7 ms·
For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. This prevents a situat
by aetherson 9y ago
For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it.
This prevents a situation where the actual admin logs in, their attention is taken away from the computer, and someone sits at their chair and does awful things with the computer.
- oneeyedpigeon 9y ago> For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. If that's the case, no-one told the `sudo` command...
- mikestew 9y agoSudo requires a password, so I’m confused. Do you mean the period of time before it requires entering creds again?
- oneeyedpigeon 9y agoYes, exactly. It requires a password, then doesn't require a password on subsequent attempts for a certain period of time.
- natch 9y agoGood point. Clearly with sudo, aside from it following the UNIX convention for sudo, it is just a consciously made tradeoff between security and ease of use. Whereas with the security pane, the lack of checking of the password that is entered is most likely a bug. Maybe you already saw this but I see they also made the same security/ease of use tradeoff for the (non-buggy) locks in the other preference panes. After unlocking, it stays unlocked for a period of time while you are in preferences, even if you visit different areas within preferences and come back.
- aetherson 9y agoIt's not "most likely" a bug, it's definitely a bug. Nobody said, "We want to lower the security level of this feature, so let's keep the password prompt but allow any input to the password prompt."
- ac29 9y agoYes, but this is configurable all the way down to 0 minutes (always require password) [0]. [0] https://askubuntu.com/questions/636092/how-to-get-sudo-to-prompt-you-for-a-password-each-time https://askubuntu.com/questions/636092/how-to-get-sudo-to-pr...
- dkonofalski 9y agoWhat "awful" things could be done exactly in the App Store panel?
- raverbashing 9y agoDisabling password requirements for app purchases Disabling/enabling automatic updates
- dkonofalski 9y agoThe App Store would prompt them for the Apple ID password for the first purchase made after this change. I fail to see how automatic updates would be "awful".
- dajohnson89 9y agoinstall an app on host machine, and then release a malicious update for it.
- dkonofalski 9y agoThat would require Apple to approve the malicious update which probably won't happen. Not an issue.
- Someone1234 9y agoIf they have "'Always Require' Password for Purchase" enabled, you could disable that and buy apps from the app store without a password. For example you could let your kid use your Mac, but you don't want them spending your money via your app-store linked credit card. If they have access to the App Store Preferences panel they can disable the requirement and do so.
- dkonofalski 9y agoThey would be prompted for the App Store password the first time a purchase was made after this is disabled so, no, that's not an issue here.