5

I was looking for answers for a configuration issue on my laptop but then I got to reading the answers to this post. There was one that troubled me slightly (the last one by Lauri) which says how to fix the users problem of the lost password by rebooting it and setting a new one on boot.

This seems like a security flaw to me if it works. What if someone rebooted your mac and changed your password for giggles or to have a snoop around or set up another username etc. Is this the tip of the iceberg? How can a user prevent that sort of thing being possible?

4 Answers 4

9

Linuxios can already answered this but I'll see if I can explain in more detail. It's not always obvious why Physical Access = Game Over:

It is not a "flaw" because if an attacker has physical access to your computer, the login password cannot protect it.

If your data is not encrypted, an attacker with physical access to your computer will just remove the hard drive and put it in a different computer to read the contents. The attacker won't be running the operating system on your hard drive, he will just be reading the contents. Therefore, the prompt for your login password will never appear, as it is a function of the operating system.

As Linuxios pointed out, you can set passwords that appear when turning on the computer (aka BIOS/EFI passwords). However, someone with physical access can get around that requirement by erasing the BIOS settings (there is a jumper on most motherboards to do this), or by removing the BIOS chip entirely and replacing it with a new one.

Someone might point out that your keychain and home directory (if you opted to encrypt it) would still be secure - and that is completely true. That is exactly why you should encrypt sensitive data with a strong password, so that even if your computer is stolen, the attacker can't get it.

2
  • Does this also mean an encrypted hard drive is also difficult to recover when you have to reinstall your os?
    – Magpie
    Mar 6, 2013 at 11:57
  • 1
    It depends on the encryption method. For example, a non-System drive (i.e. A hard drive that doesn't have the Operating System on it) encrypted with Truecrypt will be completely unaffected by an OS reinstall. Ideally, you would copy data off to a safe temporary location, reinstall, and copy the data back, then wipe the temporary area clean. Mar 7, 2013 at 1:11
5

Passwords on desktop computers are meant to:

  • protect against casual attackers who cannot or do not wish to fiddle with hardware (e.g. your low-tech colleagues or siblings);
  • protect against remote attacks (passwords are used to authenticate remote logins);
  • honour a long-standing tradition of typing a password before using the system (even though this does not make much sense in many cases).

Against people who have sufficient knowledge to reboot the system and alter the boot sequence, you can use some BIOS password or equivalent (e.g. firmware password for older Mac, which can be bypassed if you are not afraid of using a screwdriver; things have somewhat changed in newer Mac systems). But this is still a deterrent, not 100% protection.

If you want your machine to remain safe against a motivated attacker who has physical access to the machine, then... you basically cannot, but partial solutions are available. The motivated attacker can open the case and simply grab the hard disk, then plug it into his own computer and see all the files. To prevent that kind of attack, you need hard disk encryption; in that case, the password is necessary to unlock the data (the attacker can bypass the operating system when he can touch the hardware, but he cannot bypass mathematics).

Of course, an attacker who can access the hardware twice can install an inconspicuous hardware keylogger at his first passage, grab your precious password when you type it, and enter the machine at his second passage. These things can be installed in a few seconds... Hard disk encryption is really efficient only against attackers who can only have a single go at it (typically, an attacker who steals a laptop).

3

This is not a security flaw. The ability to enter single user mode for password recovery and system rescue is crucial -- anyway, if someone has physical access to your computer they can already do anything they want.

3
  • What is the point in password protecting it then?
    – Magpie
    Feb 15, 2013 at 2:56
  • 4
    @Magpie: To prevent quick access by someone who only has a second to gain access, or to prevent access by the technically incompetent. These things can be prevented with a BIOS or EFI passwords required on each boot, though, you know.
    – Linuxios
    Feb 15, 2013 at 2:59
  • 1
    It's almost an answer. Can you elaborate please? -and to be hones I would be a lot more worried about someone technically competent gaining access than someone incompetent doing that!
    – Magpie
    Feb 15, 2013 at 3:31
3

Yes, you really can. This is basic to most unix systems, including both mac and linux, though Ubuntu has removed this abilitymade this more difficult (though that can be circumvented too). There are ways to try to disable it, most are hacks that are not recommended. As Linuxios said, if someone has access you your computer, they can do anything. They can go so far as to remove the hard drive and mount it on another mac; unless you've encrypted it, they'll have everything.

If your primary concern is theft and that someone might get your data, say with a macbook, consider encryption and try to keep your important data somewhere else (the cloud or backup disc that you keep locked up elsewhere - which you should have anyway).

On the other hand, if your primary concern is your snooping friend, just set the firmware password (old but still viable instructions). If the concern is your friend, definitely don't encrypt without the firmware password being set. If your 'friend' resets your password, you would lose access to the encrypted disc. You could reveal the firmware password or to bypass it completely by removing the ram on older macs and on newer macs you can use OS X Recovery, but if someone is doing things like removing your ram or running recovery disks on your system without you knowing it, you have bigger issues. You might find this linux-based explanation of the elevation of security procedures relevant.

1
  • Ubuntu removed booting into single user mode? Since when and why? Without full disk encryption that requires popping in a live cd, mounting the old hdd and editing /etc/shadow to something known.
    – dr jimbob
    Feb 15, 2013 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .