19

On macOS High Sierra 10.13.2, when I manually lock the screen (shift+ctrl+power) and later press any key to turn it on, the screen content which was shown at the time I locked the screen is briefly displayed on the screen (something like 1/30 or 1/60 of a second — I can measure it with high speed camera but it doesn't matter much) before it finally displays the login UI.

I've never seen it before High Sierra, but now I can reproduce this 100% of the time. This is really annoying because this might allow a stranger to capture screen contents which were shown immediately before the screen was locked.

I found one workaround which is far from perfect: lock the screen, wake up and press 'esc' to turn off the screen again. Then at the next wake up, nothing is revealed.

Are there any better workarounds? Is it worth reporting to Apple as a security/privacy bug?

Update:
If I use cmd+ctrl+Q to lock the session as suggested in comments, it makes the bug less frequent, but doesn't really solve it. In other words it turns a suicide self shot into a Russian Roulette.

Update 2: macOS 10.13.3 is affected as well.

Update 3: still not fixed in macOS 10.13.4.

Update 4: still not fixed in macOS 10.13.4 with Security Update 2018-001.

Update 5: still not fixed in macOS 10.13.5.

Update 6: I am not 100% sure but I think I saw it again in macOS 10.13.6 too.

|improve this question
  • Use lock screen instead. You are using “power off screen” which does not lock it, the lock is a side effect of the screen going off. Locking is something like cmd-ctrl-q – John Keates Jan 15 '18 at 2:03
  • @JohnKeates perhaps I should. This doesn't turn it off though, apparently having one key combo to (properly) lock the user session and turn the screen off is too much of a luxury. – Sarge Borsch Jan 15 '18 at 6:35
  • If you press escape after locking, the screen goes black :) So ctrl-cmd-q and then esc is the ultimate combination – John Keates Jan 16 '18 at 13:05
  • @JohnKeates yes I know, that's what I do. – Sarge Borsch Jan 16 '18 at 14:56
  • I used to experience this same problem on my MacBook Pro (13”, mid-2009). I think it stopped when I upgraded from Yosemite (10.10) to El Capitan (10.11). I saw it as a security flaw, and I’m surprised that someone is experiencing it with one of the newer versions of macOS. – EJ Mak Jan 30 '18 at 3:12
6

Yes - the frame buffer should be scrubbed / discarded as part of the sleep / lock process no matter how brief the render. I don't think it's a huge risk and can be mitigated as you say by logging out of the screen before locking or any number of other ways like timed lockouts.

I'd just log out or enable fast user switching and switch away from the screen instead of letting the screen saver lock.

Apple publishes a page with instructions on how to report issues. If this were a huge gap, I'd consider asking you to delete the thread, but I don't think this is "stop the planet" serious unless there's a way to abuse this "feature".

https://support.apple.com/en-us/HT201220

Security and privacy researchers

To report security or privacy issues that affect Apple products or web servers, please contact product-security@apple.com.

|improve this answer
  • 2
    okay… I've sent them a message to product-security@apple.com, hopefully they will do something – Sarge Borsch Jan 14 '18 at 21:52
  • so it's been 1 or 2 macOS updates from the time I've sent them a detailed report, and I didn't get any valuable replies from them, and the bug is still not fixed. :/ – Sarge Borsch Feb 1 '18 at 18:13
  • Yeah, it doesn't work like this. – Sarge Borsch Jun 4 '18 at 15:58
  • This appears to be fixed as of yesterday's release of macOS Mojave. – Jesse P. Sep 25 '18 at 11:18
  • I'm on 10.14.4 and still seeing it. – Nick K9 Apr 17 at 22:06

You must log in to answer this question.

protected by Community♦ Jul 22 '18 at 8:52

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .