Emojis are known to break systems in certain circumstances due to the way they're interpreted in certain character sets.
I guarantee people doing this will not only lock out their own accounts, but may even freeze some authentication servers.
https://www.pcmag.com/news/want-to-brick-an-iphone-send-some-emojis
The website should feed your password straight into a well known hashing algorithm or key derivation function that has undergone a decade or more of careful scrutiny, without any other processing. The output will usually be a fixed length base64 or hex string.
There's a short list of about three options that are currently considered acceptable, and a few more are probably fine but are a little too easy to crack these days (e.g. anything that shares the same math as bitcoin… what if someone throws a mining datacentre at your password?)
If the site breaks, maybe you don't to be a customer of that service.
Can you still log in to wellsfargo accounts using the T9 translation of your password?
make one account with emoji password to test their system, if it break, good, go create hour account somewhere else
It's not the processing on the server that's the problem. To reach the server the password needs to go through several layers of character encoding, if any of them fails the server will receive something different from what you meant. And when you try to login from another device and the layers will be different you'll effectively be sending a different password.
The same character encoding that would break emoji would break a significant portion of the words names, so if your system can't handle it, then you deserve all the trouble that you run into.
Unicode isn't that hard.
It's not the 90s anymore.
auth servers breaking from emojis would be hilarious, pretty sure that's why older auth servers only allow certain symbols in passwords
"Your password '🤣umådbrø⁉️' is breaking our server. Please change it."
"Of course. What is the server's root password?"
If some auth server breaks because I put emojis in my password then that's right and deserved
Sounds like a crappy implementation of the authentication server then, and the sysadmin deserves a paddlin' for not stripping non-UTF characters (or making sure they work).
My problem with using emojis as part of the password would rather be that while I might be able to enter them on my personal Android phone using the exact keyboard app I have installed right now, I might find myself struggling on a desktop computer or any other phone that doesn't have this exact keyboard installed. After all, the graphical representation of the same emoji might look different there, and there is a chance I couldn't even recognize it.
So if anything, I'd say use a non-UTF keyboard like Thai or Chinese, but then a standard character in that specific type. Keyboards layout can be installed across devices and are fully standardized, even if the same character looks slightly different.
Stripping characters from passwords, great idea! Right up there with truncating passwords that are too long.
Not from passwords, from password fields. In the same way that ", ' and various types of brackets can't be used since they could be used for code injections.
That's not how any of this works.
First of all, stripping passwords is never okay. You can reject the password and let the user choose a new one, but never just modify it on your own.
Then, if your system is at risk of code injection by certain characters in user input, please just shut it down and never turn it on again.
Doing that is actually a great way to tell attackers that you're vulnerable to that type of attack.
Bypassing those front end restrictions is super easy, and the attackers don't need an account or a password to attack you.
It's like putting a sign that says "lock fragile; don't tug" on the door to your business.
Learn how to sanitise your database inputs first, damnit!
also some OSKs put whitespaces after inserting an emoji, some doesn't. there's no unified emoji input method yet.
There's no such thing as a non-UTF8 character. You mean non-UTF8 bytes? If a system sees those, it should reject the entire input, not try to patch it up.
OTOH, there is only one character set that matters, and any system using a different one is, by that fact alone, broken.
I said only one that matters. So I already did pick one. It's called Unicode.
UTF-8 and UTF-16 pretty much do everything, but if you have a UTF-16 emoji in a UTF-8 system, you'll have a bad day. :(
Those are encodings, not character sets.
IANA calls them character sets, it's literally in the URL twice, that's good enough for me!
and there are many trash implementations that dont recognise something like :emoticon: as shortcut and turn it into emoji, no no you have to use emoji keyboard to type them
deleted by creator
That only applies to iphones that came out 2016 or earlier and we're never updated right?
Hahaha, I wish.
You would be amazed at how ancient and poorly maintained many web servers are on the modern internet. SQL injection still consistently make the top 3 web app vulnerabilities as of 2021. If that isn't being sanitized properly I don't expect emojis would be handled much better.
Thanks I wasn't aware of that
For that particular bug, yes, but there have been many other variations on that theme and not limited to Apple tech. I've seen it nuke an email send for example because the SMTP server choked on emojis placed in a subject, to, or from line.
Thanks I appreciate the clarification
💯🐴🔋(umm, staple)
Correct horse battery staple!
