Post by: Bill on July 05, 2003, 09:34:10 PM
I tried it on 10.2.6.
Didn't work.
Now the $64 question is why would anybody [thief] want to hold some blasted key down for five minutes or more just to ........
Post by: () on July 08, 2003, 12:55:14 AM
only a dummy would qualify for that job...
or maybe some people just don't have anything better to do with their time...
Post by: pendragon on July 08, 2003, 05:52:03 AM
"Mac OS X Screensaver Security: Crashing Screen Effects
Over the weekend, MacFixIt reader Charles Maurer submitted the following report, indicating yet another potentially serious security flaw in Mac OS X 10.2.6's Screensaver implementation:
"I don't know the exact amount of characters, only that if you leave a key pressed for 5 minutes or more and then hit the enter key, you crash the screensaver and gain access to the desktop. you can mess the desktop and all around it (network, mail, docs, anything you can imagine)."
Later, SecuriTeam.com posted a note stating that "It appears that MacOS X's screensaver can be crashed by providing it with between 1280 and 1380 characters (followed by pressing the Enter key)."
In January of this year, we noted an issue that allows applications to be freely quit or launched - while Mac OS X's Screen Effects is prompting for a password.
If you have Full Keyboard Access turned on (available under the Keyboard pane in System Preferences), the dock can be accessed "blind" from behind Screen Effects - you can't see the dock, but some functions using it are still accessible. On our in-house system, we have the Dock set to appear when the "Control-F3" keyboard combination is pressed.
When Screen Effects prompts for a password, pressing this keyboard combination will move the cursor out of the pop-up prompt dialog box, and onto the Dock (which is not visible). Pressing tab to switch applications, and then pressing "Q" will cause applications to quit. Likewise, pressing "Return" will cause applications to launch.
This issue significantly undermines the protection level offered by Screen Effects. If you choose to use this method of password security, make sure that Full Keyboard Access is turned off.
The bottom line is that if you want a secure Mac OS X system, do not allow any other individuals to gain physical access."
-----
Good point re physical access. Perhaps most already know, but for those who do not: presuming one has access to another's machine and you have an installation OS, and the target machine is not protected by the Open Firmware Password, all one need do is insert Disk 1 to change the password. Then, you can install the Open Firmware Password. And from then on, that machine is yours!
Harv
Post by: Bill on July 08, 2003, 09:36:54 AM
Guess I'll have to stash you BD on a cd/zip so no one will ....... <gr>
Post by: Xairbusdriver on July 08, 2003, 11:31:44 AM
Interesting article from the Toronto Star on M$'s planned 'secure PC.'
Jim C.
Post by: kelly on July 08, 2003, 12:18:30 PM
If you're serious get Panther.
"In addition, Panther includes FileVault, a new feature that secures the contents of a home directory with strong 128-bit AES encryption. With FileVault, users can select to have their whole home directory encrypted automatically so it encrypts and decrypts files on the fly, without interrupting their work. For mobile users, FileVault provides a new level of security on the road so if anyone ever tries to access a user’s account or if their notebook is lost, important data is always protected by high-security encryption."
http://www.apple.com/pr/library/2003/jun/2.../23panther.html
Post by: Bill on July 08, 2003, 01:24:45 PM
Time will tell.
Still can't see why someone would go to all the trouble of holding down a key?
Guess the 'too much time on your hands' goes for this one for sure.
Post by: Bill on July 13, 2003, 04:50:26 PM