Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS lock screen: “I just sent my session pass to my whole team”

twitter.com

Post reply on HN
Print view View original

61–70 of 276 posts

Re: macOS lock screen: “I just sent my session pass to my whole team”

#61

Post by j_s »

teekert wrote: post #59
j_s wrote: post #52

I often wonder how many authentication log files contain passwords because people in a hurry append it to the username on accident (not visually confirming the Tab/Enter/switch to the password entry). This is also vaguely similar to the 'test SSL submit' security technique of first entering enough data into login forms to process a submission, and then entering real login info into the 'login failed' retry page after…

Yeah, pretty sure mine is in clear text in some ssh auth.logs. Yeah yeah, I should use encryted keybased login (I try to mostly do it.)

I typically require both when others are involved since proper key security can't be enforced (hardware 2FA is the dream).

AuthenticationMethods requiring both wasn't availabe in OpenSSH prior to v6.2 (May 2013)[1] and I'm on Windows anyway so I went with https://www.bitvise.com/ssh-server.

https://serverfault.com/a/562899

Re: macOS lock screen: “I just sent my session pass to my whole team”

#62

Post by drb91 »

striking wrote: post #34
jerf wrote: post #30

Lock screens are harder than they first appear: www.jwz.org/xscreensaver/toolkits.html (Which, you'll note, mentions this exact failure case in the "Transfer Grabs?" section.) There's some X-specific stuff in there, but there's a lot of general issues in there, and with just a bit of imagination most or all of the X-specific issues can be seen as general issues as well.

N.B. jwz does not like being linked to from HN. Open the link in a new tab.

With treatement like that, I’d prefer to avoid this person and all their content.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#63

Post by gonational »

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations.

Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention.

“Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature (security) to the same people that paid those companies thousands of dollars for that privilege.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#64

Post by [deleted] »

pilif wrote: post #6

I did something similar too - I was typing in the password while the Mac was being unlocked by the watch using that unlock-with-the-watch feature. I was used to hammering return a few times to wake the machine up, then typing in the password, then hitting return again. The few times I hammered return woke the machine, the watch unlocked the mac and the password plus the return key went into the app that had focus whi…

[deleted]

Re: macOS lock screen: “I just sent my session pass to my whole team”

#65

Post by teekert »

breakingcups wrote: post #8
rst wrote: post #2

Even more fun if the focus happens to be on a terminal window...

I knew I shouldn't have picked 'rm -rf /' as a password

Haha, tried that a couple of months back before wanting to do a reinstall. The system stopped me with some warning :) I think it was Arch but could have been Ubuntu or Solus.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#66

Post by msla »

sigzero wrote: post #3

How about people stop releasing this sh*t on twitter?

What's the threat model here? That someone malicious with physical access to the computer somehow shifts focus to a program they know you have running such that, when you type your password, you send it to the malicious person.

That's a very tenuous exploit, seeing as it relies on physical access and knowledge that the victim is already running a program which would hand the password to the attacker were the password typed into it, and I'm assuming that changing focus once the lock screen is active is even possible.

But once the attacker has physical access, there are more things they can do, I'm certain, making this a rather pointless exploit as well. So disclosure isn't giving anyone a new road into the system, it's just making people aware of a potential security flaw in a way Apple might actually care about.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#67

Post by lathiat »

godzillabrennus wrote: post #58
andr wrote: post #39

Earlier quoted context omitted.

Citation: http://bash.org/?244321

Amazing. Reminds me of people being told in chat to hit F10 to enable cheats in Counterstrike Source. Half the gamers would exit immediately.

Have you seen the feature they added to the latest release of BitchX and irssi?

Try it out: /disco party

Re: macOS lock screen: “I just sent my session pass to my whole team”

#68

Post by DannyBee »

oatmealsnap wrote: post #41
caiob wrote: post #36

I may be wrong, but Slack might be hijacking the window order, there's def some monkey business going on there.

Nothing should be able to hack outside of of the lock screen. That should require some crazy special permissions.

The system allows things like key-triggered screen grabs during the login password window (found this out when my 1 year old hit a bunch of keys), which already seems like nonsense.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#69

Post by monochromatic »

gonational wrote: post #63

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature…

Especially here, where it’s (probably?) not remotely exploitable.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#70

Post by zamalek »

monochromatic wrote: post #69
gonational wrote: post #63

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature…

Especially here, where it’s (probably?) not remotely exploitable.

> probably

Show and focus a window when the user locks their machine.

Post reply on HN