Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS lock screen: “I just sent my session pass to my whole team”

twitter.com

Post reply on HN
Print view View original

131–140 of 276 posts

Re: macOS lock screen: “I just sent my session pass to my whole team”

#131

Post by blattimwind »

monochromatic wrote: post #69
gonational wrote: post #63

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature…

Especially here, where it’s (probably?) not remotely exploitable.

Having your password in some IRC channel gets remotely exploitable quickly.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#133

Post by Domenic_S »

pilif wrote: post #6

I did something similar too - I was typing in the password while the Mac was being unlocked by the watch using that unlock-with-the-watch feature. I was used to hammering return a few times to wake the machine up, then typing in the password, then hitting return again. The few times I hammered return woke the machine, the watch unlocked the mac and the password plus the return key went into the app that had focus whi…

Hmm, the "Unlocking with Apple Watch..." sequence breaks when you hit a key and then displays the standard password field, so that you can type in your password instead. This seems really unusual.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#134

Post by [deleted] »

daveFNbuck wrote: post #108
gonational wrote: post #63

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature…

Responsible disclosure is about preventing the bug from being exploited before it can be fixed. Knowing about this bug doesn't help me compromise someone else, but it does help me avoid getting compromised.

[deleted]

Re: macOS lock screen: “I just sent my session pass to my whole team”

#135

Post by ghostly_s »

dawnerd wrote: post #79
malchow wrote: post #31

Not to pile on, but my MBP (with "TouchBar" which will assuredly not exist in another year) is always in clamshell mode and connected to two external LG 4K displays. Whether, on which screen(s), or in what state the Mac wakes each morning is completely random. Sometimes it doesn't wake at all. Sometimes I have artifacts on one screen and a desktop on another screen. The sleep/wake sequence is a complete mess, and it…

Same problems as you, but I disagree on the touchbar. It’s one of the better things Apple has added recently. But holy hell do they need to work on their external monitor support. Yesterday I had one of my monitors randomly go black for a second. I’ve had audio over usbc just not show up anymore and it refusing to see my gigabit ethernet when waking up unless I unplug the actual ethernet cable. Simply amazing this pa…

We have many staff with MBP + dual external displays and it's always been the least reliable aspect of the platform. From reading between the lines in the unusually arcane history of support docs on the topic, I've surmised their stance can be summed up as "it might work!" Which of course runs counter to the Apple It Just Works ideal, so they can never come out and admit as such. They've gone to great lengths to squeeze impressive performance out of their stingy graphics hardware choices at the OS level, but there's not much you can do to massage the numbers when adding up pixels, I guess.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#136

Post by y3sh »

FWIW this is a known security bug at Apple. I filed a bug about similar behavior where you can see the desktop briefly without logging in. Apple marked it as a duplicate. https://imgur.com/YxXtU2y

Here are the steps to reproduce:

- Start Mac

- Login

- Turn on Screen Lock: System Preferences > Security > General > Check "Require Password" and Select 5 Seconds.

- Turn on Hot Corner Sleep Display: System Preferences > Mission Control > Hot Corners > Select upper left > Put Display to Sleep > Ok

- Attach external monitor

- Activate hot corner by dragging mouse to upper left corner of screen

- Wait 6 seconds

- Click the mouse to trigger waking the screen

- See brief flash of the desktop without logging in!

Re: macOS lock screen: “I just sent my session pass to my whole team”

#138

Post by [deleted] »

y3sh wrote: post #136

FWIW this is a known security bug at Apple. I filed a bug about similar behavior where you can see the desktop briefly without logging in. Apple marked it as a duplicate. https://imgur.com/YxXtU2y Here are the steps to reproduce: - Start Mac - Login - Turn on Screen Lock: System Preferences > Security > General > Check "Require Password" and Select 5 Seconds. - Turn on Hot Corner Sleep Display: System Preferences > M…

[deleted]

Re: macOS lock screen: “I just sent my session pass to my whole team”

#139

Post by lostlogin »

notheguyouthink wrote: post #77
lostlogin wrote: post #74

Earlier quoted context omitted.

Hell yes. I wonder wha’s the worst thing someone has done with this? When you hit return and just before the keystroke a pop up comes up and you agree to something you didn’t want. I’ve see a couple of bad ones in the radiology world.

Oh god, popups while you're typing are the worst. I feel like the OS should not even allow it. No idea how to prevent the issue, but I've been caught mid sentence before and accepted installs, upgrades, random popups, etc. Ones from Skype tend to be the most infuriating / scary..

My favourite was watching someone perform an MRI with injected contrast - imaging being timed for specific points after injection.

They are just tidying up parameters for a bit of post constrast injection imaging. They hit enter to accept a parameter change just as a notification appeared to trigger the next scan. Basically it missed the key imaging phase and the scan had to be repeated a day later once the injected contrast had been cleared out of the patient’s system. Imaging equipment vendors seem to make custom UI in places where it is unneeded (software buttons which trigger on touch down, not touch up for critical functionality?! Why?) but in places where it would be safer to make something custom they don’t.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#140

Post by lostlogin »

Arnt wrote: post #85
notheguyouthink wrote: post #77

Earlier quoted context omitted.

Oh god, popups while you're typing are the worst. I feel like the OS should not even allow it. No idea how to prevent the issue, but I've been caught mid sentence before and accepted installs, upgrades, random popups, etc. Ones from Skype tend to be the most infuriating / scary..

It's not too difficult. a) only the application with keyboard focus gets to open new windows with keyboard focus less than about two seconds after a keystroke (with no intervening mouse activity). b) no keyboard input into a new window for the first second, unless the user clicks there. We looked into this while I was Trolltech. Decided against doing it for Qt unilaterally, it's really something the system must do, o…

But what about pop ups that come from within the application? Anything that has dialogues come up when there is a chance the user might be using enter/return for a different purpose is a bit crap, especially with multi-screen systems where there is a fair chance the user is looking elsewhere. Even just having no pre-selected default would help (so arrow - enter/return would be needed).
Post reply on HN