Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS lock screen: “I just sent my session pass to my whole team”

twitter.com

Post reply on HN
Print view View original

21–30 of 276 posts

Re: macOS lock screen: “I just sent my session pass to my whole team”

#21

Post by TonnyGaric »

pilif wrote: post #6

I did something similar too - I was typing in the password while the Mac was being unlocked by the watch using that unlock-with-the-watch feature. I was used to hammering return a few times to wake the machine up, then typing in the password, then hitting return again. The few times I hammered return woke the machine, the watch unlocked the mac and the password plus the return key went into the app that had focus whi…

Seems plausible. I have replied to the tweet and asked him, see https://twitter.com/TonnyGaric/status/939152498249666562

Re: macOS lock screen: “I just sent my session pass to my whole team”

#22

Post by symlinkk »

A similar thing happens to me sometimes with 1Password on the web. I'll click the extension's icon and type in my password and realize I'm typing it into a text box on the webpage. I've tried to reproduce it and I can't, so I have no idea what the issue is. It freaks me out though.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#23

Post by ulldma »

valine wrote: post #18
atonse wrote: post #5

Christ are these people just looking for attention or what? Why don't they take a second to follow some kind of responsible disclosure policy? Plus you can get bug bounty money probably if you do this the correct way.

Apple’s bug bounty program is for iOS only. There isn’t a bounty program for macOS.

And their iOS bug bounty program is invitation-only.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#24

Post by lloydde »

Although this bug still sucks, the class of problems of pasting passwords into chat may have a simple, worthwhile, and general solution. A colleague at a former company always changed the key bindings is his IRC/Jabber client to include a control key with Return for sending a message. Does Slack have this option?

Re: macOS lock screen: “I just sent my session pass to my whole team”

#25

Post by TonnyGaric »

theOnliest wrote: post #20
djsumdog wrote: post #7

Earlier quoted context omitted.

Most people not in tech or infosec have never heard of and are totally uneducated about the concept of responsible disclosure. Maybe it needs to be added to high school computer class?

But this doesn't really need to be responsibly disclosed: it's not something someone can use to get into your machine, but rather a way you could accidentally broadcast your credentials somewhere unexpected. Announcing on Twitter seems more like "hey be careful, make sure your password field is focused."

Yes, you can not get into someone else's Mac. However, what if the last opened application was Terminal? I can think of several scenario where you can do "damage" without logging in—if this bug is real—depending on the last opened application.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#26

Post by geerlingguy »

pilif wrote: post #6

I did something similar too - I was typing in the password while the Mac was being unlocked by the watch using that unlock-with-the-watch feature. I was used to hammering return a few times to wake the machine up, then typing in the password, then hitting return again. The few times I hammered return woke the machine, the watch unlocked the mac and the password plus the return key went into the app that had focus whi…

Because of the short delay between waking the Mac and the display lighting up, I always either use spacebar or command key, or click the trackpad/mouse a couple times to wake.

Return is a dangerous key!

Re: macOS lock screen: “I just sent my session pass to my whole team”

#27

Post by FLUX-YOU »

donmb wrote: post #4

Could not reproduce that. For me its impossible to not have the password field focused. Hm?

>For me its impossible to not have the password field focused

Maybe Slack or other apps have to call for focus, and MacOS is allowing those calls while it's locked.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#28

Post by CameronBanga »

atonse wrote: post #5

Christ are these people just looking for attention or what? Why don't they take a second to follow some kind of responsible disclosure policy? Plus you can get bug bounty money probably if you do this the correct way.

You've obviously never filed a bug with Apple if you think you could get bug bounty money, or really anything other than "FILED AS DUPLICATE OF RDAR://198017630131903".

Re: macOS lock screen: “I just sent my session pass to my whole team”

#29

Post by CameronBanga »

ankushnarula wrote: post #11
donmb wrote: post #4

Could not reproduce that. For me its impossible to not have the password field focused. Hm?

Same here. Running 10.12.6

I think this is a 10.13-only bug, likely tied with some of the other password entry bugs that have popped up due to a bunch of rework with how user login/authentication work.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#30

Post by jerf »

Lock screens are harder than they first appear: www.jwz.org/xscreensaver/toolkits.html (Which, you'll note, mentions this exact failure case in the "Transfer Grabs?" section.) There's some X-specific stuff in there, but there's a lot of general issues in there, and with just a bit of imagination most or all of the X-specific issues can be seen as general issues as well.
Post reply on HN