Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

or: Does enabling auto-login in OS X add any additional security risks?

How does this auto-login work? I'm not a security expert, but I imagine that such a procedure would require the password to be stored somewhere in plain text, right? But then this specific location could be exploited by malicious software.

Where is the password for the auto-login stored?

The setting I'm referring to is located at:
Users & Groups → Login Options → Automatic login

enter image description here

share|improve this question
    
Aren't this two questions here? How secure -> not secure at all because anybody with physical posession of your computer can reboot to log in. Where is it stored -> good point –  patrix May 7 '12 at 14:30
    
@Lri Yes. That's the setting I'm referring to. –  gentmatt May 7 '12 at 14:33
    
@patrix Of course loosing physical access to the machine is very severe, but I don't want to take this option into consideration. I'll edit the question. –  gentmatt May 7 '12 at 14:35

2 Answers 2

up vote 6 down vote accepted

Yes. If you enable automatic login, the keychain password is stored in /etc/kcpassword using XOR cipher, which can be decoded easily. You need root privileges to read it though.

sudo ruby -e 'key = [125, 137, 82, 35, 210, 188, 221, 234, 163, 185, 31]; IO.read("/etc/kcpassword").bytes.each_with_index { |b, i| break if key.include?(b); print [b ^ key[i % key.size]].pack("U*") }'

Even if automatic login was disabled, the login password can be reset in single user mode. It doesn't change the password of the login keychain though. If someone logged in to your account after resetting the login password, they could access most of your files normally, but they couldn't log in on your account in Mail or use auto-fill in Safari. If automatic login was enabled, they could see your passwords with something like security find-internet-password -s accounts.google.com -w and use Mail and auto-fill.

There was a vulnerability when automatic login was enabled:

According to a leading password recovery software developer Passware, your password could be easily accessed via the direct memory access associated with the Mac’s FireWire port.

It seems that by enabling the “automatic login” feature the FireWire port on your Mac opens the door to unauthorized password recovery. It seems that this is an issue that has plagued Snow Leopard as well, but as it stands it does not look like there is any fix for it, apart from disabling “automatic login” and spending that extra second or two typing in your password.

The hash of the login password (which is usually also the password of the login keychain) is stored in /private/var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8. In 10.7 even relatively complex passwords could be cracked with DaveGrohl, but 10.8 switched to PBKDF2, which limits it to about 10 guesses per second per core.

share|improve this answer
2  
The FireWire vulnerability was fixed in 10.7.2; see Apple's notes here (it's listed as CVE-2011-3215). –  Gordon Davisson May 8 '12 at 6:09

Enabling autologin does store the user's password in recoverable form, but it's not in plaintext (it's obscured, and no, I'm not going to tell you where it is). The reason for this isn't to enable autologin itself, but to allow automatic access to the user's keychain (which is encrypted based on the user's password).

This doesn't weaken security too much; the main implications are that someone (/some malware) with root access to the computer (and/or physical control of it) can find out what your password is; but since they already have full control of the computer, that doesn't matter much. It gives them access to your keychain (which a password reset wouldn't give them), and if you used the same password for other things they know that... but that's about it.

Realistically, if you care at all about security, you shouldn't be enabling autologin anyway.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.