Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AppStore Preferences can be unlocked by a local admin with any bogus password

openradar.appspot.com

Post reply on HN
Print view View original

11–20 of 190 posts

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#11

Post by CGamesPlay »

atonse wrote: post #3

I have a feeling this isn't actually that High Sierra is that much worse, but more that people are now actively pen-testing macOS to find the next embarrassing bug. And that scares me even more because of the unknown of how long such bugs must've existed in the system. Is this Apple's Windows XP moment? (Like when MS stopped everything and did massive security training that resulted in XP SP 2 being worlds more secur…

Well, the root account password bug and this bug both do not reproduce on Sierra, so they were both introduced in High Sierra. Unless you’re arguing that Apple fixed a bunch of undisclosed vulnerabilities when they introduced these, High Sierra is definitely worse.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#12

Post by pvg »

briandear wrote: post #7

Kind of a silly title "AppStore Preferences lock is a lie" -- it isn't a "lie" unless Apple intended for it to not lock correctly. But obviously, it's a bug. It isn't like Apple is trying to deceive users. Interesting bug, unnecessarily hyperbolic title for it.

It's supposed to be amusing. Think 'the cake is a lie'.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#13

Post by newscracker »

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub-standard products that aren’t expected from it.

As a long time Mac user, I keep hoping that Apple will decide to double down on better and deeper focus on all its products, including the Mac, its OS and ecosystem, and make the changes necessary across its organization and its teams.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#14

Post by gregoriol »

atonse wrote: post #3

I have a feeling this isn't actually that High Sierra is that much worse, but more that people are now actively pen-testing macOS to find the next embarrassing bug. And that scares me even more because of the unknown of how long such bugs must've existed in the system. Is this Apple's Windows XP moment? (Like when MS stopped everything and did massive security training that resulted in XP SP 2 being worlds more secur…

Most of the recently discussed High Sierra bugs were not there on Sierra, while the features were there, like this one.

So it's not that much pen tensting, but Apple making changes and not validating them correctly. Maybe they have their Vista moment with High Sierra, maybe we forgot previous buggy versions.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#15

Post by oneeyedpigeon »

jtchang wrote: post #6

If you read the notes: This only appears to be when logged in as a local admin. Tested with a non-admin account and I cannot unlock the prefpane with incorrect credentials. So basically they are checking to see if you have credentials already. I guess this is a caching issue since you locked it.

That makes an awful lot of sense, in which case the bug is just not checking that the login is 'cached' before displaying the dialog. In a similar vein to another comment, though, why doesn't that dialog detect the state of the 'login cache' consistently across all occurrences?

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#16

Post by TheCoreh »

dajohnson89 wrote: post #9

sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the osx security model, this sounds like not a big deal?

On OS X, administrative accounts still need to authenticate with their passwords to perform administrative tasks. This is to avoid (presumably) someone using your computer and changing settings without your consent if you have automatic login enabled, and to make sure you pay attention to what you're doing (similar to the UAC prompts on Windows, and sudo on Windows)

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#17

Post by gregoriol »

dajohnson89 wrote: post #9

sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the osx security model, this sounds like not a big deal?

As long as a password is requested, it has to be checked!

Also this wasn't possible on Sierra.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#18

Post by aetherson »

dajohnson89 wrote: post #9

sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the osx security model, this sounds like not a big deal?

For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it.

This prevents a situation where the actual admin logs in, their attention is taken away from the computer, and someone sits at their chair and does awful things with the computer.

Post reply on HN