Replicated fine here on 11.13.1
How the hell did this pass qa?!
How the hell did this pass qa?!
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Major macOS High Sierra Bug Allows Full Admin Access Without Password - How to Fix [Updated]
- Thread starter MacRumors
- Start date
- Sort by reaction score
So it requires physical access to a Mac that's not just "unlocked" but that has the Users dialogue open with the padlock showing that the pane is unlocked as well. So, no risk if no one else has physical access to the machine or those that do don't know the password. Not exactly like anyone can log in with root, requiring no unlocking at all. So, a bug? Yes. A catastrophic and highly embarrassing failure? Not really.
This is getting downright ridiculous Apple.
But emoji karaoke is working well on iPhone X. Whew!
Glad this got rooted out. Apple will have to try a more subtle way to give the spook agencies a back door "for reasons of national security".
This protects users from forgetting their root password. It just works.
OMG, this is worst ever!
Just put the cursor on the password and press enter and let it go!
Just put the cursor on the password and press enter and let it go!
Last edited:
Awesome job FBI/NSA/CIA Apple!
Last edited:
tested and confirmed on my lab-machine (installed 10.13.1 fresh today). jawdropping 
Worked first try, only works in Users & Groups.
Also, I swear I heard a mechanical click from the computer.
Edit: The sounds was the new SFX for unlocking.
Also, I swear I heard a mechanical click from the computer.
Edit: The sounds was the new SFX for unlocking.
Here’s an idea....don’t enable this “feature” and when your Mac is locked, “root” won’t unlock it.
It also works from a guest account.
Works for me, are the people who it's not working from logged into an admin account or a user account?
Admin account. I only have the one account. Tried this numerous times. It does not work for me.
I'm not sure why it's not working for some, but one possible reason might be the Server app. I have it installed, and the second attempt let me in.
There are some who recommend enabling the root account, setting a password, then disabling it again. This is wrong. You can perform the hack again when root is disabled. Just leave it enabled with a proper password.
There are some who recommend enabling the root account, setting a password, then disabling it again. This is wrong. You can perform the hack again when root is disabled. Just leave it enabled with a proper password.
How many people have their computer set up with guest accounts (especially with a non-trivial root password)?
Not saying this isn't bad, but isn't the default to not have guest accounts?