Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If macOS High Sierra shows your password instead of the password hint

support.apple.com

Post reply on HN
Print view View original

101–110 of 372 posts

Re: If macOS High Sierra shows your password instead of the password hint

#101

Post by FabHK »

JumpCrisscross wrote: post #97
eonti09taeuo wrote: post #86

Earlier quoted context omitted.

Keep in mind that this only happens if you turned it on using Disk Utility. If you did the normal upgrade (the vast majority of users) you didn't go through disk utility, and everything's fine (presumably). Still a terrible error, but affects far fewer people than your comment implied.

What if you used command line diskutil?

Apparently the bug only affected the GUI app.

> When creating an encrypted APFS volume in Terminal with the diskutil command line utility, the actual hint is shown, rather than the password.

https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-...

Re: If macOS High Sierra shows your password instead of the password hint

#102

Post by [deleted] »

marnett wrote: post #73
nevir wrote: post #18

Earlier quoted context omitted.

Agreed. You can be sure that whomever was involved with the bug will probably never make that mistake again.

They asked for new leadership, not new developers. The 'mistake' wasn't a bug in XYZ, but a leader who took feature deadlines ahead of actual functionality. That leader should be axed - that's what GGP was discussing.

[deleted]

Re: If macOS High Sierra shows your password instead of the password hint

#103

Post by debaserab2 »

aphextron wrote: post #58
jamisteven wrote: post #55

Earlier quoted context omitted.

This is a blatant lie.

>This is a blatant lie. No, it's not. Try recovering your iCloud password from the web right now. I couldn't believe it either. https://support.apple.com/en-us/HT204921 "For your security, recovery includes a waiting period that may be several days or longer depending on the information you can provide to verify your identity. Apple Support cannot help you shorten this time. "

If you want to reset your password, it's pretty much standard operating procedure: https://support.apple.com/en-us/ht201487

Not sure where you got that quote from - it's not in the link you pasted.

Re: If macOS High Sierra shows your password instead of the password hint

#104

Post by kerouanton »

eridius wrote: post #7
wallnuss wrote: post #4

how??! In what context does a clear-text password end up anywhere, except as the input for a hash function.

It doesn't. The bug is Disk Utility was setting the password as the password hint.

well, strictly speaking storing the password itself is a good hint, no?

Re: If macOS High Sierra shows your password instead of the password hint

#105

Post by bdamm »

aphextron wrote: post #58
jamisteven wrote: post #55

Earlier quoted context omitted.

This is a blatant lie.

>This is a blatant lie. No, it's not. Try recovering your iCloud password from the web right now. I couldn't believe it either. https://support.apple.com/en-us/HT204921 "For your security, recovery includes a waiting period that may be several days or longer depending on the information you can provide to verify your identity. Apple Support cannot help you shorten this time. "

The link you provided documents account recovery, not password change. Also, the word "waiting" does not appear on that page anywhere.

Re: If macOS High Sierra shows your password instead of the password hint

#106

Post by revelation »

thought_alarm wrote: post #49

How did Disk Utility.app go from being one of the great built-in OS X utilities to the embarrassing amateurish shit show that it is today? Perhaps the same people responsible for the file system engineering are also responsible for developing this user-facing application. They might excel at low level system engineering, but they are utterly unqualified to develop a high level GUI application. Spend 5 minutes with th…

But it looks very sleek now, with big graphs and fonts for the crucial information.

Re: If macOS High Sierra shows your password instead of the password hint

#107

Post by laurent123456 »

aphextron wrote: post #58
jamisteven wrote: post #55

Earlier quoted context omitted.

This is a blatant lie.

>This is a blatant lie. No, it's not. Try recovering your iCloud password from the web right now. I couldn't believe it either. https://support.apple.com/en-us/HT204921 "For your security, recovery includes a waiting period that may be several days or longer depending on the information you can provide to verify your identity. Apple Support cannot help you shorten this time. "

> For your security

Translation: we can't be bothered to come up with a secure solution so we offload that onto our users.

Re: If macOS High Sierra shows your password instead of the password hint

#109

Post by jaclaz »

Xynap wrote: post #74
cliffy wrote: post #35

Earlier quoted context omitted.

How? 1. Lack of automated unit tests covering the code in question. 2. Lack of automated functional tests running through scenarios of setting up an encrypted volume with or without a hint. 3. Lack of strict review process for the disk utility's codebase. This assumes automated tests are also peer-reviewed. 1 - 3 won't guarantee a bug-free project, but I doubt this bug would've made it into production.

Completely agree that adequate automated testing would have caught this but still ... You'd think the developer/QA that worked on that particular feature would have manually tested it at least once.

>You'd think the developer/QA that worked on that particular feature would have manually tested it at least once.

Or anyone else, it is seemingly not a hidden, elusive bug that can only be caught when a number of particular conditions concurrently happen.

According to Matheus Mariano (that seemingly was the first to find it and report to Apple):

https://news.ycombinator.com/item?id=15408258

https://medium.com/@matheusmariano/new-macos-high-sierra-vul...

The only needed condition is that the Mac has a SSD, and in his words:

"I really don’t know how this went unnoticed by Apple (and anyone else). "

Re: If macOS High Sierra shows your password instead of the password hint

#110

Post by Gaelan »

aphextron wrote: post #58
jamisteven wrote: post #55

Earlier quoted context omitted.

This is a blatant lie.

>This is a blatant lie. No, it's not. Try recovering your iCloud password from the web right now. I couldn't believe it either. https://support.apple.com/en-us/HT204921 "For your security, recovery includes a waiting period that may be several days or longer depending on the information you can provide to verify your identity. Apple Support cannot help you shorten this time. "

Google also has a similar process for some password resets.
Post reply on HN