With the latest Lion security update, Mac OS X 10.7.3, Apple has accidentally turned on a debug log file outside of the encrypted area that stores the user’s password in clear text.

How can I determine whether my system if affected by this issue? If so, can I work around it, and also determine which users’ passwords have been exposed?


As stated in the article linked in the question:

Anyone who used FileVault encryption on their Mac prior to Lion, upgraded to Lion, but kept the folders encrypted using the legacy version of FileVault is vulnerable. FileVault 2 (whole disk encryption) is unaffected.

The password shows up in /var/log/secure.log. To look for it, log in as an Administrator, open Terminal.app and run

sudo grep -i passwordAsUTF8String /var/log/secure.log

Have a look at the result (if any) to see whether passwords appear in plain text.

For additional information see

  • And if my significant other doesn't really remember what he did on his laptop, how can I confirm if it is affected or not?
    – F'x
    May 7 '12 at 8:58
  • Is FileVault enabled for his home directoy (have a look System Preferences)?
    – nohillside
    May 7 '12 at 9:41
  • Yes, FileVault is enabled. How do I know if it was migrated and kept to a legacy version?
    – F'x
    May 7 '12 at 9:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .