3 ms·

T2 Mac security vulnerability means passwords can now be cracked

32 points by stalfosknight 5y ago

java-man 5y ago
"Passware is now offering an add-on module that can defeat Macs with the T2 chip, apparently by bypassing the features designed to prevent multiple guesses." Color me skeptic, but I can't believe this is not intentional. You had one job, to prevent an attacker from trying multiple times. I do not think the people who designed the chip were amateurs.
- olliej 5y ago
  Bugs happen, and bugs making it possible to bypass password retry limits have happened across multiple manufacturers (including apple)
- baybal2 5y ago
  > I do not think the people who designed the chip were amateurs. How do you define amateurs? Most chip designers in US will work on less than 10 designs in their lifetimes. In Asia, a chip outsourcing shop pumps out that much in a month.
- rnk 5y ago
  Don't necessarily ascribe that to malice. What hasn't been hacked, in terms of websites, auth schemes, web browsers? Nothing! Was that all intentional- the answer is no.
treesknees 5y ago
>The process is still slower than usual, at a relatively sedate 15-ish passwords per second. In theory, this could still take thousands of years, but most people use relatively short passwords which are vulnerable to dictionary attacks. The average password length is just six characters, which can be cracked in around 10 hours. This means anyone with a strong password are still reasonably safe. I'd say the T2 security has been degraded but not completely compromised. >Passware says that the add-on module is only available to government customers, as well as private companies who can supply a valid justification for its use. Oh that makes me feel better... /s
kylehotchkiss 5y ago
Knowing this is one of the worst T2 attacks after several years makes me feel slightly more secure. * Requires physical access to computer * If https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords says your password hasn't been "pwned", the dictionary attacks for Passware likely won't include you, and the crack time is still going to take a very long time Still, I hope Apple makes a quantum leap with T3 before less ethical governments start getting their hands on these tools

32 points by stalfosknight 5y ago

"Passware is now offering an add-on module that can defeat Macs with the T2 chip, apparently by bypassing the features designed to prevent multiple guesses." Color me skeptic, but I can't believe this is not intentional. You had one job, to prevent an attacker from trying multiple times. I do not think the people who designed the chip were amateurs.

olliej 5y ago
Bugs happen, and bugs making it possible to bypass password retry limits have happened across multiple manufacturers (including apple)
baybal2 5y ago
> I do not think the people who designed the chip were amateurs. How do you define amateurs? Most chip designers in US will work on less than 10 designs in their lifetimes. In Asia, a chip outsourcing shop pumps out that much in a month.
rnk 5y ago
Don't necessarily ascribe that to malice. What hasn't been hacked, in terms of websites, auth schemes, web browsers? Nothing! Was that all intentional- the answer is no.

treesknees 5y ago

>The process is still slower than usual, at a relatively sedate 15-ish passwords per second. In theory, this could still take thousands of years, but most people use relatively short passwords which are vulnerable to dictionary attacks. The average password length is just six characters, which can be cracked in around 10 hours. This means anyone with a strong password are still reasonably safe. I'd say the T2 security has been degraded but not completely compromised. >Passware says that the add-on module is only available to government customers, as well as private companies who can supply a valid justification for its use. Oh that makes me feel better... /s

kylehotchkiss 5y ago

Knowing this is one of the worst T2 attacks after several years makes me feel slightly more secure. * Requires physical access to computer * If https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords says your password hasn't been "pwned", the dictionary attacks for Passware likely won't include you, and the crack time is still going to take a very long time Still, I hope Apple makes a quantum leap with T3 before less ethical governments start getting their hands on these tools