Hacker News Reader

To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.

View on HN

How hard do you think it is to steal a password once you have root?

It should be impossible with SIP enabled, as in OS X 10.14 Apple protected the files in /var/db/dslocal where the user shadow files are stored so that root could not read them (unless triggered by an Apple signed executable, like Software Update). If you are running with SIP disabled you've taken the risk of it happening, and if you are on a corporate laptop (or 99% of personal machines) it is engaged.

https://apple.stackexchange.com/questions/344117/mac-10-13-1...

Think a little harder. With root, you can install a keylogger.

You'd still need to bypass TCC.

It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.

Reply on news.ycombinator.com