undefined | Better HN

0 pointskobayashi8y ago0 comments

This seems to be why: https://objective-see.com/blog/blog_0x24.html

0 comments

To some up, when you try to log in with a disabled account, MacOS "promotes" the account but uses the _password provided by the user trying to log in_ instead of the password on file (in this case, an asterisk indicating the account is disabled). Once that is done, you can log in with that account.

IMHO these are two separate bugs: promoting disabled accounts and using the password the user typed in instead of the value in the password list.

irishsultan8y ago

I assume that it can't use the password in the password list as that should be hashed already.

cmiles748y ago

I see your point, but it still seems kind of wacky to me. They should validate that the password is correct, then promote the account. Taking the password provided in the authentication dialog just seems like a bad idea.

Perhaps the root issue here is forgetting that the asterisk indicates that the account is disabled and shouldn't be a candidate for promotion.

j / k navigate · click thread line to collapse

0 comments

cmiles748y ago

IMHO these are two separate bugs: promoting disabled accounts and using the password the user typed in instead of the value in the password list.

irishsultan8y ago

I assume that it can't use the password in the password list as that should be hashed already.

cmiles748y ago

Perhaps the root issue here is forgetting that the asterisk indicates that the account is disabled and shouldn't be a candidate for promotion.

j / k navigate · click thread line to collapse