Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I understand that it is possible to reset the administrator password on a Mac, allowing someone with physical access to a machine to create a new password that gives them access to all files unlocked files remaining on the machine after the reset process.

But what else do they have access to? Specifically:

  1. Are all user accounts still present?
  2. Are all keychains still present, or are they reset or cleared as part of the password creation process?
  3. If the keychains are still present, does the (new) administrator have access to the contents of existing keychains.
  4. Are any files (other than keychains) erased or reset as part of the process?

I assume that FileVault protects against using this technique in an attack; would a firmware password confer any protection?

share|improve this question
2  
Keychains aren't accessible after a password reset. A firmware password prevents single user mode and changing the boot destination, but if someone has physical access to the Mac it's not going to help because they can just remove the hard drive. FileVault is your safest option. Just be aware that if you forget the password and you didn't register it with your AppleID for resetting, you're stuffed. –  hellothere Aug 18 '12 at 6:39

3 Answers 3

up vote 2 down vote accepted

If FileVault is enabled, booting into single user mode requires a password, so neither of the methods for resetting the password in single user mode work.

As others have mentioned, resetting the login password doesn't reset the password of the login keychain. I tried resetting the login password a few months ago. I could access most files normally, but not my account in Mail.app or auto-filled passwords in Safari. But I could access my Gmail account from Safari because I had set it to log in automatically.

The login password (but not the password of the login keychain) can also be reset with an Apple ID. There's a checkbox for allowing that when creating an account. I think it was checked by default. The option can be disabled later in the Users & Groups preference pane. If the option was enabled before you turned FileVault on, you cannot disable it without turning FileVault off and back on. See Michael Tsai - Blog - FileVault 2’s Apple ID Backdoor.

1. Are all user accounts still present?

Yes. And all of their passwords can be changed separately, or from the Users & Groups preferences after logging in to (or creating) one adminstrator account.

2. Are all keychains still present, or are they reset or cleared as part of the password creation process?

The keychains aren't removed, but the login keychain isn't unlocked automatically after the login password is reset.

3. If the keychains are still present, does the (new) administrator have access to the contents of existing keychains.

Not without knowing their passwords.

4. Are any files (other than keychains) erased or reset as part of the process?

I don't know, but you can access most files normally.

share|improve this answer
    
Wow, I'd never noticed the option to "reset the keychain with the Apple ID" in my Users & Groups preferences! –  raxacoricofallapatorius Aug 21 '12 at 13:03
    
Some follow up: (1) Could you say a bit more about how automatic login to Gmail was configured in Safari? Was that pulling a password from the (locked) keychain of from somewhere else? (2) The linked article doesn't mention resetting the keychain password with an Apple ID; how does that work? –  raxacoricofallapatorius Aug 21 '12 at 13:06
1  
Gmail uses a cookie for the automatic login. I should've read the article better. Resetting the login password with an Apple ID does not reset the password of the login keychain. –  ؘؘؘ Aug 21 '12 at 19:36

If someone has your administrator account, everything on the machine is accessible to them. People in IT Security circles say "Physical access = Total access".

Keychains can only be unlocked with the keychain password. If an account password is changed/updated without being logged into the account AND having the relevant keychain unlocked, the keychain password doesn't change.

Meaning, someone could get access to your account perhaps, but not your keychain, without the original password. The account and keychain passwords fall out of sync with one another.

FileVault protection similarly, will remain in place until unlocked using the correct password. I don't believe having root access on the machine allows you to unlock the keychain or the file vault account without the relevant passwords.. that's the whole point.

Of course, theoretically a hacker with godlike skills, patience, and knowledge could manually edit the relevant passwd files to be whatever he/she wanted it to be (if they had root access), but the probabilities of this happening is somewhere between zero and nil.

share|improve this answer
    
Not have: reset. Does that process (a) give them access to the keychain, etc. or does the resetting process wipe certain sensitive files (b) give access to FileVault-protected drives. –  raxacoricofallapatorius Aug 17 '12 at 21:28
2  
Keychains can only be unlocked with the keychain password. After a password reset, the keychain is either lost or updated, but can only be updated if you knew the original password (in which case, presumably, you wouldn't have reset). FileVault protection similarly, will remain in place until unlocked using the correct password. –  Harv Aug 17 '12 at 21:31
    
Are keychains still present (what does "lost or updated" mean)? If so, I assume what your saying is that their passwords is not synced with the new, reset password, so that it they are inaccessible (and distinct, even if some were synced with the admin account password originally). –  raxacoricofallapatorius Aug 17 '12 at 21:43
    
That is correct. –  Harv Aug 18 '12 at 0:59
    
I've clarified the question a bit: if you could rewrite the answer to incorporate your comments (and confirm that the answer below is wrong) then I could accept. Thx. –  raxacoricofallapatorius Aug 20 '12 at 18:11

I have gone through this recently with a friend's computer. Once the person has the Admin password, they can enable Root access. Then everything is available. I think that Root overrides even FileVault. (That's a question).

share|improve this answer
    
Root does not override FileVault –  hellothere Aug 18 '12 at 6:39
    
So they do have access to keychains? –  raxacoricofallapatorius Aug 18 '12 at 14:13
    
I am corrected about FileVault. However, I know that Root access gives me control of keychains.. Just did this yesterday. –  David DelMonte Aug 18 '12 at 15:25
    
Can you confirm (see rewritten question): a new administrator password, created following the instructions linked to in the question, will give access to existing keychains? –  raxacoricofallapatorius Aug 20 '12 at 18:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.