Home > News

It happened Again: Another Apple Password Screen Lets You in with Any Password

By Laura Tucker
It happened Again: Another Apple Password Screen Lets You in with Any Password Featured Image

The latest macOS, High Sierra, has had its difficulties with password screens. First, a build of the OS allowed just anybody to log into a Mac running that version if they signed with “root,” and now a second build allows a similar login to the App Store system preferences, although admittedly not as egregious as the first password screen bug.

It does make you wonder how this keeps happening. Apple is usually quick to fix these types of things; however, how are builds getting released, past the beta version and into users’ hands with such big obvious errors?

The First Time

news-mac-password-bug-laptop

The first password screen problem with High Sierra occurred last November. The 10.13.1 build of High Sierra was most noticeable by going to System Preferences. If you clicked the lock, it brought up a screen to log in to get access.

The problem with this is it didn’t do as it was supposed to and require you to put in your user name and password for the system. It allowed you to put in “root” as the user name and use a blank password.

And it went further than that as well. Several other login screens in the OS worked the same. It was reported that every preference panel that was tried worked the same way with “root” as the user name and a blank password.

In the System Preferences it meant just anyone could do many different things, including adding a new user, even a new administrator. Current users could be locked out as well.

New Security Risk

news-mac-password-bug-keyboard

While admittedly it’s not as bad as before, it’s a similar problem. With the current version of High Sierra, once again in the System Preferences, but only in the App Store pane, making it not quite as devastating, but still bad nonetheless, there is once again a security flaw.

If you go to System Preferences, and then to the App Store settings and find the padlock icon, if it’s unlocked, you can unlock it using just any password. It doesn’t need to be that favorite coveted password of yours. It can literally be anything.

This means automatic downloads can be enabled or disabled as well as operating system updates. Again, it’s not quite as bad, as just anyone can’t log in to your Mac. However, anyone who already has access to your Mac, even children, can get in there and change your App Store settings.

It’s possibly more damaging to Apple than it is to individual users. This is their second security flaw in High Sierra. They need to figure out how these builds keep getting released with such serious compromising bugs. These have been released to the general public and are not just beta releases. Why were these not discovered beforehand? Is someone’s job on the line? If not, it should be.

In the Future

Apple has reportedly acted quickly, and this most recent bug has already been fixed in newer beta versions of the software. If there’s a silver lining here, it’s that the company takes security seriously and always fixtures these mistakes right away.

But while that’s honorable on Apple’s part, they need to be taking the next step and figuring out where the process isn’t working before these builds are released. They need to be looking into their quality control and figuring out how they can take care of these flaws before they reach the general public. Even better still, if it compromises security, it shouldn’t even be reaching beta versions of their OS.

In the meantime, as a consumer of Macs, be forewarned that Apple is having trouble. If you have a version of the software that has security bugs, be sure to update as soon as possible, and don’t leave your Mac unattended if you’re currently experiencing a security bug.

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox

Laura Tucker Avatar
Laura Tucker
Laura has spent more than 20 years writing news, reviews, and op-eds, with the majority of those years as an editor as well. She has exclusively used Apple products for the past 35 years. In addition to writing and editing at MTE, she also runs the site’s sponsored review program.

Read next

When the SS Great Eastern laid the first working transatlantic telegraph cable in 1866, a message that had taken ten days by steamship suddenly crossed the ocean in minutes, and the financial markets of London and New York were forced, within a single trading week, to invent the modern concept of synchronised global price.
From below of blue starry sky over radio telescope and trees with leaves
The Big Ear telescope was scanning at 1420.4056 megahertz on the night of 15 August 1977, the exact frequency at which hydrogen atoms vibrate across the universe, because Giuseppe Cocconi and Philip Morrison had argued years earlier that any species trying to be found would broadcast on that channel — and then, for 72 seconds, something did.
In 2016, archaeologists dated two rings of snapped stalagmites in France’s Bruniquel Cave to 176,500 years ago, evidence that Neanderthals had walked 336 metres into darkness with fire and built architecture deep underground long before modern humans reached Europe
Otto von Bismarck was 74 when Germany adopted the world’s first national old-age social insurance program in 1889, setting the pension age at 70 after years of fighting socialists with bans, laws, and a promise few workers would live long enough to use
When cosmonaut Valeri Polyakov stepped out of his Soyuz capsule in March 1995 after 437 consecutive days aboard Mir, doctors recorded him at several centimetres above his pre-flight height, and his spine had become so unaccustomed to gravity that the recovery team carried him to a chair rather than risk the compression of letting him walk.
When Bell Labs engineer Karl Jansky pointed a rotating antenna at the sky in 1932 looking for sources of transatlantic radio static, he kept picking up a faint hiss that peaked every 23 hours and 56 minutes, and he eventually realized he had become the first human to hear the center of the Milky Way.
A contemplative scene with two scientists in a vintage laboratory setting.
When Harvard astronomer Cecilia Payne submitted her 1925 doctoral thesis arguing that the Sun was made almost entirely of hydrogen, the field’s senior figure Henry Norris Russell talked her into adding a line calling the result ‘almost certainly not real,’ and then published the same conclusion himself four years later to widespread acclaim.
When seismic waves from the Chicxulub impact reached what is now North Dakota roughly ten minutes after the asteroid struck, they appear to have triggered a ten-metre standing wave in an inland river that flung fish onto the bank and buried them under glass beads still falling from the sky.