Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS lock screen: “I just sent my session pass to my whole team”

twitter.com

Post reply on HN
Print view View original

221–230 of 276 posts

Re: macOS lock screen: “I just sent my session pass to my whole team”

#221

Post by zamalek »

gaius wrote: post #205
Someone1234 wrote: post #201

Earlier quoted context omitted.

Not really sure what you think that adds. Nobody is denying that the "anti-hijacking" forcing of CTRL-ALT-Delete adds to security, what they're saying is that it has nothing to do with this topic. This topic is about keyboard input focus. In Windows, due to the process hierarchy the login UI isn't running in the same context as desktop applications, so stealing focus or focus drift couldn't occur.

This topic is about keyboard input focus. Yes, and the SAS guarantees that after you enter it, nothing else can have keyboard focus. I don't see why this is such a controversial point. You will never come to unlock your NT workstation and find that the keyboard focus is somewhere you don't expect, because you need to enter the SAS first.

> I don't see why this is such a controversial point.

Because It's untrue. The SAS is a sanity check.

If something is spoofing a login screen on your desktop and you press CTRL+ALT+DEL, you will get a system menu instead of a password prompt.

If you are in the login screen, which is able to hook CTRL+ALT+DEL, it will switch to the password prompt.

Here's the clincher: even if you have the SAS disabled (which it is by default on Windows 10) there is still no way for an app to steal focus from the login screen. The keyboard focus assurances are handled by something completely different - protected desktops (these also handle the UAC prompt for the most secure setting).

Full circle: even though nothing can ever steal focus from the login screen (unless it is running within that protected desktop), if you don't use the SAS there is no way for you to know that you are looking at the real Windows login screen.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#223

Post by linkregister »

joeblau wrote: post #207
tracker1 wrote: post #164

Earlier quoted context omitted.

I'm pretty sure you'd find a LOT of people to do that work for $300k/year... Apple has lots of money to go as far as they like.

Yeah, but if you can make $300k a year, you're likely not dedicating your software engineering career to fixing bugs. Also, you can go a few miles south to Los Gatos and work at Netflix and make $400k/year.

$400k/year? is that for Principal Engineers and Directors? What would a senior eng make there?

Re: macOS lock screen: “I just sent my session pass to my whole team”

#224

Post by linkregister »

joeblau wrote: post #210
sangnoir wrote: post #173

Earlier quoted context omitted.

Only the first issue can't be solved by throwing more money at it.

If someone is good and can't get a Visa to move to the U.S. more money won't help that either.

Money can buy a new engineering office in a more immigration-friendly country.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#225

Post by linkregister »

lostlogin wrote: post #74
geerlingguy wrote: post #26

Earlier quoted context omitted.

Because of the short delay between waking the Mac and the display lighting up, I always either use spacebar or command key, or click the trackpad/mouse a couple times to wake. Return is a dangerous key!

Hell yes. I wonder wha’s the worst thing someone has done with this? When you hit return and just before the keystroke a pop up comes up and you agree to something you didn’t want. I’ve see a couple of bad ones in the radiology world.

Yes, stealing focus by another application should not be permitted by the window manager / OS. Windows XP had a feature or a 3rd party plugin that would simply blink the application in the task bar if it attempted to steal focus. I also seem to remember a similar feature in Gnome 2, though it could be a false memory.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#226

Post by linkregister »

lostlogin wrote: post #140
Arnt wrote: post #85

Earlier quoted context omitted.

It's not too difficult. a) only the application with keyboard focus gets to open new windows with keyboard focus less than about two seconds after a keystroke (with no intervening mouse activity). b) no keyboard input into a new window for the first second, unless the user clicks there. We looked into this while I was Trolltech. Decided against doing it for Qt unilaterally, it's really something the system must do, o…

But what about pop ups that come from within the application? Anything that has dialogues come up when there is a chance the user might be using enter/return for a different purpose is a bit crap, especially with multi-screen systems where there is a fair chance the user is looking elsewhere. Even just having no pre-selected default would help (so arrow - enter/return would be needed).

This seems like something that should be handled by the application's developer. A different application's popup or focus steal should be managed by the window manager / OS.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#228

Post by thomastjeffery »

pfranz wrote: post #202
feelin_googley wrote: post #178

Earlier quoted context omitted.

"With no disrespect to the developers at Apple, et. al., each one of these problems that goes viral before reaching "proper" channels..." s/that goes viral before reaching \"proper\" channels// The fact that the problems existed to begin with is more troubling than whether they became known outside the company or not. IMO. With an open source UNIX-like OS (like the ones Apple sourced from for parts of macOS), both th…

In addition to the many xscreensaver bugs over the years that the sibling post mentioned, last year there was a systemd root escalation exploit that was the same class of programming error as Apple's bug that enabled the root account with an empty password. From my understanding, in both cases they misinterpreted the return code's magic number (-1) as something it wasn't. Also, Linus' Law has some doubters. Things li…

> isn't immune

Why all-or-nothing?

The fact is that free software has transparency as one of its advantages.

When software is closed-source, its users must rely on the developers to maintain that software.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#229

Post by eridius »

Grimm665 wrote: post #216
eridius wrote: post #212

Earlier quoted context omitted.

That's Windows. F5 doesn't do anything in Mac browsers.

What? Fn+F5 works fine in chrome.

Funny, I actually tested Chrome before commenting just to make sure it wasn't doing something weird, and F5 definitely doesn't reload Chrome on my computer.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#230

Post by eridius »

zeveb wrote: post #215
eridius wrote: post #208

Earlier quoted context omitted.

By consoles do you mean terminals? Terminal.app uses ⌘⌥1–9 to switch windows and ⌘1–9 to switch tabs. The F-keys aren't used by Terminal.app at all (well, they're sent to the terminal as an escape sequence).

No, I mean complete GUI heads: completely separate GUI login sessions which use the same screen and can be switched between. Also called 'virtual framebuffers,' I think. Very awesome. I'm sure that Macs support something similar.

macOS has something called Fast User Switching, which is completely separate login sessions, but you access it through a menu on the right side of the menubar, not with keys.

macOS also has Spaces, which is just virtual desktops, but again, it doesn't use the F-keys to switch between them.

Post reply on HN