High Sierra vulnerability exposes the password of an encrypted APFS container

Re:High Sierra vulnerability exposes the password of an encr... by jchw on Thursday October 05, 2017 @07:26AM (#15408281)

So... it stores the password as a password hint?

One must wonder how Apple's QA process didn't catch something as egregious as that in a piece of security code.

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by natch on Thursday October 05, 2017 @11:14AM (#15409823)

Probably some unthinking tester was just using the same string in both fields (e.g. “test”). As a developer I’ve learned over the years not to do that. That tester should have their work attitude adjusted and their methods thoroughly reviewed.

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by headShrinker on Thursday October 05, 2017 @11:36AM (#15410006)

There’s probably some easy explanation but why is there a need separate code to store variables for the ssd vs hdd version? I would think this would be high level code, abstracted far away from any hardware differences

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by jsjohnst on Thursday October 05, 2017 @12:09PM (#15410285)

I believe the SSD vs HDD issue is not about the password hint codepath, but rather that APFS is only supported on SSDs right now.

[ Parent | on HN ]