Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Researcher Gives Apple Details of macOS Keychain Security Flaw Despite No Mac Bug Bounty Program
- Thread starter MacRumors
- Start date
- Sort by reaction score
Apple doesn't care because Mac OS is the Apple ][ of 2018. Eventually, Apple will just sell IOS devices. They are clearly headed in this direction.
iDevice connected to a wired Screen and bluetooth keyboard.
I agree. The kid should get paid. Not only for the discovery but also for the fact that he is just 18 and he is already showing some talent. His time (and mainly the result) should be rewarded even if its just few thousands. I feel $5k-$10k would be appropriate. Apple had all this time to fix it and their software developers probably earn more so this is nothing.
I think this is the best idea. Give Apple a heads up and then it's their problem if the most profitable company in the world can't fix a few lines of code in 1/4 of a year.
[doublepost=1551711241][/doublepost]
No he didn't. His naive mistake was thinking Apple cared about its customers. He fell for all of Tim's PR talk.
That is what's known as responsible disclosure.
He wrote a program to take advantage of the exploit, and then shared that information with Apple, which is the responsible way to get a bug fixed. I would expect full details to be released once Apple patches it.
Based on the video, the user needs to be logged into the system in order to access the passwords that require the user login to access. Doesn't really sound like a HUGE security bug. Now, if he could get access to KeyChain logged in as a Guest or through an iCloud exploit that would be a monstrous issue.
The least they could do is give the kid a free iMac or something.
[doublepost=1551715985][/doublepost]
Well, except that if you can get the user to run a trojan you'd *still* expect it to prompt for the keychain password before being able to pull secrets out of it. That's how it's *supposed* to work.
[doublepost=1551715985][/doublepost]
Well, except that if you can get the user to run a trojan you'd *still* expect it to prompt for the keychain password before being able to pull secrets out of it. That's how it's *supposed* to work.
That’s very kind of this researcher and an very ‘unApple’ thing to do, by giving this freely. Hope Apple will be able to correct this before 2022.
Me too.
iCloud Keychain is convenient if you're 100% Apple, but I'm steadily giving up Apple products where there are better solutions around.
1Password is cross platform, and their team has way better focus on their product than Apple does on Keychain. I've raised a couple of potential bugs with 1Password and they responded pretty much instantly and carried on the conversation until the matter was closed. Probably the best technical response I've had from any company.
If this will happen, be prepared for another couple of years been throwing back in time. I’ve experienced two transitions already and it will take years to give the OS the same functionality as from the platform it came from.
I’m having adobe acrobat crashing for two years now when I’m sending a pdf from acrobat to outlook for Mac. Every time it crashes, I’ve send the report to Apple and to adobe with my email address in it. In those two years I’ve never received any conformation from neither Adobe or Apple. Nor did I receive a question from them.
It’s like talking to Siri. And this ain’t the way to treat a customer.
Sounds like the guys from 1Password are very involved with their offerings. This is the way it should be. Cudo’s to them
No he wasn’t. Holding it back, leaving people vulnerable isn’t the right thing to do
They are not obligated to.
It sounds like extortion to me.
It would be nice, but really? It just sounds like he did it for money, otherwise he would not care for any bounty. Seems like he changed his idea. I mean, he has a Mac that runs Mojave. Not a poor kid.
Last edited:
Not blaming him and his behavior. But, "Teen does right thing even though not rewarded financially for doing so", is not a very high bar to get over. I'm glad he did the right thing. I'm glad that this brought some media attention to Apple not having a bug bounty program for macOS. I hope Apple rectifies that (both the bug and the lack of a bug bounty program), and I sincerely hope they put more effort into making the Macs (and macOS) that their customers actually want.
Totally agree. When I read "teenager" I thought the words, 'entitlement'. It'd be nicer if people just did the right thing because they'd like to be treated the same and not looking for gratitude or payment.
It's cheaper to hire a bunch of propagandists at near minimum wage than security researchers at upwards of $200K/year each.