4 ms·

Okay, okay. You insinuated nothing. I stand corrected. Just a little side note: You didn't need root for the exploit, it was also trivial to boot from a CD or a

by 13415 6y ago

Okay, okay. You insinuated nothing. I stand corrected. Just a little side note: You didn't need root for the exploit, it was also trivial to boot from a CD or another OS to get the passphrase from the page file. Basically it meant that file vault was useless for many years. Anyway, you're kind of missing my point. There are plenty of other examples of Apple not addressing security issues in time. Be that as it may, if you feel secure about your Mac, who am I to argue with that...

zepto 6y ago
Ok - physical without root definitely makes it worse, but it’s still not open to a remote exploit. Yes, some people need worry about people entering their office to steal their home directories, but it’s not a simple thing to exploit. Apple is quite slow to address certain issues, but on the whole end user security is still excellent for most end-users now.
- 13415 6y ago
  Well, the whole point of encrypted home directories is to secure the data when the user is not logged in and does not attend the machine...
  - zepto 6y ago
    Sure - but not only against physical access, also against remote. And let’s remember - this is a fixed problem. Obviously they did care about it.
    - 13415 6y ago
      > Sure - but not only against physical access, also against remote. Not really. An encrypted home directory is mounted when the user is logged in and surfs the web. If there is a remote exploit, then the attacker can just read the unencrypted data. And as I've said, they started caring about it after many years and when the exploit was on every Mac fan page.
      - brokenmachine 6y ago
        Shamelessly copied from sracer [1] Here's the typical cycle for problems reported on Apple products: 1. A few members post reports of the problem, report it to Apple 2. No response from Apple 3. Increased number of people report the issue 4. No response from Apple 5. Apple apologists dismiss the reports as very rare, the result of trolling, or exaggeration by drama queens 6. Even more reports of the problem 7. No response from Apple 8. News of the problem hits blogs 9. Apple apologists dismiss the blogs as simply engaging in clickbait 10. No response from Apple 11. Those affected by the issue threaten a class-action lawsuit 12. Apple apologists decry the "sue happy" nature of American consumers 13. Apple acknowledges the legitimacy of the problem 14. Apple apologists are silent 15. Apple release an update to correct the problem or 15. They set up a "program" to address the problem. 16. Apple gains some positive publicity 17. Apple apologists applaud Apple for doing the "right thing". (for an issue that they said from day-1 was not actually an issue) 18. First hand experience with the “program” reveals very strict guidelines and restrictions that greatly reduce the number of affected customers that can participate in the program. [1] https://forums.macrumors.com/threads/apple-faces-another-class-action-macbook-pro-flexgate-lawsuit.2250753/post-28920028 https://forums.macrumors.com/threads/apple-faces-another-cla...

by 13415 6y ago

zepto 6y ago

Ok - physical without root definitely makes it worse, but it’s still not open to a remote exploit. Yes, some people need worry about people entering their office to steal their home directories, but it’s not a simple thing to exploit. Apple is quite slow to address certain issues, but on the whole end user security is still excellent for most end-users now.

13415 6y ago
Well, the whole point of encrypted home directories is to secure the data when the user is not logged in and does not attend the machine...
- zepto 6y ago
  Sure - but not only against physical access, also against remote. And let’s remember - this is a fixed problem. Obviously they did care about it.
  - 13415 6y ago
    > Sure - but not only against physical access, also against remote. Not really. An encrypted home directory is mounted when the user is logged in and surfs the web. If there is a remote exploit, then the attacker can just read the unencrypted data. And as I've said, they started caring about it after many years and when the exploit was on every Mac fan page.
    - brokenmachine 6y ago
      Shamelessly copied from sracer [1] Here's the typical cycle for problems reported on Apple products: 1. A few members post reports of the problem, report it to Apple 2. No response from Apple 3. Increased number of people report the issue 4. No response from Apple 5. Apple apologists dismiss the reports as very rare, the result of trolling, or exaggeration by drama queens 6. Even more reports of the problem 7. No response from Apple 8. News of the problem hits blogs 9. Apple apologists dismiss the blogs as simply engaging in clickbait 10. No response from Apple 11. Those affected by the issue threaten a class-action lawsuit 12. Apple apologists decry the "sue happy" nature of American consumers 13. Apple acknowledges the legitimacy of the problem 14. Apple apologists are silent 15. Apple release an update to correct the problem or 15. They set up a "program" to address the problem. 16. Apple gains some positive publicity 17. Apple apologists applaud Apple for doing the "right thing". (for an issue that they said from day-1 was not actually an issue) 18. First hand experience with the “program” reveals very strict guidelines and restrictions that greatly reduce the number of affected customers that can participate in the program. [1] https://forums.macrumors.com/threads/apple-faces-another-class-action-macbook-pro-flexgate-lawsuit.2250753/post-28920028 https://forums.macrumors.com/threads/apple-faces-another-cla...