6 ms·
Right, no need to encrypt anything, just don't set any read permissions. Problem solved!
by 13415 6y ago
Right, no need to encrypt anything, just don't set any read permissions. Problem solved!
- zepto 6y agoNobody is saying this other than you.
- 13415 6y agoYou insinuated it, though, by claiming that it wasn't a security problem as it required root. If you think failure to encrypt (leaking the passphrase) is not a problem because the exploit requires root, then you understand absolutely nothing about security. By the way, the reason why I mentioned this particular example is that it almost certainly proves malicious intent. It is not credible that a team of security engineers at Apple developed file vault without thinking at all about locking memory for the passphrase and then continued not to think about it for years. They basically only fixed it (and first even in the wrong way) after it became folklore on every second Mac fan site. (Lost your file vault password? Don't despair: Just copy & paste this in the terminal.) There is 0 reason to trust Apple on security.
- zepto 6y ago> You insinuated it, though by claiming that it wasn't a security problem as it required root I did make any such claim. You are seeing things where they aren’t. Encryption at rest is very important. However, it’s worth putting different risks into perspective. What you can do if you have root, simply is a different category of risk than what you can do without. Pointing that out insinuates nothing. > By the way, the reason why I mentioned this particular example is that it almost certainly proves malicious intent. Obviously not, because otherwise they wouldn’t have fixed it. That you can find a security problem from the past that has now been fixed, is the precise opposite of evidence that a company doesn’t care about security.
- 13415 6y agoOkay, okay. You insinuated nothing. I stand corrected. Just a little side note: You didn't need root for the exploit, it was also trivial to boot from a CD or another OS to get the passphrase from the page file. Basically it meant that file vault was useless for many years. Anyway, you're kind of missing my point. There are plenty of other examples of Apple not addressing security issues in time. Be that as it may, if you feel secure about your Mac, who am I to argue with that...
- zepto 6y agoOk - physical without root definitely makes it worse, but it’s still not open to a remote exploit. Yes, some people need worry about people entering their office to steal their home directories, but it’s not a simple thing to exploit. Apple is quite slow to address certain issues, but on the whole end user security is still excellent for most end-users now.
- 13415 6y agoWell, the whole point of encrypted home directories is to secure the data when the user is not logged in and does not attend the machine...
- zepto 6y agoSure - but not only against physical access, also against remote. And let’s remember - this is a fixed problem. Obviously they did care about it.
- 13415 6y ago> Sure - but not only against physical access, also against remote. Not really. An encrypted home directory is mounted when the user is logged in and surfs the web. If there is a remote exploit, then the attacker can just read the unencrypted data. And as I've said, they started caring about it after many years and when the exploit was on every Mac fan page.