17 ms·

If this is reported correctly, it sounds like passwords are stored in memory for quite a while in their unhashed, clear text form. This is not good for people

If this is reported correctly, it sounds like passwords are stored in memory for quite a while in their unhashed, clear text form. This is not good for people that depend on FileVault as a way to assume that physical access doesn't necessarily compromise their data. It's a little hard to believe this as there's really no need to have the password kept in memory; it could be the exploit requires the device to be plugged in while you're typing your password--which is more believable and also less interesting.

sp332 15y ago
If you have the autologin feature enabled, which would you prefer: keep the password in RAM, where most people can't get it, or put it on the hard drive, which is a much easier target?
- deleted 15y ago
  [deleted]
- ovi256 15y ago
  But why would the autologin implementation need access to the cleartext password ? And then why is the cleartext password stored at all ? These seems like big holes.
  - epochwolf 15y ago
    On OSX, probably to unlock keychain.
    - Sidnicious 15y ago
      Yep: http://www.brock-family.org/gavin/perl/kcpassword.html http://www.brock-family.org/gavin/perl/kcpassword.html
DmitrySumin 15y ago
Mac OS X 10.6 and 10.7 do store clear-text passwords in memory, long after login.
- eropple 15y ago
  It uses them, too. For convenience's sake (because everything else is locked under other passwords) I use the same usernames/passwords for my local machines, and without prompting me my new Mini was able to access SMB shares on other machines. I'm not terribly worried about it because this password is unique to local logins on my own network, but it was a little unnerving.
Locke1689 15y ago
If you have full disc encryption enabled, you'll need to keep the encryption key in memory somewhere (encrypted or not). Basically, if an attacker gets hold of your running computer and you don't have serious hardware security then you're screwed.

sp332 15y ago

If you have the autologin feature enabled, which would you prefer: keep the password in RAM, where most people can't get it, or put it on the hard drive, which is a much easier target?

deleted 15y ago
[deleted]
ovi256 15y ago
But why would the autologin implementation need access to the cleartext password ? And then why is the cleartext password stored at all ? These seems like big holes.
- epochwolf 15y ago
  On OSX, probably to unlock keychain.
  - Sidnicious 15y ago
    Yep: http://www.brock-family.org/gavin/perl/kcpassword.html http://www.brock-family.org/gavin/perl/kcpassword.html

DmitrySumin 15y ago

Mac OS X 10.6 and 10.7 do store clear-text passwords in memory, long after login.

eropple 15y ago
It uses them, too. For convenience's sake (because everything else is locked under other passwords) I use the same usernames/passwords for my local machines, and without prompting me my new Mini was able to access SMB shares on other machines. I'm not terribly worried about it because this password is unique to local logins on my own network, but it was a little unnerving.

Locke1689 15y ago

If you have full disc encryption enabled, you'll need to keep the encryption key in memory somewhere (encrypted or not). Basically, if an attacker gets hold of your running computer and you don't have serious hardware security then you're screwed.