If macOS High Sierra shows your password instead of the password hint

#1

Post by 0x0 » Thu, Oct 05, 2017, 5:38 PM UTC

If macOS High Sierra shows your password instead of the password hint
support.apple.com

Re: If macOS High Sierra shows your password instead of the password hint

#2

Post by egb » Thu, Oct 05, 2017, 5:48 PM UTC

I so wish Apple had not removed the older Sierra installer from the Mac AppStore... I need to update some machines but High Sierra does not seem ready for reliable use yet.

Re: If macOS High Sierra shows your password instead of the password hint

#3

Post by chmars » Thu, Oct 05, 2017, 5:51 PM UTC

Description:

'If a hint was set in Disk Utility when creating an APFS encrypted volume, the password was stored as the hint. This was addressed by clearing hint storage if the hint was the password, and by improving the logic for storing hints.'

https://support.apple.com/en-us/HT208165

Re: If macOS High Sierra shows your password instead of the password hint

#4

Post by wallnuss » Thu, Oct 05, 2017, 5:52 PM UTC

how??! In what context does a clear-text password end up anywhere, except as the input for a hash function.

Re: If macOS High Sierra shows your password instead of the password hint

#5

Post by maxton » Thu, Oct 05, 2017, 5:52 PM UTC

It's rather frightening that a bug as serious as this one got past Apple's QA. It seems like the list of known problems with the new Disk Utility is growing - recently there was a submission about how High Sierra's Disk Utility did not show unformatted disks.

Re: If macOS High Sierra shows your password instead of the password hint

#6

Post by pi-err » Thu, Oct 05, 2017, 5:53 PM UTC

egb wrote: post #2

I so wish Apple had not removed the older Sierra installer from the Mac AppStore... I need to update some machines but High Sierra does not seem ready for reliable use yet.

If you haven't updated yet, why would you need the Sierra installer? Nobody managing multiple machines would use a 1.0 anyway.

Re: If macOS High Sierra shows your password instead of the password hint

#7

Post by eridius » Thu, Oct 05, 2017, 5:53 PM UTC

wallnuss wrote: post #4

how??! In what context does a clear-text password end up anywhere, except as the input for a hash function.

It doesn't. The bug is Disk Utility was setting the password as the password hint.

Re: If macOS High Sierra shows your password instead of the password hint

#8

Post by adenylyl » Thu, Oct 05, 2017, 5:54 PM UTC

"Erase the affected volume" is really the best solution they could come up with?

Re: If macOS High Sierra shows your password instead of the password hint

#9

Post by matt_wulfeck » Thu, Oct 05, 2017, 5:54 PM UTC

maxton wrote: post #5

It's rather frightening that a bug as serious as this one got past Apple's QA. It seems like the list of known problems with the new Disk Utility is growing - recently there was a submission about how High Sierra's Disk Utility did not show unformatted disks.

I really hope a head rolls for this mistake. That team needs some new leadership.

Re: If macOS High Sierra shows your password instead of the password hint

#10

Post by robinwassen » Thu, Oct 05, 2017, 5:55 PM UTC

wallnuss wrote: post #4

how??! In what context does a clear-text password end up anywhere, except as the input for a hash function.

You need to fetch the value to use as hint from the input somewhere.

Doing a typo of writing passwordInput instead of passwordHintInput is not that unlikely, even though it is unfortunate.