If you can read this, either the style sheet didn't load or you have an older browser that doesn't support style sheets. Try clearing your browser cache and refreshing the page.

(MacRumors)   Apple's new High Sierra "Show Password Hint" feature leaves one of those three words out   ( macrumors.com) divider line
    More: Fail, Disk Utility, English-language films, good point, macOS, volumes, Terminal, people, impact  
•       •       •

2383 clicks; posted to Geek » on 05 Oct 2017 at 10:46 PM (41 weeks ago)   |   Favorite    |   share:  Share on Twitter share via Email Share on Facebook   more»

Voting Results (Smartest)
View Voting Results: Smartest and Funniest

2017-10-05 10:49:14 PM  
14 votes:
The very fact the password is possible to display (i.e. stored in a state in which the original password can be recovered) makes the entire security of this disk encryption worthless.
2017-10-05 11:07:25 PM  
4 votes:
bingethinker, it doesn't matter a whole lot to me if it's been fixed already. Anyone doing any development that involves a password in 2017 who doesn't know that YOU DO NOT STORE THE PASSWORD IN ANY RECOVERABLE FORM is grossly incompetent - even Sum Dum Gai was right on top of that.

Could such a software development team consider it a "fix" if they just keep the password in a really sneaky place, maybe even encrypted or at least obfuscated? I'd be pretty worried about that, because it's only reasonable to assume they have also gotten everything else related to security wrong.
2017-10-05 11:09:57 PM  
3 votes:

bingethinker: Fixed already. Eat a bowl of stale dicks, subby.

You seem upset
2017-10-06 03:13:37 AM  
2 votes:
Christ, everyone. The password got saved as the hint. That's it. It doesn't say any more about the technical competence of the security stack and encryption technology.
2017-10-05 11:59:43 PM  
2 votes:
The fact that this bug can even occur means that the underlying security is worthless even without the bug.
2017-10-06 11:20:05 AM  
1 vote:

trialpha: covfefe: Christ, everyone. The password got saved as the hint. That's it. It doesn't say any more about the technical competence of the security stack and encryption technology.

Well, it shows they didn't much in the way of testing. Which means confidence in their implementation of said security stack and encryption technology is low.

Since they didn't do any kind of testing, and they've already made basic mistakes like this, who says the encryption code isn't:

// encrypt_key = get_key();
encrypt_key = testing_static_value;

Yeah it look like the updated GUI front end was bugged. The command disk utility still works exactly the same.

I'm putting money on it being rewritten from scratch and the poor soul writing:

APFS.password = input.password;
APFS.passwordhint = input.password;

2017-10-06 01:35:34 AM  
1 vote:
Am I sorry I ditched Apple and went back to Windows? Not after the dumpster fire that's been Apple for the last five years,
2017-10-06 12:05:08 AM  
1 vote:
Reading the article, it looks like they didn't intend to store the password itself; they meant to store the password hint. But they screwed up the programming, which got fixed in the update, and it's why they recommend you recreate the volume (because the hint is likely stored in plain text, while the proper password is at best stored as a hash, or just not stored at all -- you just try the decrypt key blindly, and see if you get a valid filesystem out of it).

Put another way, let's say that your dialog box populates a struct / record / whatever with "password" and "passwordHint". Then, when the user clicks "ok", they run code that looks like this:

  fs.passwordHash = myFancyHashFunction(dialog.password); // ok, maybe add a salt or something.
  fs.passwordHint = dialog.password; // oops, meant to use 'dialog.passwordHint'

I'm not defending this, but I'd be more worried that this wasn't caught in [preferably automatic] testing.
2017-10-05 10:53:06 PM  
1 vote:
That's the kind of hint I need in law enforcement.
Displayed 9 of 9 comments

View Voting Results: Smartest and Funniest

This thread is archived, and closed to new comments.

Continue Farking

On Twitter

Top Commented
Javascript is required to view headlines in widget.
  1. Links are submitted by members of the Fark community.

  2. When community members submit a link, they also write a custom headline for the story.

  3. Other Farkers comment on the links. This is the number of comments. Click here to read them.

  4. Click here to submit a link.