Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Major security flaw!

G

gurbinav

macrumors newbie
Original poster
Aug 16, 2011
6
0
Everyone's talking about how you can unlock the device without a passcode which is minor. Here's what we need to worry about:

Go into Preferences>Safari>Passwords and Autofill>Saved passwords

There you'll find all of your saved passwords in PLAIN TEXT.
 
M

Mentat2K

macrumors newbie
Jul 24, 2013
3
1
Uau, that's a "big" finding!

So... do you want to see the password like *****?
What is the use?
You can use that list if you forget a password.

The simple rule is "never let a browser memorise passwords!"

The same thing on desktops!

P.S. Use 1password for logins on Windows/Mac/IOS
 
B

bbfc

macrumors 68040
Oct 22, 2011
3,849
1,612
Newcastle, England.
gurbinav said:
Everyone's talking about how you can unlock the device without a passcode which is minor. Here's what we need to worry about:

Go into Preferences>Safari>Passwords and Autofill>Saved passwords

There you'll find all of your saved passwords in PLAIN TEXT.
Click to expand...

It asks for your passcode when you go to view any password.
 
G

gurbinav

macrumors newbie
Original poster
Aug 16, 2011
6
0
I dont have a passcode lock set. My phone rarely leaves my hands and if it were to get stolen I know I would need to change my passwords immediately. That was a risk I was willing to take.

Now, however, instead of having to gain physical access to my phone for a significant amount of time, finding out passwords is a matter of 30 seconds of snooping!
 
S

sim667

macrumors 65816
Dec 7, 2010
1,390
2,915
gurbinav said:
I dont have a passcode lock set. My phone rarely leaves my hands and if it were to get stolen I know I would need to change my passwords immediately. That was a risk I was willing to take.

Now, however, instead of having to gain physical access to my phone for a significant amount of time, finding out passwords is a matter of 30 seconds of snooping!
Click to expand...

Put a passcode lock on it then.

Anyone who doesnt have a passcode lock deserves to have their details nicked if they lose their phone.
 
M

marktuk

macrumors member
Dec 27, 2011
52
1
It shouldn't display them full stop. It should just show the user name and the fact you have a saved password. The only options should be to delete it, or re-enter it if it has changed.

It shouldn't be a password reminder service, put a "hint" field in for that.

This is pretty basic stuff that was standardised in the software industry years ago.
 
G

gurbinav

macrumors newbie
Original poster
Aug 16, 2011
6
0
@sim
My entire point was losing your phone is no longer a requirement.

----------

@eresin

http://m.bbc.co.uk/news/technology-24170429
 
T

Todd B.

macrumors 6502
May 1, 2013
434
1
Don't worry, Google says this is all in the name of "promoting security"....

Seriously, though, iCloud Keychain is going to solve this (and you shouldn't be saving passwords in the browser any way).
 
Steve121178

Steve121178

macrumors 603
Apr 13, 2010
6,403
6,969
Bedfordshire, UK
Todd B. said:
Don't worry, Google says this is all in the name of "promoting security"....

Seriously, though, iCloud Keychain is going to solve this (and you shouldn't be saving passwords in the browser any way).
Click to expand...

I don't rate Apple's security or their response to security issues so I'll be damned if I'm going to let my passwords sit on Apple's servers.
 
maflynn

maflynn

macrumors Haswell
May 3, 2009
73,489
43,414
[MOD NOTE]
Thread reopened - the linked news story is about a different security flaw. Sorry for the confusion.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom