Re:macOS High Sierra: Anyone can login as “root” with empty ...
by ben_w on Tuesday November 28, 2017 @05:11PM
(#15802340)
> admittedly low priority security vuln, passwords being sent over http
Wait, what?
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by ig1 on Tuesday November 28, 2017 @05:23PM
(#15802443)
Unfortunately it's still more common than you think.
The other day I actually ran across some AWS docs which suggest you send your AWS root key id in the url of http requests:
http://docs.aws.amazon.com/AlexaWebInfoService/latest/index....
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by dsmithatx on Tuesday November 28, 2017 @06:44PM
(#15803136)
Wow I didn't believe this at first, so I dug more. AWIS requires the root key of an AWS account. I found a forum that does suggest creating a new account solely for AWIS.
https://forums.aws.amazon.com/thread.jspa?threadID=126537
Still I'm surprised they would suggest sending the root key to your account over http. Even if it is just the id and not secret it still seems like something you want to keep secure. I don't use my root key for services. I create new accounts and IAM roles.
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by COMMENT___ on Wednesday November 29, 2017 @01:58AM
(#15805146)
> complaining on Twitter is probably what an average person would do.
His twitter account tells that he is an agile software craftsman, turkey founder and a community guy. And he tweets about devops, open source and other stuff.
An average person disguised as a software developer?
Although for what it's worth last time I reported a security vuln to Apple using their official process they took around 2 years to fix it (admittedly low priority security vuln, passwords being sent over http).