Mac Accepted Any Root Cert, Making Code Signing Useless(worthdoingbadly.com)

74 pointsby anonymouse0084 tahun yang lalu9 comments

worthdoingbadly.com

Mac Accepted Any Root Cert, Making Code Signing Useless

https://worthdoingbadly.com/coretrust/

9 comments

anonymouse0084 tahun yang lalu

"For years, macOS allowed any root certificate when checking code signatures, making code signing completely useless."

Joyfield4 tahun yang lalu

"Think Different".

egberts14 tahun yang lalu

My thoughts exactly. I upvoted this despite some clueless folks downvoting you.

Tagbert4 tahun yang lalu

patched in macOS 12.4 / iOS 15.5

wazzaps4 tahun yang lalu

I'm surprised Apple has no comprehensive test suite for this

bobbylarrybobby4 tahun yang lalu

There was that brief period where repeatedly pressing enter on the Lock Screen with an empty password field would eventually let you in as long as you had never seen a `su` password. And if I recall there was also a bug where the password hint would show your password in clear text?

softwarebeware4 tahun yang lalu

This is old news, right? Did they not change this yet?

dserodio4 tahun yang lalu

Even if it's already patched, the fact that it was exploitable for years make it very much relevant. And of course, those with older computers that can't be updated to the latest macOS are still vulnerable.

lapcat4 tahun yang lalu

> This is old news, right?

The article is from July 2.

> Did they not change this yet?

First line of the article: "patched in macOS 12.4 / iOS 15.5"