Ensure Users' Accounts Do Not Have a Password Hint

Trung bìnhCấp 1Tự độngmacos

Mô tả

Password hints help the user recall their passwords for various systems and/or accounts. In most cases, password hints are simple and closely related to the user's password. Password hints that are closely related to the user's password are a security vulnerability, especially in the social media age. Unauthorized users are more likely to guess a user's password if there is a password hint. The password hint is very susceptible to social engineering attacks and information exposure on social media networks.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver').objectForKey('idleTime'))
  if ( timeout != null && timeout > 0 && timeout <= 900 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Đầu ra mong đợi: true

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Graphical Method: Perform the following steps to remove a user's password hint: 1. Open System Settings 2. Select Touch ID & Passwords (or Login Password on non-Touch ID Macs) 3. Select Change... 4. Change the password and ensure that no text is entered in the Password hint box Note: This will only change the currently logged-in user's password, and not any others that are not compliant on the Mac. Use the terminal method if multiple users are not in compliance. Terminal Method: Run the following command to remove a user's password hint: % /usr/bin/sudo /usr/bin/dscl . -list /Users hint . -delete /Users/<username> hint example: % /usr/bin/sudo /usr/bin/dscl . -list /Users hint . -delete /Users/firstuser hint % /usr/bin/sudo /usr/bin/dscl . -list /Users hint . -delete /Users/seconduser hint

Thuộc tính

Hệ điều hành: macos-14
Thẻ: authmacossonoma
Tham chiếu: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.11.1 Ensure Users' Accounts Do Not Have a Password Hint

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target macos