News for hackers. Stuff that matters.

A comment on macOS High Sierra: Anyone can login as “root” with empty password. Parent comment

Re:macOS High Sierra: Anyone can login as “root” with empty ... by 5ilv3r on Tuesday November 28, 2017 @06:41PM (#15803112)
Uhg, ok I forgot some people don't know the code. The old adage is "On your first day as the new sysadmin, change all the root passwords". The idea is that a SECURE root is good, possibly better than no root (which is sort of a hack in itself). There are best practices for root passwords. Things like length, composition (no dict words), disabled for remote access, and care in who is allowed to have it.

Simply pretending root does not exist is a rather new idea and is not best practice. It's only for convenience.

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by Forbo on Tuesday November 28, 2017 @07:49PM (#15803513)
> composition (no dict words),

This is an outmoded guideline for password security. String enough dictionary words together and you achieve a high level of entropy. See for example https://en.wikipedia.org/wiki/Diceware

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by saagarjha on Tuesday November 28, 2017 @06:46PM (#15803146)
> Simply pretending root does not exist is a rather new idea and is not best practice. It's only for convenience.

Says who? Sure, it's convenient not to have to worry about choosing a secure password for your root account, but why is it "sort of a hack in itself"?

[ Parent | on HN ]