4 ms·
You insinuated it, though, by claiming that it wasn't a security problem as it required root. If you think failure to encrypt (leaking the passphrase) is not a
by 13415 6y ago
You insinuated it, though, by claiming that it wasn't a security problem as it required root. If you think failure to encrypt (leaking the passphrase) is not a problem because the exploit requires root, then you understand absolutely nothing about security.
By the way, the reason why I mentioned this particular example is that it almost certainly proves malicious intent. It is not credible that a team of security engineers at Apple developed file vault without thinking at all about locking memory for the passphrase and then continued not to think about it for years. They basically only fixed it (and first even in the wrong way) after it became folklore on every second Mac fan site. (Lost your file vault password? Don't despair: Just copy & paste this in the terminal.)
There is 0 reason to trust Apple on security.
- zepto 6y ago> You insinuated it, though by claiming that it wasn't a security problem as it required root I did make any such claim. You are seeing things where they aren’t. Encryption at rest is very important. However, it’s worth putting different risks into perspective. What you can do if you have root, simply is a different category of risk than what you can do without. Pointing that out insinuates nothing. > By the way, the reason why I mentioned this particular example is that it almost certainly proves malicious intent. Obviously not, because otherwise they wouldn’t have fixed it. That you can find a security problem from the past that has now been fixed, is the precise opposite of evidence that a company doesn’t care about security.
- 13415 6y agoOkay, okay. You insinuated nothing. I stand corrected. Just a little side note: You didn't need root for the exploit, it was also trivial to boot from a CD or another OS to get the passphrase from the page file. Basically it meant that file vault was useless for many years. Anyway, you're kind of missing my point. There are plenty of other examples of Apple not addressing security issues in time. Be that as it may, if you feel secure about your Mac, who am I to argue with that...
- zepto 6y agoOk - physical without root definitely makes it worse, but it’s still not open to a remote exploit. Yes, some people need worry about people entering their office to steal their home directories, but it’s not a simple thing to exploit. Apple is quite slow to address certain issues, but on the whole end user security is still excellent for most end-users now.
- 13415 6y agoWell, the whole point of encrypted home directories is to secure the data when the user is not logged in and does not attend the machine...
- zepto 6y agoSure - but not only against physical access, also against remote. And let’s remember - this is a fixed problem. Obviously they did care about it.
- 13415 6y ago> Sure - but not only against physical access, also against remote. Not really. An encrypted home directory is mounted when the user is logged in and surfs the web. If there is a remote exploit, then the attacker can just read the unencrypted data. And as I've said, they started caring about it after many years and when the exploit was on every Mac fan page.
- brokenmachine 6y agoShamelessly copied from sracer [1] Here's the typical cycle for problems reported on Apple products: 1. A few members post reports of the problem, report it to Apple 2. No response from Apple 3. Increased number of people report the issue 4. No response from Apple 5. Apple apologists dismiss the reports as very rare, the result of trolling, or exaggeration by drama queens 6. Even more reports of the problem 7. No response from Apple 8. News of the problem hits blogs 9. Apple apologists dismiss the blogs as simply engaging in clickbait 10. No response from Apple 11. Those affected by the issue threaten a class-action lawsuit 12. Apple apologists decry the "sue happy" nature of American consumers 13. Apple acknowledges the legitimacy of the problem 14. Apple apologists are silent 15. Apple release an update to correct the problem or 15. They set up a "program" to address the problem. 16. Apple gains some positive publicity 17. Apple apologists applaud Apple for doing the "right thing". (for an issue that they said from day-1 was not actually an issue) 18. First hand experience with the “program” reveals very strict guidelines and restrictions that greatly reduce the number of affected customers that can participate in the program. [1] https://forums.macrumors.com/threads/apple-faces-another-class-action-macbook-pro-flexgate-lawsuit.2250753/post-28920028 https://forums.macrumors.com/threads/apple-faces-another-cla...