But was it a 💯 or was it a ✅? Damn neither. Let's try with 👍…
100 horse batteries
Jeez, you're right. We got pens, pencils, stock charts, even those folders with the colored label tabs, but no stapler, the most basic of office equipment.
When it's added, I expect most implementations will make it red.
I want it to be pregnant
Preganant?
If a women has starch masks on her body does that mean she has been pargent before?
¿Preganté?
Hopefully it's compatible with skin tone modifier.
Good luck logging in a Smart TV.
Security Experts probably don't log into smart tvs all that often. Just a guess.
Sorta how car designers never have to actually fix cars.
But why wouldn't it make sense to need to pull the cab off of a pickup truck to change the spark plugs?
Car expert
Well how about my paddle car
That's true for all car designers. You're referring to the shitty designers, though.
Architects don't get involved in the actual construction of a building either.
Oh they do. They come to tell you that the safety protocols you've implemented are interfering with their design.
They'd prefer it if it looked pretty and then just fell down and light breeze thank you very much
Logging in a smart tv? Lol!
All the apps I've used recently use QR codes (or similar measures, like a sync code) that has you log in from the phone, so it should work anyway!
But not all apps, sadly, I just experimented it with Crunchyroll, and saw my dad struggling with a crappy app called Vix yesterday.
Fair enough. I'm mostly using "big ones" plus SmartTube.
In my experience the only one that works with any degree of reliability is YouTube. Even the Netflix one can be fairly intermittent.
Also a lot in the time you'll go away and the hotel you're in will have a smart TV and the software was last updated in 2011 so you have to sign in on the device.
Scan the QR code and log in on your phone. Oooh scary
I've had to manually type in passwords on a TV several times in the last few months because sometimes the login for even the biggest brand-name services is just broken.
Terrible idea, good luck logging in on desktop.
You know there's someone somewhere who would answer you with, "what's a desktop?"
Listen here, you little shit
Here is an alternative Piped link(s):
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
Dammit I'd forgotten that awful commercial. Angry upvote.
I'm still in denial 😅
I began feeling old when re**itors started calling their site an 'app'
You can say Reddit it isn't blasphemous
deleted by creator
Wait, you can't type emoji on your desktop? I feel sorry for you. 🥺
I have no idea how you could either. I don't know how to create them with s keyboard
Winkey + .
Works on Windows and some Linux distros by default
Firefox has an addon that opens up an emoji panel.
For Windows 10/11, its win+; to open the emote window.
Cmd+Ctrl+Spacebar on Mac
Huh! TIL ☺
That doesn't work on the desktop last I checked.
But it's actually possible to set a password with emojis anyways (or at least for domain accounts). I successfully logged in on a VM using the Hyper-V window and pasting the emoji from the host. You can also name an account a single emoji and windows actually handles it decently. It's very likely to break a lot of programs though.
Its worked on desktops for years and works right now. As someone else pointed out "win+." works as well. Or maybe its supposed to be the only way it works and mine is bugged? Idk. I found it via trying to lock my desktop and mistyping.
It worked on my desktop
😁👍╰(°▽°)╯
Works even in notepad on Windows 11, lol
Oh I meant the lock screen, sorry. As far as I know it works everywhere except the lock screen.
oh, I never tried. There goes that option. Wonder if that was intention to prevent people from trying to use emoji passwords because they didn't trust windows to handle it.
It's probably just because the emoji panel is a program and the lock screen has very limited or any capabilities to run any programs. And trying to make it the emoji panel to function on the lock screen is pretty much a waste of time anyways.
It's Windows logo key + . (period).
Both work for me and I haven't messed with the keybindings for it.
Who needs Reddit when people like you are here on Lemmy.
Under Windows press Win+.
Security expert reveals surprising way to induce headaches
Security experts don't actually have to work on corporate IT systems.
So you've set your password to contain a 😇 have you?
Ok so how are you going to type it on this desktop computer keyboard here…
Yeah I thought not.I'll just go reset your password shall I?
win+.(works on kde too afaik…?)
xkcd still has the best approach to this; four random common words
I like doing entire phrases with some rhymes thrown in. Makes it easier to remember them.
"BonyTonyMoansHe'sOnlyGrownLonely" has a shitload of characters, and a full sentence (even a nonsensical one like that) is more memorable to me than a random handful of disparate words.
The more ridiculous, the better. (And, naturally, don't forget your numbers and symbols)
EDIT: Actually, no idea why I made it all one group of words. So long as spaces are in the password's character space (and they very well should be if friggin' emojis are), there's nothing stopping you from doing an entire, punctuated sentence- other than that we've been conditioned not to think of a password that way.
"Skinny Kenny's friend, Mini Ben, has 20 chins." That should be a fully-acceptable password with 46 characters (48 if you add the quotes), capital letters, numbers, and special characters.
You can't compare a 46 random character password to a password composed out of words, the entropy of each is very different. Your kind of password is vulnerable to dictionary attacks which are way more common and easy than brute forcing every possibility. A 50+ characters unique random password for each service that is stored in a password manager which is encrypted with a 20+ characters random password is the most secure and future proof (for now).
If the attacker doesn’t know that you’re using a dictionary password, then dictionary attacks probably won’t be their first choice. I want to remember these passwords across devices and on guests.
Like someone else said on this thread; that's just security by obscurity, which is bad. Dictionary attacks will be one of the first (brute force related) attacks attackers will use because word passwords are incredibly popular (though admittedly of fewer words: VeryBigDog34 etc…), and relatively easy to do. I agree that having the password across different devices is somewhat of a challenge with a password manager, but not impossible. My very long and complex password is all down to muscle memory by this point, I couldn't tell you what it is from memory.
Also you shouldn't use the same password on multiple things and if you don't use a password manager you will need to memorize a lot of different passwords.
I love it, Bitwarden has supported generating passphrase style passwords for a while and it's basically that. It's my go-to these days.
Four words is too low these days to protect against gpu bruteforcing
Got a source on that?
Edit: plus brute forcing is just one scenario. I think the xkcd comic refers to using passwords in online services, and those usually have some sort of rate limiting.
https://thesecurityfactory.be/password-cracking-speed/
8 character a-zA-Z is 45 bits of entropy (log2(56^8), about the same as the XKCD password if you take from a 2048 word list. That's crackable in a minute on AWS.
Password hashes get frequently stolen, don't rely on rate limiting if it's something you really care about.
Here are the dice ware recommendations on the number of words: https://theworld.com/~reinhold/dicewarefaq.html#howlong
Sure, but the average English speaker knows way more than 2048 words. Let's not forget about case sensitivity, made-up or "inside joke" words, names, and specific industry vocabulary.
Even if you take four words of a 30000 word list (quick Google says that's the number of words an average person knows), that's still less bits of entropy than a 5 word diceware password (7776 word list). People are also really bad at randomness, so your own string of random words is likely going to be much worse.
Thanks for the explanation. What's diceware?
It's the concept of literally using a die to choose with randomness (humans are terrible at trying to be random); a link with details is in a previous comment.
That only works if someone already has access to a system's password database.
Just be sure to throw in symbols and numbers to beef it up. Dictionary words are easier to brute force.
The whole idea is to make it easier for humans to remember and more difficult to brute force. Long passwords are much harder to brute force than complex passwords with lots of special characters. And they're a lot easier for humans to remember.
There are enough words in any language that it's virtually impossible to guess the correct four words, even if they're in the dictionary.
Even so, most password requirements will force you to add them anyway. Quick way to do it is to just pick a number on a keyboard and add it and the symbol to the end. e.g HorseBattery2# and so on.
And requirements like that are why my password strengths are completely out of whack:
- Random websites get 24 randomly generated printable characters stored in my password manager. This is essentially unbreakable with conventional methods and can easily be adapted to fit whichever counterproductive rules the website enforces.
- My password manager and my home computers get memorable but long phrases. A particular favorite is to start in the middle of a line from a song and continue from there. Nobody's going to guess "make you swear and curse when you′re chewing on" but it's easy to memorize of you already know the song. Even a dictionary attack is going to have trouble with that many words.
- My work accounts get the bare minimum that complies with whichever rules the admins came up with. Numbers, special characters and mixed capitalization? No thirty letter phrase for you, then; you'll get the minimum eight characters so I have a chance of memorizing the thing. Regular password changes? Great, now the last two chargers are going to be incrementing digits, just like for everyone else.
There's a reason why experts these days argue against anything but minimum length restrictions.
You can even make a complete sentence that makes sense with symbols and numbers.
"Ronaldo doesn't grill 76 Canadian Tacos."
Or whatever
Not 4 of them in a row. Keep in mind the attacker doesn't know " look for exactly 4 words"
That's just security by obscurity. It's one other strategy of choosing passwords that a bruteforce attack is going to try if it gets popular
That's not what security by obscurity means. And going by your definition, all passwords are security by obscurity.
I prefer picking a sentence or so that has meaning to me, using the first letters, and then adjusting for numbers/symbols. So if I wanted to make that a pw, it'd be 1ppa505thm2m,utfl,atafn/5. -looks completely unintelligible, but as long as you can remember the sentence and have some ideas of how you would have encoded it, easy enough to remember/recreate.
good luck remembering all of those for every account you create, though.
Why are you not using a password manager
If you're using a password manager you don't need phrases you can remember, you can generate even more secure passwords. Or start using passkeys.
I want cross-device
Most are cross device. Use bitwarden
Guest machines too. And I sorta prefer whichever browser/OS I’m using’s implementation because they’re usually styled similarly.
I am, and I'm not jumping through hoops of making up a password sentence for every new website. I let Bitwarden take care of that for me.
Just use these methods for the pws you either need to know (like your password manager) or don't want stored for whatever reason, like your bank. Otherwise, yeah, just let your password manager generate a password for whatever site.
It's as easy to remember a bunch of those as it is remembering 4 random words with no association, I think. And besides, just use that for the big, important, pws like your pw manager.
Password database
I'd rather staple my forehead to a telephone pole before I ever think about using an emoji in a password. Those things are abominations!
Out of curiosity, what makes you say so?
Edit: Oh. Did a "Wooosh" happen to me right now? Are you being ironic and referring to the XKCD thing about how to make a secure password using words in phrases?
I think OP is conflating the use of emojis in passwords with the use of emojis by the general public.
Yes, it's annoying to read stuff like "Hi 😃😃😃😃 I am Bob ♥️♥️♥️😎😎😎😎," but that doesn't mean that using them in passwords is a bad idea.
Or that "hi 😊 I'm Bob" doesn't express a (subtly) different meaning to "hi, I'm Bob"
deleted by creator
I can agree with you. I'm curious what these reasons are, though?
Well they have to be the same on different devices, like you log in to Lemmy on your PC and then on your phone. Also sometimes it seems the icons change, or there are new ones and maybe old ones are removed …
Emojis are standardized. They may look different in different devices, but the code of a "raised hands" emoji will always be the same, just like the code for A is always the same.
Removing old ones could be a problem, though.
What if I am using a device that doesn't support emojis? wouldn't I need to learn the code for each emoji I have used in a password?
That's a good question, and yeah, I guess you'd either avoid using emojis or accept the fact that they're not universally supported.
Having said that, some people use non-ascii characters in their passwords, such as Πwhich is a valid letter in some alphabets, and they'd run onto the same issue.
Yes
But how many modern devices don't somehow support emojis though?
And how many of those you need to enter a password in?
Just like a gun is standardized to a water gun for some and a real gun for others?
Edit: I get your point, ita just if you memorize your password with emoji icons different icons would screw up your tries to log in
If you search for "gun" in your device when selecting an emoji, just pick whatever comes up. Done.
Because they're a major pain to type, except for the most common ones?
👆
Oh for fuck's sake, just turn on 2FA
Until you get to a prompt that doesn't support unicode.
Sounds great where it works but I'm sure most systems would reject an emoji or make you type out some overly complex password in addition to your emoji.
Honestly you'd be surprised how many places it just works magically. I was surprised to find that Office365 users could use emojis in names for Microsoft Teams which had no problem syncing those accounts back to an on-prem Active Directory. You can use emojis to name a whole SQL database, let alone users/passwords on it.
I keep wondering if I need to figure out how to turn that off but it hasn't caused any problems. It's definitely sketchy looking though when you see a bunch of normal usernames and then suddenly one is just ten snowman emojis in a row.
Emojis are just a string of special characters that get recognised and replaced by an image anyway. It is the same as using those special characters separately.
It's all just Unicode so in theory a password system shouldn't think that emoji or any more interesting than any other character. To a computer the letter B and the emoji ✈️ equivalent in that they're both just normal characters that one can type.
Sort of, emoji are usually treated as two or more normal characters so ✈️ might be equivalent to BB. But the basic point is the same.
