5 ms·

The interesting implication from this is that while it works for the App Store preferences, it doesn't work for the others, showing that there is a manual check

The interesting implication from this is that while it works for the App Store preferences, it doesn't work for the others, showing that there is a manual check that each pane is doing. Why aren't all of these calls identical? If each has to be handled manually, it's no wonder that there are bugs like this appearing.

christoph 9y ago
My guess is that the App Store preferences isn't even meant to have the padlock. iCloud prefs doesn't have it, so I can only assume it's there by mistake. If you try the same thing with say "Time & date prefs", it pauses with an incorrect password for a few seconds, then visually shakes indicating it's a wrong password. With the App Store prefs, it just instantly closes the authentication dialog, even with a blank password. I don't really understand the logic as to why some panels in preferences have padlocks and others don't... Why does date/time need admin rights whereas Network (delete/add/reconfigure networking), Internet Accounts (delete/add any accounts?), iCloud (do all manner of things), Time Machine (back a machine up elsewhere?) don't require it?
- ryanianian 9y ago
  It's concerning there's a UI element that displays as a padlock and shows the standard auth dialog but then doesn't actually do any auth. If this is easy to do by mistake, where else is this hiding?
- dkonofalski 9y ago
  I would imagine it's because changing the system date/time could be used nefariously whereas iCloud, Internet Accounts, and Network would all require passwords for the individual accounts/networks to do anything with them.
  - pishpash 9y ago
    Date time manipulation can be used to bypass expired certificates.
    - dkonofalski 9y ago
      Exactly my point.
- ZoFreX 9y ago
  > it pauses with an incorrect password for a few seconds, then visually shakes indicating it's a wrong password This is also the behaviour of the App Store preferences in version 10.13.1
- pishpash 9y ago
  Indeed, App Store pref box has no lock in 10.11.
- briffle 9y ago
  Most OS's require admin rights to change the date/time because of the ability to mess with things like kerberos ticket TTL's, and other security issues.
  - christoph 9y ago
    I can understand why it would be there for date & time. I guess I more don't understand why it's not there for networking - you can add a proxy in (or even a whole new network adapter) for all network traffic without admin rights!?
    - derefr 9y ago
      I don't think "sharing-only" accounts can; only regular accounts. Keep in mind that a non-"sharing only" account is an account with a special privilege: it can log in through the local-framebuffer LoginWindow. This translates to an assumption that the computer is–at least temporarily—in the physical possession of said user. They're at least sitting down in front of it; they may have been leased it by their employer. The global prefs that can be reconfigured by "regular users" (i.e. non-"sharing only" users) are precisely those prefs required to keep the system in a working state if you're physically in possession of it and doing the things that possession of a computer implies. For example, you can move a computer you physically possess to a new location–at which point the same wireless networks won't be available, and maybe you won't be able to get online without a proxy. So, in order to ensure that just going places doesn't necessitate a call to corporate IT, the default† is to let any non-"sharing only" user configure networking. † "Default" because these prefs can be locked down using a configuration profile (like a windows Group Policy Object) by corporate IT if they need a computer specifically secured against these changes, such as a public-use kiosk.
- Pharaoh2 9y ago
  To further support your point, if you switch to a pane that does require the padlock and then switch back, the padlock is gone. Looks like someone forgot to set the padlock bar to invisible on that perf plane. It's a minor UI glitch, nothing to see here.

christoph 9y ago

My guess is that the App Store preferences isn't even meant to have the padlock. iCloud prefs doesn't have it, so I can only assume it's there by mistake. If you try the same thing with say "Time & date prefs", it pauses with an incorrect password for a few seconds, then visually shakes indicating it's a wrong password. With the App Store prefs, it just instantly closes the authentication dialog, even with a blank password. I don't really understand the logic as to why some panels in preferences have padlocks and others don't... Why does date/time need admin rights whereas Network (delete/add/reconfigure networking), Internet Accounts (delete/add any accounts?), iCloud (do all manner of things), Time Machine (back a machine up elsewhere?) don't require it?

ryanianian 9y ago
It's concerning there's a UI element that displays as a padlock and shows the standard auth dialog but then doesn't actually do any auth. If this is easy to do by mistake, where else is this hiding?
dkonofalski 9y ago
I would imagine it's because changing the system date/time could be used nefariously whereas iCloud, Internet Accounts, and Network would all require passwords for the individual accounts/networks to do anything with them.
- pishpash 9y ago
  Date time manipulation can be used to bypass expired certificates.
  - dkonofalski 9y ago
    Exactly my point.
ZoFreX 9y ago
> it pauses with an incorrect password for a few seconds, then visually shakes indicating it's a wrong password This is also the behaviour of the App Store preferences in version 10.13.1
pishpash 9y ago
Indeed, App Store pref box has no lock in 10.11.
briffle 9y ago
Most OS's require admin rights to change the date/time because of the ability to mess with things like kerberos ticket TTL's, and other security issues.
- christoph 9y ago
  I can understand why it would be there for date & time. I guess I more don't understand why it's not there for networking - you can add a proxy in (or even a whole new network adapter) for all network traffic without admin rights!?
  - derefr 9y ago
    I don't think "sharing-only" accounts can; only regular accounts. Keep in mind that a non-"sharing only" account is an account with a special privilege: it can log in through the local-framebuffer LoginWindow. This translates to an assumption that the computer is–at least temporarily—in the physical possession of said user. They're at least sitting down in front of it; they may have been leased it by their employer. The global prefs that can be reconfigured by "regular users" (i.e. non-"sharing only" users) are precisely those prefs required to keep the system in a working state if you're physically in possession of it and doing the things that possession of a computer implies. For example, you can move a computer you physically possess to a new location–at which point the same wireless networks won't be available, and maybe you won't be able to get online without a proxy. So, in order to ensure that just going places doesn't necessitate a call to corporate IT, the default† is to let any non-"sharing only" user configure networking. † "Default" because these prefs can be locked down using a configuration profile (like a windows Group Policy Object) by corporate IT if they need a computer specifically secured against these changes, such as a public-use kiosk.
Pharaoh2 9y ago
To further support your point, if you switch to a pane that does require the padlock and then switch back, the padlock is gone. Looks like someone forgot to set the padlock bar to invisible on that perf plane. It's a minor UI glitch, nothing to see here.