[dead]
macOS lock screen: “I just sent my session pass to my whole team”
141–150 of 276 posts
Re: macOS lock screen: “I just sent my session pass to my whole team”
#142So, Apple has the most available cash resource of any company out there (or at least close to). Yet, bugs galore, and strange product decisions. The obvious conclusion is that their management is failing to staff accordingly to the work that needs to be done. This could be because they are not aware that work needs to be done, which means engineers are not telling them, or that the management is not succeeding in hiring enough people to do the jobs.
My gut instinct says that a some former people at Apple used to do a lot of undocumented QA work and sanity checks, and that as the company has grown and changed, nobody picked up the slack when they left. Now, they'll have to go through a formal process of re-identifying QA steps that need to exist, and hiring against them. It's been a hell of a month for them, though.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#143Earlier quoted context omitted.
Same problems as you, but I disagree on the touchbar. It’s one of the better things Apple has added recently. But holy hell do they need to work on their external monitor support. Yesterday I had one of my monitors randomly go black for a second. I’ve had audio over usbc just not show up anymore and it refusing to see my gigabit ethernet when waking up unless I unplug the actual ethernet cable. Simply amazing this pa…
We have many staff with MBP + dual external displays and it's always been the least reliable aspect of the platform. From reading between the lines in the unusually arcane history of support docs on the topic, I've surmised their stance can be summed up as "it might work!" Which of course runs counter to the Apple It Just Works ideal, so they can never come out and admit as such. They've gone to great lengths to sque…
For what it's worth (anecdote incoming) I use a touchbar MBP with a Dell UP2414Q, which is driven using multi-stream transport. Effectively its panel is presented to the system as two separate displayport streams running daisy-chained over a single port. Once I found the right cable, everything worked fine. (The first cable was advertised with DP1.2 and MST support, but it would only operate in the legacy mode that dropped down to 30 Hz).
God forbid you try to use this with Windows though. Sometimes half of the screen cuts out, sometimes one side of it shifts by a couple hundred pixels (and wraps the right edge of the image around to a stripe down the middle of the screen), and god knows what other problems that I can't even remember. This was with a GTX 900 series GPU which is definitely "supported."
I used to have it hooked up to my Windows desktop since that's the fast computer with more storage and RAM, so it should be great for stuff like Lightroom. But since the screen doesn't work reliably, I moved that back to my MBP.
A friend with the same screen had identical issues on Windows and a similar solution. It's now on his wife's desk for her to plug her Macbook into.
Display signaling has gotten a lot more complicated than DVI/VGA were, and the reliability problems that have cropped up from that are present across the industry.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#144This is why Windows NT ensures no user process can intercept Ctrl-Alt-Del.
No. It is nothing to do with secure attention.
This is why Windows NT runs the log-on user interface, the screen saver, and the elevation consent UI on separate desktops that have restrictive ACLs disallowing interactive user processes from creating windows there.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#145Sounds like the assumption is that the lack of focus means that the first password got sent to Slack? But it seems more likely that it was the second entry of the password that was sent to Slack, and it was just that the keyboard input was being buffered? (So the first password-enter eventually got processed, and then the second one got processed but after unlock.)
Re: macOS lock screen: “I just sent my session pass to my whole team”
#146With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature…
Responsible disclosure is about preventing the bug from being exploited before it can be fixed. Knowing about this bug doesn't help me compromise someone else, but it does help me avoid getting compromised.
presumably if you had access to someone's locked MBP and you could move focus away from the password field you might be able to trick them into revealing their pw; if the setup requires access to an unlocked device it still allows you to leverage temporary access to unlocked device to get a leaked password.
Re: macOS lock screen: “I just sent my session pass to my whole team”
#147Re: macOS lock screen: “I just sent my session pass to my whole team”
#148Lock screens are harder than they first appear: www.jwz.org/xscreensaver/toolkits.html (Which, you'll note, mentions this exact failure case in the "Transfer Grabs?" section.) There's some X-specific stuff in there, but there's a lot of general issues in there, and with just a bit of imagination most or all of the X-specific issues can be seen as general issues as well.
[deleted]
Re: macOS lock screen: “I just sent my session pass to my whole team”
#149Earlier quoted context omitted.
Especially here, where it’s (probably?) not remotely exploitable.
Having your password in some IRC channel gets remotely exploitable quickly.
If you reused the password, yeah, instant pwnage everywhere. If your local account password isn't used anywhere else, meh, random IRC people don't have physical access to your machine :)
Re: macOS lock screen: “I just sent my session pass to my whole team”
#150These lock screen issues go back further than 10.13, I believe it was 10.10 or 10.11 my child was able to bypass the lock screen by mashing on the keyboard while the screensaver was fading out the login dialog.
I witnessed it. I was not able to reproduce it in 10-15 minutes of testing. She did NOT type in the password. Just banging on the keyboard, playing with the screensaver.