tag:blogger.com,1999:blog-46781154971301693622011-07-07T15:48:07.765-07:00Oresteshttp://www.blogger.com/profile/13285144182851574837noreply@blogger.comBlogger11100tag:blogger.com,1999:blog-4678115497130169362.post-25561971181595263462009-10-31T15:55:00.000-07:002009-10-31T16:13:33.765-07:00My 14 year old son pointed this one out and I was shocked when I saw him do this on the Mac. We both have user accounts on the same machine (both with admin <span class="blsp-spelling-corrected" id="SPELLING_ERROR_0">privileges</span>) which is a <span class="blsp-spelling-error" id="SPELLING_ERROR_1">MacBook</span> Pro running version 10.5.8 with all the latest updates. With my account logged in I shut the lid and put the Mac to sleep.<div><br /></div><div>He then said, "Dad let me show you something". He opened the lid and it showed the <span class="blsp-spelling-error" id="SPELLING_ERROR_2">login</span> screen with my name and an empty password field. On that same <span class="blsp-spelling-error" id="SPELLING_ERROR_3">login</span> dialog box he changed the user name to his name and entered his password. The expected result here should be that it should log him into his account right? The actual result is that the Mac lets him unlock the screen using his password and actually use my account as if it was me who had entered my own password!</div><div><br /></div><div>This is obviously a huge security flaw. A user of a machine can access another user's account on the same machine and have full control over applications and files and impersonate that user any time.</div><div><br /></div><div>Has anyone else seen this? I am amazed that Apple has not come across this before and has not fixed this. Can anyone else verify that they can do this on their Mac? Does anyone know whether this was fixed in Snow Leopard?</div><div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/4678115497130169362-2556197118159526346?l=orestesm.blogspot.com' alt='' /></div>Oresteshttp://www.blogger.com/profile/13285144182851574837noreply@blogger.com3