Slashdot Mirror

← Back to Stories (view on slashdot.org)

Apple Security Blunder Exposes Lion Login Passwords In Clear Text

Posted by samzenpus on from the whoops dept.

An anonymous reader writes "An Apple programmer, apparently by accident, left a debug flag open in the most recent version of its Mac OS X operating system. In specific configurations, applying the OS X Lion update 10.7.3 turns on a system-wide debug log file that contains the login passwords of every user who has logged in since the update was applied. The passwords are stored in clear text."

2 of 205 comments (clear)

  1. Re:lucky for me... by Sancho · · Score: 5, Interesting

    Some "strange" reason?

    How about you've got multiple users on the machine? With Filevault2, any user can unlock the whole disk. As much as I like macs, it's a complete joke. With Filevault1, you had homedir encryption on a per-user basis. My files were secure from other users of the machine.

  2. Re:Great by icebraining · · Score: 5, Interesting

    You obviously have no fucking clue of what you're saying. If you hash the pass before sending, then what happens if someone sniffs the connection? They can just send the hash!

    The hash effectively becomes the password.

    So no, it doesn't increase security. But you know what does? Two-factor authentication. And do you know what big consumer oriented company start offering those first? I'll give you an hint.

    --
    Dilbert RSS feed