macOS High Sierra: Anyone can login as “root” with empty password

Re:macOS High Sierra: Anyone can login as “root” with empty ... by rtpg on Wednesday November 29, 2017 @04:48AM (#15805712)

But at one point a root account is created with an empty password right?

There's a specific line somewhere that's doing this, in theory.

Maybe they should have opted for "create `root` with unguessable password"

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by akvadrako on Wednesday November 29, 2017 @05:36AM (#15805889)

No, that's a hack. And it opens new attacks, like on the hashing algorithm and poor randomness or predictability in the generation logic.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by LeifCarrotson on Wednesday November 29, 2017 @08:46AM (#15806669)

You have some pretty high standards. Being imperfect doesn't automatically make it better than the alternative of not doing it.

If the system can't generate a secure hash, or can't generate cryptographically random numbers, you're in serious trouble. Those tools are foundational to security.

Moving the problem from "a root account is created with the first password you try" to "you have to break crypt(1) or /dev/random" is basically equivalent to solving it.

[ Parent | on HN ]