5

I have created a specific account on my Mac (called skype) to use with risky software, Skype. This account is a standard account.

Since I didn't want to use this account very often, I saved its password in an encrypted file and I am fully sure of the password.

Today I can't login on this account. Once I type the password for the skype account in the login window, the password area is shaking which should mean "wrong password". I checked that the usual suspects aren't playing here:

  • the doomed caps lock isn't involved,
  • by pressing +space I checked that the mapping of my keyboard is the one I want,
  • I used /usr/bin/su skype to check its password and it is rejected.

The conclusion is clear: the password of the skype account was changed, or is failing after a MacOS X upgrade.

  • I didn't changed it
  • I am the sole administrator of this Mac.
  • There isn't even a guest account set.

I would like to find what might have happened to block this account.

1st step of investigation:

  • how to find when an account password was last changed?
  • how to find through which method it was changed, either with the graphical interface of System Preferences... or with the passwd command, or through none of these and with the use of a security vulnerability?

The Mac where this incident happened is running High Sierra 10.13.5.

  • You don't have remote login enabled on this account by chance so you could try to log in through ssh? Or set any kind of constraints on the password or the account? – nohillside Dec 15 '18 at 18:35
  • 2
    Have you tried logging in as another user with administrator privileges, open Terminal and then running "su skype"? It will ask you for the account password, enter that and see if it works. If it does, the password has not been changed, but something else is preventing you from logging in interactively. – jksoegaard Dec 15 '18 at 18:47
  • 1
    @jksoegaard : good advice, I tried this and it was a failure. I will upgrade my question to avoid wasting other's time. – daniel Azuelos Dec 15 '18 at 20:11
  • Please post the output of the command sudo ls -la /var/db/dslocal/nodes/Default/users/skype.plist – Allan Dec 19 '18 at 17:51
  • This file modification time report the time of last change of any parmeter on this account and not only its password. – daniel Azuelos Dec 20 '18 at 23:19
3

You can get the last time a password was changed by using dscl:

$ dscl . read /Users/<username> | grep passwordLastSetTime -A1

You will then get a result similar to the result below; the time will be in epoch (Unix) time.

<key>passwordLastSetTime</key>
<real>1489446910.113889</real>

Then, to convert epoch to something useful, you need to drop the mantissa (fractional part) since epoch is measured in nano seconds (useless for our purposes here)

$ date -r 1545267484
Wed Dec 19 19:58:04 EST 2018
0

In Users and Groups there is a Accessibility option button and it says that " These accessibility items will automatically be enabled in the login window: Voice Over, Zoom, Accessibility Keyboard *, Sticky Keys, Slow Keys, Mouse Keys, and Switch Control *. If they are turned off then the features are disabled for all users at the login window, ( but can be turned on ...) Then it says if a feature is ON and has the the " * " like Accessibility Keyboard * and Switch Control * do then your own ( your Admin account) configurations will be used for all users at the login window. I think by default these are all checked. I unchecked them. But someone should add info if its ok to uncheck them because I do have trackpad problems that I'm trying to figure out.

  • 1
    How does this relate to passwords? – nohillside Dec 15 '18 at 22:29
  • Accessibility settings being on effects login screen for all users to function based on users configurations before you even log in. – Lisa Ann Dec 16 '18 at 7:13
  • @nohillside the accessibility settings can redefine the keyboard mapping thus causing problems on the login window of the same nature than the [caps lock]. You are convinced you type the right password but it isn't and nothing will display but the usual •••••••••••• . – daniel Azuelos Dec 16 '18 at 15:10
  • 1
    @danielAzuelos Well, maybe the answer should explain this in more detail then – nohillside Dec 16 '18 at 15:19
  • I looked up " System Administration Guide: Security Services" on the internet and was able to see the way it is explained on Oracle is designed in a way that helps me begin to understand. – Lisa Ann Dec 17 '18 at 17:17
0

If you go to System Preferences, Users and Groups then unlock it and click parental controls for the standard user you can see what the actual setting are that the account has. When I did that I found that in the Finder setting there were apps that were checked that I did not even know I had on my computer. I just wonder if they are third party apps that can gain access to change passwords. Also the last tab is Other and has a button called Log that can show you what has been going on going back over time.

Also I have created a Standard user that I typed very confidently 3 times in a row for it to finally let me in.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.