Hacker News Reader

Comment by tauntz | Hacker News Reader

Mi kid got around the lock screen of my mac. Twice.

It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months. After that I took my phone, sat him behind my computer and started to record him playing with the buttons but it never happened again and my hopes of getting a bug bounty from Apple vanished :(

View on HN

My kid (3 years old then) found an issue in the MacOS lock screen as well. It didn't result in a bypass, but a "Spinning Beach Ball of Death". I could then reproduce it and even filed an issue, but only I could reproduce (and one funny response was: "Why would you want a screen shot of the screen sleeping? It would just be black." - well tell that to my kid): https://discussions.apple.com/thread/7598463

> https://discussions.apple.com/thread/7598463

Wow every new person who joins that thread misses the point more than the previous one. This was painful to read.

Here's the last reply before the thread was locked:

> I don't see the point of pressing the wrong series of key combinations nine or more times in a row constitutes a "Login Window ScreenShot Problem" any more than dropping my MacBook from various heights until it breaks is a reliability problem.

Why do people hold computers to such a lower standard than other complex devices in their life? (Serious question -- I don't understand people very well here.)

Can you imagine a car that wouldn't unlock or start if a passerby without the key plays with the door handles too much? If this has happened and is documented, that alone is a testament to its rarity and people's unwillingness to excuse the behavior.

Unless it happened to early Tesla, because they were held to the lower standard applied to computers and OSs. That doesn't seem to be as true anymore, thankfully.

>Unless it happened to early Tesla, because they were held to the lower standard applied to computers and OSs. That doesn't seem to be as true anymore, thankfully.

I've definitely had my Model 3 not unlock when it should, but I've never had it go the other way around.

genuine question: Is that dialabrain person an Apple employee or just a user?

I was wondering as well. I _think_ he is just a user; an Apple fan ("community"). To some extend Apple employees probably moderate this forum (same as here, or at Stackoverflow.com), but most comments are from the community. I didn't find a way to file a security issue, so I thought I ask a question in this forum, hoping someone can reproduce it, and someone understands this is a security problem, and then forwards the problem to Apple. But that never happened.

With the current version of MacOS I have (not the latest), one could still cause some havoc... E.g. filling the disk by recording a movie with sound. Command+Shift+5. When mashing the keys, sometimes after login a list of message shows up ("Can not save the screenshot at this location").

That discussion railed of pretty quickly.

Probably just hit enter when the password field was empty. For some reason that bypassed all security on OS X.

You used to be able to just open up recovery mode and reset the password anyway, passwords on OS X used to be a theatre. No idea about it now though.

Still works unless you have FireVault enabled for obvious reasons.

Perhaps it was related to this bug: https://www.wired.com/story/macos-high-sierra-hack-root/

my kid got around a locked cash box yesterday. it's amazing how much security is tied to ingrained behavioural patterns

My 4 year old son manages to beach-ball the big sur lock screen about twice a week. It has resulted in lost work more than once.

On the previous version I believe he managed to unlock the computer as well, just by hammering the keyboard.

Reply on news.ycombinator.com