dimanche 30 novembre 2014

Yosemite lock screen is trivial to bypass


This may be an issue that carries over from Mavericks, as seen in a related question.


However what I am experiencing is slightly different in nature from that question.


I have my setting set to 15 minutes (it's under Security & Privacy in the System Prefs). So, what I expect is that my Macbook will only show me a lock screen if I wait 15 minutes after I close the screen cover.


What's annoying is that I get the lock screen even if I close and re-open it immediately.


I looked at this answer: http://apple.stackexchange.com/a/148133/13465


There are no problems with the plist file. The contents of the plist are immediately kept up to date when I edit the system preferences.


But what's even worse than annoying is that I can get past the lock screen at this point by hitting Esc or waiting for the ~20 second timeout for the lock screen to time out, screen goes blank, and I hit ANY KEY on the keyboard. Then I pop back to my desktop. So much for security, huh?


Now, if I use the Lock Screen option from the task bar padlock menu (You have to go to the Keychain Access app's preferences to enable this, oddly enough) to do the locking, then I cannot bypass the actual lock screen in this way. It is impossible to visually confirm which kind of screen lock it is.


I also tested that if I set this setting to "Immediately", it will indeed not allow me to skip the lock screen with any keypress. I would still expect at this point that if I do close the lid or leave the machine idle for the time that we specify in the setting that I will also not be able to bypass it in this way. Still, i think many will agree with me that this is an actual big juicy bug, because WHY PRETEND TO ASK FOR MY PASSWORD AND WASTE MY TIME!


Effectively this means that (at least for me, on my machine that I've upgraded from Mountain Lion to Mavericks and then to Yosemite) the only practical way to go if I care about using the security that comes with the OS is to set the setting to "Immediately" because once the cover is closed I'm going to get the lock screen no matter what, and it's the only way to actually ensure that the lock screen is a real actual lock screen.


I would appreciate it if readers could try this out for themselves and relate to me if this is an issue that can be reproduced. It may be that my system is borked.





Aucun commentaire:

Enregistrer un commentaire