Lion security flaw with "resetpassword"

[NorthDakota91]

Just yesterday I've discovered that anyone who has physical access to my Mac can easily reset just any password by using the "resetpassword" command from Lion's recovery partition. My question is: is there a way to avoid that?

[Intell]

Use a firmware password. This flaw is no different then boot the Mac from an external drive or cd.

[scottishwildcat]

I wouldn't really call it a "flaw". As any security guru will tell you, once somebody has physical access to your machine, all bets are off -- at that point, if somebody really wants access to your stuff, they can most likely get it one way or another. The best you can do is make it hard enough that they might lose interest first.

[Bear]

Two ways to avoid it. One is the firmware password. The other is Filevault 2. If the disk is encrypted, they wouldn't be able to use the reset password.

If you're worried about data security and integrity, I would recommend the FileVault 2 route as the firmware password isn't 100% secure as Apple knows how to reset it, so I'm sure others do as well.

[benwiggy]

Originally Posted by NorthDakota91

Just yesterday I've discovered that anyone who has physical access to my Mac can easily reset just any password by using the "resetpassword" command from Lion's recovery partition. My question is: is there a way to avoid that?

If they have physical access to your Mac, they can boot it up in Target mode (making the whole Mac an external drive to another Mac), or take the drive out and mount it in an external case.

The best way to avoid such problems are not to leave your expensive computer lying around, and place it in a locked drawer when you're not using it.

[ThirteenXIII]

Originally Posted by benwiggy

If they have physical access to your Mac, they can boot it up in Target mode (making the whole Mac an external drive to another Mac), or take the drive out and mount it in an external case.

The best way to avoid such problems are not to leave your expensive computer lying around, and place it in a locked drawer when you're not using it.

not with disk encryption. and the recommended methods provided previously.
But, yes proper watch over your stuff is the first step.
Also Back-ups are critical!

[benwiggy]

Originally Posted by ThirteenXIII

not with disk encryption. and the recommended methods provided previously.
But, yes proper watch over your stuff is the first step.
Also Back-ups are critical!

Many people leave their laptops continually running, and don't leave a password to get past the screensaver.
Some people let their dorm buddy use their laptop on the same account.

In short, encryption is fine, but it's just one defence against some, but by no means all, of the security threats to your computer.

Most thieves are not Tom Cruise trying to access your special data without you noticing, but will probably just wipe the disk and sell the laptop.

[ezramoore]

Common sense is your best defense.

resetpassword is a feature not a flaw.

[ThirteenXIII]

Originally Posted by benwiggy

Many people leave their laptops continually running, and don't leave a password to get past the screensaver.
Some people let their dorm buddy use their laptop on the same account.

In short, encryption is fine, but it's just one defence against some, but by no means all, of the security threats to your computer.

Most thieves are not Tom Cruise trying to access your special data without you noticing, but will probably just wipe the disk and sell the laptop.

well when you support enterprise level systems it is critical regardless of how "Special" or "not special" the data is. even in basic users. never underestimate the maliciousness of thieves, a slight bit of personal data is all they may need to steal your identity, cause problems, etc.

Also, tell me how you can erase an encrypted disk? if it were that easy it wouldnt be a defacto encryption process.

[benwiggy]

Originally Posted by ThirteenXIII

Also, tell me how you can erase an encrypted disk? if it were that easy it wouldnt be a defacto encryption process.

I dunno -- erase it using Linux or Windows? I'd be surprised if diskutil didn't let you somehow, though.

But yes, encryption is of course useful. And I would expect enterprise-level guys to be following a lot of procedure that most domestic users don't.
I was merely trying to highlight other physical risks that are greater than "resetpassword".
;-)

[chrfr]

Originally Posted by benwiggy

And I would expect enterprise-level guys to be following a lot of procedure that most domestic users don't.

Yeah, the Enterprise level equipment with sensitive data is locked in a limited-access secured data center.

[ZMacintosh]

Originally Posted by chrfr

Yeah, the Enterprise level equipment with sensitive data is locked in a limited-access secured data center.

not always true, such as with schools, or businesses with off-site work.