4

I understand that it is possible to reset the administrator password on a Mac, allowing someone with physical access to a machine to create a new password that gives them access to all files unlocked files remaining on the machine after the reset process.

But what else do they have access to? Specifically:

  1. Are all user accounts still present?
  2. Are all keychains still present, or are they reset or cleared as part of the password creation process?
  3. If the keychains are still present, does the (new) administrator have access to the contents of existing keychains.
  4. Are any files (other than keychains) erased or reset as part of the process?

I assume that FileVault protects against using this technique in an attack; would a firmware password confer any protection?

1
  • 2
    Keychains aren't accessible after a password reset. A firmware password prevents single user mode and changing the boot destination, but if someone has physical access to the Mac it's not going to help because they can just remove the hard drive. FileVault is your safest option. Just be aware that if you forget the password and you didn't register it with your AppleID for resetting, you're stuffed.
    – hellothere
    Aug 18 '12 at 6:39
2

If FileVault is enabled, booting into single user mode requires a password, so neither of the methods for resetting the password in single user mode work.

As others have mentioned, resetting the login password doesn't reset the password of the login keychain. I tried resetting the login password a few months ago. I could access most files normally, but not my account in Mail.app or auto-filled passwords in Safari. But I could access my Gmail account from Safari because I had set it to log in automatically.

The login password (but not the password of the login keychain) can also be reset with an Apple ID. There's a checkbox for allowing that when creating an account. I think it was checked by default. The option can be disabled later in the Users & Groups preference pane. If the option was enabled before you turned FileVault on, you cannot disable it without turning FileVault off and back on. See Michael Tsai - Blog - FileVault 2’s Apple ID Backdoor.

1. Are all user accounts still present?

Yes. And all of their passwords can be changed separately, or from the Users & Groups preferences after logging in to (or creating) one adminstrator account.

2. Are all keychains still present, or are they reset or cleared as part of the password creation process?

The keychains aren't removed, but the login keychain isn't unlocked automatically after the login password is reset.

3. If the keychains are still present, does the (new) administrator have access to the contents of existing keychains.

Not without knowing their passwords.

4. Are any files (other than keychains) erased or reset as part of the process?

I don't know, but you can access most files normally.

3
  • Wow, I'd never noticed the option to "reset the keychain with the Apple ID" in my Users & Groups preferences!
    – orome
    Aug 21 '12 at 13:03
  • Some follow up: (1) Could you say a bit more about how automatic login to Gmail was configured in Safari? Was that pulling a password from the (locked) keychain of from somewhere else? (2) The linked article doesn't mention resetting the keychain password with an Apple ID; how does that work?
    – orome
    Aug 21 '12 at 13:06
  • 1
    Gmail uses a cookie for the automatic login. I should've read the article better. Resetting the login password with an Apple ID does not reset the password of the login keychain.
    – Lri
    Aug 21 '12 at 19:36
6

If someone has your administrator account, everything on the machine is accessible to them. People in IT Security circles say "Physical access = Total access".

Keychains can only be unlocked with the keychain password. If an account password is changed/updated without being logged into the account AND having the relevant keychain unlocked, the keychain password doesn't change.

Meaning, someone could get access to your account perhaps, but not your keychain, without the original password. The account and keychain passwords fall out of sync with one another.

FileVault protection similarly, will remain in place until unlocked using the correct password. I don't believe having root access on the machine allows you to unlock the keychain or the file vault account without the relevant passwords.. that's the whole point.

Of course, theoretically a hacker with godlike skills, patience, and knowledge could manually edit the relevant passwd files to be whatever he/she wanted it to be (if they had root access), but the probabilities of this happening is somewhere between zero and nil.

7
  • Not have: reset. Does that process (a) give them access to the keychain, etc. or does the resetting process wipe certain sensitive files (b) give access to FileVault-protected drives.
    – orome
    Aug 17 '12 at 21:28
  • 2
    Keychains can only be unlocked with the keychain password. After a password reset, the keychain is either lost or updated, but can only be updated if you knew the original password (in which case, presumably, you wouldn't have reset). FileVault protection similarly, will remain in place until unlocked using the correct password.
    – Harv
    Aug 17 '12 at 21:31
  • Are keychains still present (what does "lost or updated" mean)? If so, I assume what your saying is that their passwords is not synced with the new, reset password, so that it they are inaccessible (and distinct, even if some were synced with the admin account password originally).
    – orome
    Aug 17 '12 at 21:43
  • That is correct.
    – Harv
    Aug 18 '12 at 0:59
  • I've clarified the question a bit: if you could rewrite the answer to incorporate your comments (and confirm that the answer below is wrong) then I could accept. Thx.
    – orome
    Aug 20 '12 at 18:11
-3

I have gone through this recently with a friend's computer. Once the person has the Admin password, they can enable Root access. Then everything is available. I think that Root overrides even FileVault. (That's a question).

4
  • Root does not override FileVault
    – hellothere
    Aug 18 '12 at 6:39
  • So they do have access to keychains?
    – orome
    Aug 18 '12 at 14:13
  • I am corrected about FileVault. However, I know that Root access gives me control of keychains.. Just did this yesterday.
    – ICL1901
    Aug 18 '12 at 15:25
  • Can you confirm (see rewritten question): a new administrator password, created following the instructions linked to in the question, will give access to existing keychains?
    – orome
    Aug 20 '12 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .