When I tried to include the [taco] Unicode characters in the headline to this post, it cut off the headline. Supporting Unicode isnt easy, and often, to avoid security issues arising from Unicode, it is removed or outright blocked.
But in particular, mobile devices make it easy to type Emojis or other Unicode characters. As a security guy, my next question was if I can use them as part of my password. The quick answer: support varies… and dont count on it.
One issue I was a bit worried about is that multibyte characters often include the 0x00 byte. This can cause issuessince the 0x00 byte is often used to terminate strings. So I set up a quick test page to figure out if any of the PHP or MySQL hashing functions are susceptible to this issue. the Smiley character, for example, has a code of 0x1f600. The 00 byte could terminate the string, and all passwords starting with the Smiley character would result in the same hash. My initial testing hasnt found any issues like this, but I think this is an area that does require a bit more testing, in particularif a salt is added to a password prior to hashing.
If you want to play, I setup a quick test page with various PHP and MySQL hash functions: https://isc.sans.edu/emojitest.html
(and while you play, I will see if I can make the diary editor emoji capable-) )
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.