What's up with all the hate for emojis lmao
People who use them tend to spam the hell out of them. Like, 8 of the same emoji. And they use them every other sentence. It's obnoxious, you only need one or two to get the point across.
💀💀💀💀💀💀💀🗿🗿🗿🗿🗿🗿🗿🚣👍👍👍👍👍👍🔥🔥🔥🔥🔥🔥🔥 sigma
the emojis and text above are a part of the reason
Whats the boat rowing used for typically ?
Traversing water using manual propulsion
Don't act like you don't already know, pervert.
😠 I hate it when people do that because the emoji don't mean anything. Like I can use a single emoji to actually relay some information but just putting a bunch of them doesn't do anything.
well that just sounds like you don't like immature content/people
Back in my day we only had 95 printable characters, and that's the way we liked it! /s
Antisocial people.
It was the same on Reddit. All of the people who despised emojis were often posting in really cringe and incel related subs.
My use of emojis sky rocketed after I started dating. They are fun and convey emotion really well.
I'm convinced emojis are what has been missing from language for a long time. They are great way to portray emotions through texts, which otherwise could not be achieved.
This way there is a difference between:
"You are so amazing 😁👍"
and
"You are so amazing 🙄 "
"You are so amazing 🙄 "
Greatest put down ever.
deleted by creator
If I'm going to be relaying through to people strictly over text as much as I do these days, I better have a way to articulate it with the right emotional range to match my sparkling personality ✨
🤣
🍆✊💦🍳
😔
They didn't exist yet when I was an early teenager, all we had were emoticons that might be replaced by images by the forum software, so of course I think they're stupid /s
Without sarcasm, it is a good thing we have standardized symbols now and don't have to implement emoticon replacement into forum or chat or social media software. If only because half of such implementations replaced any occurrence of the number 8 followed by a closing parenthesis with 😎 even when that wasn't the intended meaning (one can think of many other times one would end a parenthetical statement with the number 8).
…no
Can you write any unicode cahracter? Gotta make passwords in cuneiform
(👁 ͜ʖ👁) 𓂺
-The most secure password
Wingdings for life baby!
Wingdings is a font.
That was a joke. There now we both said something that was plainly obvious.
Last week or two I've been learning more about passkeys, and it makes threads like this seem ridiculously out of date. Given the choice between emojis and passwords and hard crypto, I'll take the crypto.
I'm not sure what the passkey advantage over long unique password in a password database is.
Well, KeepAssXC just got passkey support so I guess it doesn't matter much
With passkeys, your browser and the website exchange a public-private key pair then make up long random one-time "passwords" every time you login but only use them to check they each still have the right key.
I guess I'm gonna need the answer spoonfed to me. I think I understand how the tech works but I don't understand the advantage over a complex non-reused password. Maybe keyloggers, if it's one-time thing?
The advantage - from my very incomplete understanding - is that your passkeys cannot be phished or stolen from you. So only you from your device can log-in to the site. Which leaves me with the question, how cross-device passkeys work.
There are different ways.
One way is to use an encryption module on the device that, rather than storing the keys just encrypts the keys and holds an encryption key that you can't extract, and can do various crypto operations.
Now you ask the module to do a secure key exchange algorithm with the new device, meditated by a party the module trusts, like apple or something.
Now both devices share a secret key, and they trust that the other is owned by the same user because the owner verified with apple who then signed the exchange messages.
Old device decrypts with the old key, and encrypts with the new key, never letting the data leave the secure module. Send the data to the new device which can do the reverse, and both devices forget the shared password.Overall, minor weaknesses like storing keys in the cloud encrypted by a key derived from a password that the cloud never sees, while objective weaknesses, are still significant net improvements to security over passwords.
Thank you for explaining. That's a thing most sites leave out: tell people how the keys cannot be stolen while still working on a different device.
That would be a really nice advantage but yeah, I wonder how cross-device passkeys or recovery passkeys would work
There are lots of advantages:
- No need to worry about password encoding, like this emoji debacle for example. Actually there's no need to worry about passwords in general anymore, no more worries about lenghts, encoding, character space, remembering them etc.
- It eliminates that scam where attackers set up a site on a domain that looks like the correct one, because the domain is part of the protocol.
- It eliminates phishing for 2FA because login only works on your device anyway and there's nothing you can be tricked into giving away to an attacker.
