Could not reproduce that. For me its impossible to not have the password field focused. Hm?
Same here. Running 10.12.6
macOS lock screen: “I just sent my session pass to my whole team”
11–20 of 276 posts
Re: macOS lock screen: “I just sent my session pass to my whole team”
#12How about people stop releasing this sh*t on twitter?
Most people not in tech or infosec have never heard of and are totally uneducated about the concept of responsible disclosure. Maybe it needs to be added to high school computer class?
Except this dude on Twitter is. I wonder how many people in tech actually know about responsible disclosure.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#13Oh, wow - I've reported this problem along with na example exploit to Apple about 6-7 years ago. Never got any recognition for it, but It was fixed some time after that. It's quite sad to see old bugs getting new lives like that.
For those interested, the sample exploitation that I've discovered was connecting any iPod/iPhone device to a OSX laptop while screen was locked was taking the focus away from login prompt 'into' the system, where iTunes was gaining it and from there it was just few OS level keyboard shortcuts from gaining network access to the system, while still locked: launch finder, go to tools folder, launch terminal, launch `nc` in the terminal to get the access via network. Lots of blind typing but it worked more times than not.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#14Christ are these people just looking for attention or what? Why don't they take a second to follow some kind of responsible disclosure policy? Plus you can get bug bounty money probably if you do this the correct way.
No you don't, at least not from Apple, as it was the case when I reported a very similar issue few years ago. ;)
Re: macOS lock screen: “I just sent my session pass to my whole team”
#15Left Slack open with focus, allowed MBP to sleep, woke with space bar, login field had focus, tried with closing lid and opening while Slack was open and focused, again password field functioned as it should, unable to reproduce, macOS 10.13.2
Difficult to reproduce, can be when we lock the session, close the macbook, plug a second screen and re-open. Or in another order. Personally I remember not having the focus on the password input by opening my MacBook onetime, I often plug and unplug screens
Re: macOS lock screen: “I just sent my session pass to my whole team”
#16Even more fun if the focus happens to be on a terminal window...
If it's not there, you can always make it be, like I did in past with very similar issue (described in another comment). Quite few people disable/change OS wide keyboards shortcuts ;)
Re: macOS lock screen: “I just sent my session pass to my whole team”
#17Christ are these people just looking for attention or what? Why don't they take a second to follow some kind of responsible disclosure policy? Plus you can get bug bounty money probably if you do this the correct way.
I think in the specific case of apple, this serves a nice purpose. I believe macOS has lost a bit of love from the company, and so it’s a nice way (if not the only way) to make management listen.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#18Christ are these people just looking for attention or what? Why don't they take a second to follow some kind of responsible disclosure policy? Plus you can get bug bounty money probably if you do this the correct way.
Apple’s bug bounty program is for iOS only. There isn’t a bounty program for macOS.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#19How about people stop releasing this sh*t on twitter?
Most people not in tech or infosec have never heard of and are totally uneducated about the concept of responsible disclosure. Maybe it needs to be added to high school computer class?
Plus, even if you understand that, the thrill of having a shot at gaining thousands of followers instantly (like the root empty password guy) if you get lucky and get covered by news outlets is a great incentive for people to not responsibly disclose the security problem. If you responsibly disclose to Apple, it's their mercy to give you any reporting privileges, pay attention to you, and credit you.
That to me is not the right way to think, but in the day and age where number of likes and followers is king, I'd say it's not too irrational.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#20How about people stop releasing this sh*t on twitter?
Most people not in tech or infosec have never heard of and are totally uneducated about the concept of responsible disclosure. Maybe it needs to be added to high school computer class?
But this doesn't really need to be responsibly disclosed: it's not something someone can use to get into your machine, but rather a way you could accidentally broadcast your credentials somewhere unexpected.
Announcing on Twitter seems more like "hey be careful, make sure your password field is focused."