10 16:51 · Score: 3, Informative

to just reset the password. Easily accomplished.

--

-You may license this sig for only $6.99.
1. Re:The solution would be by coolmacdude · 2003-09-10 19:01 · Score: 4, Informative
  
  Why was my post modded overrated? I'm serious. All you have to do is take out or install new ram, (basically just change the amount of ram in the machine) and then reset the PRAM 3 times. That clears the Open Firmware password.
  
  --
  
  -You may license this sig for only $6.99.
2. Re:The solution would be by shawnce · 2003-09-11 07:57 · Score: 2, Informative
  
  Well you can use strong encryption to protect critical data even in the case of lost physical security (which you are correct about).
  
  In Mac OS X 10.3 you will have the ability to have your home folder encrypted (using AES-128). Other OSes have similar features. ...of course given time even strong encryption will fail you.
Re:Alrighty men.. by HiredMan · 2003-09-10 17:05 · Score: 4, Interesting

Microsofy story of the day - yet another hole that will get you owned that we're disclosing and patching after years of vulnerability.

Apple story of the day - bug disallows a certain character in little used Openfirmware password.

Slashdot spin - both platforms have bugs. Fair and Balanced - Slashdot News! ;)

=tkk

--
Bill Gates - Creationist?!?
Isn't it obvious? by the+darn · 2003-09-10 17:32 · Score: 5, Funny

This is clear evidence that despite its user-friendly appearance, deep down, Apple hates U.

--
Ceci n'est pas un post.
Did anyone see the artnum? by tuxedobob · 2003-09-10 19:36 · Score: 5, Funny

The article number for this was 107666. If that's not clear proof that Microsoft was somehow involved, I don't know what is.

Um, I need something for the 107 part...

Waiting to see if this gets modded flamebait or funny... ;-)
Re:Care to speculate? by colinleroy · 2003-09-10 21:50 · Score: 2, Informative

U is ASCII 0x55 (85 dec), which is 01010101 in binary. Maybe.

--
blah
Re:Care to speculate? by TheRaven64 · 2003-09-10 22:23 · Score: 3, Funny

What's a 4-letter word for a woman ending in "UNT?" :D
Aunt!

--
I am TheRaven on Soylent News
Re:Alrighty men.. by TheRaven64 · 2003-09-10 22:28 · Score: 3, Funny

ready PITCHFORKS!
You don't need to bother. Being based on FreeBSD, OS X comes with its own pitchforks.

--
I am TheRaven on Soylent News
This is why I hate geeks by oni · 2003-09-11 01:31 · Score: 2, Funny

See, why does everything always have to be about U?
huh?

Stupid geeks!
Wonder about other OF computers by downix · 2003-09-11 05:51 · Score: 2, Insightful

I wonder if this problem exists in my Open Firmware based Pegasos machine.

--
Karma Whoring for Fun and Profit.
Not just the U character by rtm1 · 2003-09-11 06:10 · Score: 2, Interesting

This bug happens to other characters too. I once set an open firmware password with the character '{' in it, and OF wouldn't take it at boot time. The lowercase '[' worked fine though.
I think this is a problem with the Open Firmware Password application using a different character set than Open Firmware itself. So some characters you can type in the OF Password app you can't type in OF itself. Or maybe OF just doesn't like the shift key...

--
"Belief means not wanting to know what is true." [Nietzche, The Anti-Christ, 1889]
Probably an easy solution for this question by Anonymous Coward · 2003-09-11 06:18 · Score: 4, Insightful

The value $AA is used to "encrypt" the password in OF. Every letter in the password is obfusticated via XOR with this value.

'U' = $55 XOR $AA = $FF (and this is probably used as a end-of-password marker).
nreasonable Limit on Open Firmware Passwords by yet+another+coward · 2003-09-11 08:39 · Score: 2, Funny

Just to be safe, I suggest changing the story title.