- If attackers break into a site and steal the public keys they can't use them for anything.
- Since the whole process is automated between servers and browsers and also standardized, it can be upgraded seamlessly and continously, you can upgrade the protocol, the key lengths, the encryption cyphers etc. with zero impact for the user. New upgraded versions can be distributed to both servers and browsers and they'll just use the highest version they both have.
- 2FA is a core part of the protocol, but again in a way that eliminates phishing: it's basically a way to unlock access temporarily to one specific key in your key vault. You can use a master password, or an USB key, or TOTP codes, or biometrics (fingerprint or face) etc., but NOT cellular texts (SMS) anymore because the vault stays on your devices, no need for another party to send you anything.
- Syncing your vault online and over multiple devices, as well as backup, are also a core part of the approach and will eliminate the worry that you drop your phone and you're screwed forever.
The downside is that there's been a whole bunch of tools and apps and services built around passwords for decades and converting all that mass to passkey tools will take a bit.
There are some other tradeoffs like, right now for example I can reasonably print all my passwords and TOTP codes on a few sheets of paper and achieve an "offline" backup in case of untimely death and so on, it's going to be a bit more cumbersome with passkeys. But I expect there will be ways to optimize that as the technology evolves.
Passkeys, under the hood, use a way of proving your identity that doesn't require you to actually send your password, and also doesn't require you to send your username either.
Because of how it's implemented, the system managing the passkeys also gets to authenticate that the website is who it says it is.So no private data actually gets sent anywhere, but you can prove your identity while also checking the identity of the site you're talking to, like the SSL lock icon but automated. It's often implemented such that the device that holds they keys can't actually have them stolen from it, and it's integrated with a biometric sensor.
This means it's possible to have a high degree of confidence that the person logging in is physically the same person who created the credential, and not just someone who had their password stolen.The final perk, is that if you're using something like a phone with a fingerprint scanner, passkeys work as two factors of authentication, despite only feeling like one.
Because the phone verifies your identity via fingerprint (something you are), it can then unlock the key that is uniquely available to the phone (something you have).Combine that with being generally easier to use, and it's pretty clear why most security experts are pushing them. Security that users will use is better than security they won't, and finally we have easier to use security that's also better than the more difficult options.
What's crypto?
Well you see there's this thing called the Blockchain, it's like a ledger…
Man, I sure wish I could get on the ground floor of this exciting new technology as an investor.
Might be too late for that, but BOY do I have a bridge to sell you!
You're kidding. A real-life bridge!? You can own those!? Name your price.
Yes!
You can even change it into a toll road and return your investment in no time!
Cryptography
this feeeels like the stupidest idea ive ever heard… its not like theres really an emojii standard applied as universally as text, across devices or applications… the transforms that happen… this seems fraught with terribleness
am i missing something?
Emojis are standardized exactly the same way as text is, both are defined by the unicode standard. They might not be rendered uniformly, the same way that text rendering depends on the font.
If this isn't satire, that's literally what Unicode and UTF-8 are
I thought Emojis were a set standard but how they're rendered can change. So whatever it is that identifies the heart emoji is universal but iPhone, Samsung, Google, etc might render that heart differently.
How they're rendered is a set standard now too. For example there was a bit of an issue where the gun emoji could be a water pistol pointing left or a revolver pointing right… and when it was combined with a person emoji… that could lead to… issues. It's a water pistol everywhere now.
I didn't know that, thanks
You mean Apple changed it to a water gun and everyone followed suite as to not have an issue?
Thanks, America, and your mass shootings.
Although I agree it is risky, emoji are unicode characters, just like any other unicode character. If, and that's a big if, the programmers do their job right, it shouldn't matter if you use an emoji or a random kanji. It's all just another character. That said, I don't trust programmers enough to run the risk. Your password might work fine on the website but then fail on the mobile app.
Someone else said "good luck on the desktop", but Windows actually has an emoji picker built right in. Win+. will bring it up. Another fun fact, usernames and computer names both support the full unicode set on Windows, including emoji. Some fun can be had with that knowledge. I haven't tried it on Linux or MacOS yet.
Yes there is,
. I would say most modern devices/systems utilize it too. The reason they may look different from device to device is because the presentation style can be modified by vendors, somewhat similar to using different fonts to make letters look styled.
