3 ms·

How hard do you think it is to steal a password once you have root?

• swiley 7y ago
  It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.
• jedieaston 7y ago
  It should be impossible with SIP enabled, as in OS X 10.14 Apple protected the files in /var/db/dslocal where the user shadow files are stored so that root could not read them (unless triggered by an Apple signed executable, like Software Update). If you are running with SIP disabled you've taken the risk of it happening, and if you are on a corporate laptop (or 99% of personal machines) it is engaged. https://apple.stackexchange.com/questions/344117/mac-10-13-10-14-where-are-the-hash-passwords-located https://apple.stackexchange.com/questions/344117/mac-10-13-1...
  • tantalor 7y ago
    Think a little harder. With root, you can install a keylogger.
    • saagarjha 7y ago
      You'd still need to bypass TCC.