Apple security blunder exposes Lion login passwords in clear text

Re:Apple security blunder exposes Lion login passwords in cl... by tptacek on Sunday May 06, 2012 @02:15PM (#3935803)

You're the one person I know, now. Most everyone I knew that cared to encrypt their laptops (to be clear: that includes my whole team) used PGP WDE. My impression of legacy "homedir" Filevault is that it randomly ate homedirs.

[ Parent | on HN ]

Re:Apple security blunder exposes Lion login passwords in cl... by jwr on Sunday May 06, 2012 @02:20PM (#3935812)

I used it for many years, so did many people I know. Never got any "impressions" about it. It had its (many) flaws, but worked fine for me and was certainly better than no encryption at all.

[ Parent | on HN ]

Re:Apple security blunder exposes Lion login passwords in cl... by tptacek on Sunday May 06, 2012 @02:26PM (#3935835)

UNCLE. I'm wrong. People used homedir Filevault.

I stand by (most of) my original comment.

[ Parent | on HN ]

Re:Apple security blunder exposes Lion login passwords in cl... by nnnnnnnn on Sunday May 06, 2012 @04:04PM (#3936142)

"and was certainly better than no encryption at all."

Evidently not!

[ Parent | on HN ]

Re:Apple security blunder exposes Lion login passwords in cl... by farmdawgnation on Sunday May 06, 2012 @02:35PM (#3935869)

I never had legacy FileVault eat my homedir, but I did have issues with it forgetting what program was supposed to be used to open what kinds of files. Very strange, that.

[ Parent | on HN ]

Re:Apple security blunder exposes Lion login passwords in cl... by nigelk on Sunday May 06, 2012 @04:04PM (#3936138)

From memory this was due to LaunchServices not waiting until the home directory was completely mounted, and thus launching with default prefs.

There was a workaround I had running for a while in a large deployment in the form of a logouthook that would copy the relevant prefs to a location that LaunchServices would find it before FileVault finished mounting the home directory.

There were a lot of corporate/education deployments running "legacy" FileVault who hadn't invested in PGP WDE or other commercial options, and I bet they haven't all upgraded instantly to the new FileVault when they moved to Lion.

[ Parent | on HN ]

Re:Apple security blunder exposes Lion login passwords in cl... by batista on Sunday May 06, 2012 @03:04PM (#3935965)

>You're the one person I know, now.

Which means nothing at all, especially since hackers are not known for their extended social circles. It's also the dictionary definition of "anecdotal evidence".

If you want to gauge how many people used the old FileVault, well, one of the ways would be to compare old FileVault support mailing list traffic to the traffic for lists of other OS X offerings.

[ Parent | on HN ]