AppStore Preferences can be unlocked by a local admin with any bogus password
openradar.appspot.com
AppStore Preferences can be unlocked by a local admin with any bogus password
1–10 of 190 posts
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#2Can confirm - with my colleagues laptop - much to his amusement :)
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#3I have a feeling this isn't actually that High Sierra is that much worse, but more that people are now actively pen-testing macOS to find the next embarrassing bug.
And that scares me even more because of the unknown of how long such bugs must've existed in the system.
Is this Apple's Windows XP moment? (Like when MS stopped everything and did massive security training that resulted in XP SP 2 being worlds more secure?)
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#4Cmon Apple I know security people are in short supply but:
A) You have the resources B) This is the type of bug that any semi decent QA process should catch anyway
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#5The interesting implication from this is that while it works for the App Store preferences, it doesn't work for the others, showing that there is a manual check that each pane is doing. Why aren't all of these calls identical? If each has to be handled manually, it's no wonder that there are bugs like this appearing.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#6If you read the notes:
This only appears to be when logged in as a local admin. Tested with a non-admin account and I cannot unlock the prefpane with incorrect credentials.
So basically they are checking to see if you have credentials already. I guess this is a caching issue since you locked it.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#7Kind of a silly title "AppStore Preferences lock is a lie" -- it isn't a "lie" unless Apple intended for it to not lock correctly. But obviously, it's a bug. It isn't like Apple is trying to deceive users.
Interesting bug, unnecessarily hyperbolic title for it.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#8I'm on 10.12.6 and a local admin account, and it only unlocks to my actual password. That might mean it's a recently-introduced bug (assuming someone else can reproduce my result).
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#9sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the osx security model, this sounds like not a big deal?
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#10Can confirm it doesn't work on "Sierra", so it must be high sierra's feature.