7

or: Does enabling auto-login in OS X add any additional security risks?

How does this auto-login work? I'm not a security expert, but I imagine that such a procedure would require the password to be stored somewhere in plain text, right? But then this specific location could be exploited by malicious software.

Where is the password for the auto-login stored?

The setting I'm referring to is located at:
Users & Groups → Login Options → Automatic login

enter image description here

3
  • Aren't this two questions here? How secure -> not secure at all because anybody with physical posession of your computer can reboot to log in. Where is it stored -> good point
    – nohillside
    May 7, 2012 at 14:30
  • @Lri Yes. That's the setting I'm referring to.
    – gentmatt
    May 7, 2012 at 14:33
  • @patrix Of course loosing physical access to the machine is very severe, but I don't want to take this option into consideration. I'll edit the question.
    – gentmatt
    May 7, 2012 at 14:35

2 Answers 2

11

Yes. If you enable automatic login, the keychain password is stored in /etc/kcpassword using XOR cipher, which can be decoded easily. You need root privileges to read it though.

sudo ruby -e 'key = [125, 137, 82, 35, 210, 188, 221, 234, 163, 185, 31]; IO.read("/etc/kcpassword").bytes.each_with_index { |b, i| break if key.include?(b); print [b ^ key[i % key.size]].pack("U*") }'

Even if automatic login was disabled, the login password can be reset in single user mode. It doesn't change the password of the login keychain though. If someone logged in to your account after resetting the login password, they could access most of your files normally, but they couldn't log in on your account in Mail or use auto-fill in Safari. If automatic login was enabled, they could see your passwords with something like security find-internet-password -s accounts.google.com -w and use Mail and auto-fill.

There was a vulnerability when automatic login was enabled:

According to a leading password recovery software developer Passware, your password could be easily accessed via the direct memory access associated with the Mac’s FireWire port.

It seems that by enabling the “automatic login” feature the FireWire port on your Mac opens the door to unauthorized password recovery. It seems that this is an issue that has plagued Snow Leopard as well, but as it stands it does not look like there is any fix for it, apart from disabling “automatic login” and spending that extra second or two typing in your password.

The hash of the login password (which is usually also the password of the login keychain) is stored in /private/var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8. In 10.7 even relatively complex passwords could be cracked with DaveGrohl, but 10.8 switched to PBKDF2, which limits it to about 10 guesses per second per core.

1
  • 2
    The FireWire vulnerability was fixed in 10.7.2; see Apple's notes here (it's listed as CVE-2011-3215). May 8, 2012 at 6:09
4

Enabling autologin does store the user's password in recoverable form, but it's not in plaintext (it's obscured, and no, I'm not going to tell you where it is). The reason for this isn't to enable autologin itself, but to allow automatic access to the user's keychain (which is encrypted based on the user's password).

This doesn't weaken security too much; the main implications are that someone (/some malware) with root access to the computer (and/or physical control of it) can find out what your password is; but since they already have full control of the computer, that doesn't matter much. It gives them access to your keychain (which a password reset wouldn't give them), and if you used the same password for other things they know that... but that's about it.

Realistically, if you care at all about security, you shouldn't be enabling autologin anyway.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .