5 ms·

Actually, no. For all computers, running macOS High Sierra, a computer with a root password is a whole heck of a lot more secure than one without a root account

Actually, no. For all computers, running macOS High Sierra, a computer with a root password is a whole heck of a lot more secure than one without a root account at all :) But seriously, a fix is whatever fixes the problem.

saagarjha 9y ago
It is now. There's going to be a whole lot of people who are going to set a root password because they read an article online recommending it, then install the update that fixes this issue. Now they're stuck with a root password when they could have not had one at all.
- reitanqild 9y ago
  Shouldn't matter as long as the password is strong?
  - saagarjha 9y ago
    Making it difficult to access something is always worse than not having anything to access. Plus, the average person will set their root password to something like 123456 or qwerty, which is clearly insecure.
    - reitanqild 9y ago
      > Making it difficult to access something is always worse than not having anything to access. Not a choice now. If people have physical access to Macs at the moment then it seems to me there are two options right now: either 1) you have changed the root password, hopefully to a strong password or 2) they'll be able to login as root. Right now you can expect the participants in this thread to be a little smarter than the average computer user.
- forapurpose 9y ago
  > Now they're stuck with a root password when they could have not had one at all. And many users will create insecure passwords, leaving them with a serious vulnerability after the patch. A password of "root" or "qwerty" is only marginally more secure than a blank one.
- wuliwong 9y ago
  Could the patch also handle this case? Can you create a root account in OS X? If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account.
  - saagarjha 9y ago
    > Can you create a root account in OS X? Yes, you can. macOS ships with the account disabled by default, but you can re-enable it if you wish. Most of the time there is no reason to do so. > If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account. Yes, but this difference doesn't matter. By creating a root account you have made your computer less secure anyways, assuming that we didn't have the current issue at hand.
- roblabla 9y ago
  And as a result, they've been safer sooner than other people.

saagarjha 9y ago

It is now. There's going to be a whole lot of people who are going to set a root password because they read an article online recommending it, then install the update that fixes this issue. Now they're stuck with a root password when they could have not had one at all.

reitanqild 9y ago
Shouldn't matter as long as the password is strong?
- saagarjha 9y ago
  Making it difficult to access something is always worse than not having anything to access. Plus, the average person will set their root password to something like 123456 or qwerty, which is clearly insecure.
  - reitanqild 9y ago
    > Making it difficult to access something is always worse than not having anything to access. Not a choice now. If people have physical access to Macs at the moment then it seems to me there are two options right now: either 1) you have changed the root password, hopefully to a strong password or 2) they'll be able to login as root. Right now you can expect the participants in this thread to be a little smarter than the average computer user.
forapurpose 9y ago
> Now they're stuck with a root password when they could have not had one at all. And many users will create insecure passwords, leaving them with a serious vulnerability after the patch. A password of "root" or "qwerty" is only marginally more secure than a blank one.
wuliwong 9y ago
Could the patch also handle this case? Can you create a root account in OS X? If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account.
- saagarjha 9y ago
  > Can you create a root account in OS X? Yes, you can. macOS ships with the account disabled by default, but you can re-enable it if you wish. Most of the time there is no reason to do so. > If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account. Yes, but this difference doesn't matter. By creating a root account you have made your computer less secure anyways, assuming that we didn't have the current issue at hand.
roblabla 9y ago
And as a result, they've been safer sooner than other people.