4 ms·

sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the

sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the osx security model, this sounds like not a big deal?

TheCoreh 9y ago
On OS X, administrative accounts still need to authenticate with their passwords to perform administrative tasks. This is to avoid (presumably) someone using your computer and changing settings without your consent if you have automatic login enabled, and to make sure you pay attention to what you're doing (similar to the UAC prompts on Windows, and sudo on Windows)
- TheCoreh 9y ago
  I can no longer edit the comment above, but I meant sudo on linux, not on Windows.
gregoriol 9y ago
As long as a password is requested, it has to be checked! Also this wasn't possible on Sierra.
aetherson 9y ago
For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. This prevents a situation where the actual admin logs in, their attention is taken away from the computer, and someone sits at their chair and does awful things with the computer.
- oneeyedpigeon 9y ago
  > For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. If that's the case, no-one told the `sudo` command...
  - mikestew 9y ago
    Sudo requires a password, so I’m confused. Do you mean the period of time before it requires entering creds again?
    - oneeyedpigeon 9y ago
      Yes, exactly. It requires a password, then doesn't require a password on subsequent attempts for a certain period of time.
      - natch 9y ago
        Good point. Clearly with sudo, aside from it following the UNIX convention for sudo, it is just a consciously made tradeoff between security and ease of use. Whereas with the security pane, the lack of checking of the password that is entered is most likely a bug. Maybe you already saw this but I see they also made the same security/ease of use tradeoff for the (non-buggy) locks in the other preference panes. After unlocking, it stays unlocked for a period of time while you are in preferences, even if you visit different areas within preferences and come back.
        aetherson 9y ago
        It's not "most likely" a bug, it's definitely a bug. Nobody said, "We want to lower the security level of this feature, so let's keep the password prompt but allow any input to the password prompt."
      - ac29 9y ago
        Yes, but this is configurable all the way down to 0 minutes (always require password) [0]. [0] https://askubuntu.com/questions/636092/how-to-get-sudo-to-prompt-you-for-a-password-each-time https://askubuntu.com/questions/636092/how-to-get-sudo-to-pr...
- dkonofalski 9y ago
  What "awful" things could be done exactly in the App Store panel?
  - raverbashing 9y ago
    Disabling password requirements for app purchases Disabling/enabling automatic updates
    - dkonofalski 9y ago
      The App Store would prompt them for the Apple ID password for the first purchase made after this change. I fail to see how automatic updates would be "awful".
      - dajohnson89 9y ago
        install an app on host machine, and then release a malicious update for it.
        dkonofalski 9y ago
        That would require Apple to approve the malicious update which probably won't happen. Not an issue.
  - Someone1234 9y ago
    If they have "'Always Require' Password for Purchase" enabled, you could disable that and buy apps from the app store without a password. For example you could let your kid use your Mac, but you don't want them spending your money via your app-store linked credit card. If they have access to the App Store Preferences panel they can disable the requirement and do so.
    - dkonofalski 9y ago
      They would be prompted for the App Store password the first time a purchase was made after this is disabled so, no, that's not an issue here.
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
kfriede 9y ago
I don't believe it is, necessarily. The issue is that doing this action requires the admin to re-enter their credentials. In this case, any credentials work, meaning that if a "guest" user (semi-trusted by the account owner, obviously using the owner's credentials. ) were attempting to change these settings, they could bypass the prompt with a bogus password instead of the alternative which requires the guest to ask the owner to enter their password.
deleted 9y ago
[deleted]
mikestew 9y ago
You have the power, but the system would like to check that it is actually you and not a malicious script. It is the compromise between running as non-admin and running sudo for ever friggin’ thing and running wide open to the world as admin.
deleted 9y ago
[deleted]
sharkjacobs 9y ago
this isn't a dangerous bug itself, it matters because it exists at all and raises concerns that similar bugs might exist in places where security might actually matter.

TheCoreh 9y ago

On OS X, administrative accounts still need to authenticate with their passwords to perform administrative tasks. This is to avoid (presumably) someone using your computer and changing settings without your consent if you have automatic login enabled, and to make sure you pay attention to what you're doing (similar to the UAC prompts on Windows, and sudo on Windows)

TheCoreh 9y ago
I can no longer edit the comment above, but I meant sudo on linux, not on Windows.

gregoriol 9y ago

As long as a password is requested, it has to be checked! Also this wasn't possible on Sierra.

aetherson 9y ago

For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. This prevents a situation where the actual admin logs in, their attention is taken away from the computer, and someone sits at their chair and does awful things with the computer.

oneeyedpigeon 9y ago
> For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. If that's the case, no-one told the `sudo` command...
- mikestew 9y ago
  Sudo requires a password, so I’m confused. Do you mean the period of time before it requires entering creds again?
  - oneeyedpigeon 9y ago
    Yes, exactly. It requires a password, then doesn't require a password on subsequent attempts for a certain period of time.
    - natch 9y ago
      Good point. Clearly with sudo, aside from it following the UNIX convention for sudo, it is just a consciously made tradeoff between security and ease of use. Whereas with the security pane, the lack of checking of the password that is entered is most likely a bug. Maybe you already saw this but I see they also made the same security/ease of use tradeoff for the (non-buggy) locks in the other preference panes. After unlocking, it stays unlocked for a period of time while you are in preferences, even if you visit different areas within preferences and come back.
      - aetherson 9y ago
        It's not "most likely" a bug, it's definitely a bug. Nobody said, "We want to lower the security level of this feature, so let's keep the password prompt but allow any input to the password prompt."
    - ac29 9y ago
      Yes, but this is configurable all the way down to 0 minutes (always require password) [0]. [0] https://askubuntu.com/questions/636092/how-to-get-sudo-to-prompt-you-for-a-password-each-time https://askubuntu.com/questions/636092/how-to-get-sudo-to-pr...
dkonofalski 9y ago
What "awful" things could be done exactly in the App Store panel?
- raverbashing 9y ago
  Disabling password requirements for app purchases Disabling/enabling automatic updates
  - dkonofalski 9y ago
    The App Store would prompt them for the Apple ID password for the first purchase made after this change. I fail to see how automatic updates would be "awful".
    - dajohnson89 9y ago
      install an app on host machine, and then release a malicious update for it.
      - dkonofalski 9y ago
        That would require Apple to approve the malicious update which probably won't happen. Not an issue.
- Someone1234 9y ago
  If they have "'Always Require' Password for Purchase" enabled, you could disable that and buy apps from the app store without a password. For example you could let your kid use your Mac, but you don't want them spending your money via your app-store linked credit card. If they have access to the App Store Preferences panel they can disable the requirement and do so.
  - dkonofalski 9y ago
    They would be prompted for the App Store password the first time a purchase was made after this is disabled so, no, that's not an issue here.

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

kfriede 9y ago

I don't believe it is, necessarily. The issue is that doing this action requires the admin to re-enter their credentials. In this case, any credentials work, meaning that if a "guest" user (semi-trusted by the account owner, obviously using the owner's credentials. ) were attempting to change these settings, they could bypass the prompt with a bogus password instead of the alternative which requires the guest to ask the owner to enter their password.

deleted 9y ago

[deleted]

mikestew 9y ago

You have the power, but the system would like to check that it is actually you and not a malicious script. It is the compromise between running as non-admin and running sudo for ever friggin’ thing and running wide open to the world as admin.

deleted 9y ago

[deleted]

sharkjacobs 9y ago

this isn't a dangerous bug itself, it matters because it exists at all and raises concerns that similar bugs might exist in places where security might actually matter.