<story><title>Apple security blunder exposes Lion login passwords in clear text</title><url>http://www.zdnet.com/blog/security/apple-security-blunder-exposes-lion-login-passwords-in-clear-text/11963</url></story><parent_chain><item><author>mrich</author><text>I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day.&lt;p&gt;It is simply inacceptable that a user basically reported the issue on their support forum and didn&apos;t even get an answer back.</text></item><item><author>tptacek</author><text>I can&apos;t name a single person who ever used &quot;Legacy Filevault&quot;; that&apos;s the &quot;encrypt your home directory&quot; thing from Leopard. This issue doesn&apos;t impact Lion FDE at all. Lots of people use Lion FDE.&lt;p&gt;Even the subhed on this story is misleading, and the lede paragraph seems to go out of its way to bury the true article lede, which is &quot;if you&apos;re using FileVault home directory encryption, this impacts you&quot; --- instead, it says &quot;in specific configurations&quot;.&lt;p&gt;More generally: can anyone name a single case where ZDNet has broken a story we cared about? Even in this case, ZDNet is rehashing stuff published elsewhere earlier.</text></item></parent_chain><comment><author>tptacek</author><text>Every single time the topic of Microsoft&apos;s security track record has come up on HN, I&apos;ve waded in to point out what a great job Microsoft has done. Here&apos;s one of my highest rated comments from several years ago:&lt;p&gt;&lt;a href=&quot;http://news.ycombinator.com/item?id=577684&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=577684&lt;/a&gt;&lt;p&gt;Now, I don&apos;t disagree with your general point: Microsoft gets more scrutiny than Apple does on HN about security, and Apple enjoys an inflated perception of platform security here --- I attribute that to a general Unix bias, by the way, and not to Apple fandom.&lt;p&gt;But please be careful to note that &lt;i&gt;I&apos;m not a part of that phenomenon&lt;/i&gt;. You will, if you dig, find comments of mine that are critical of Apple security; you will probably not find comments critical of Microsoft&apos;s security practices.&lt;p&gt;(To be clear: securing a whole platform is an incredibly difficult job, and platform software security talent is some of the hardest to find in the whole industry; both Apple and Microsoft take this stuff seriously and, compared to 2002, both do a fantastic job. Also: the security of the iOS platform is a different story than of the OS X platform.)</text></comment>
<story><title>Apple security blunder exposes Lion login passwords in clear text</title><url>http://www.zdnet.com/blog/security/apple-security-blunder-exposes-lion-login-passwords-in-clear-text/11963</url></story><parent_chain><item><author>mrich</author><text>I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day.&lt;p&gt;It is simply inacceptable that a user basically reported the issue on their support forum and didn&apos;t even get an answer back.</text></item><item><author>tptacek</author><text>I can&apos;t name a single person who ever used &quot;Legacy Filevault&quot;; that&apos;s the &quot;encrypt your home directory&quot; thing from Leopard. This issue doesn&apos;t impact Lion FDE at all. Lots of people use Lion FDE.&lt;p&gt;Even the subhed on this story is misleading, and the lede paragraph seems to go out of its way to bury the true article lede, which is &quot;if you&apos;re using FileVault home directory encryption, this impacts you&quot; --- instead, it says &quot;in specific configurations&quot;.&lt;p&gt;More generally: can anyone name a single case where ZDNet has broken a story we cared about? Even in this case, ZDNet is rehashing stuff published elsewhere earlier.</text></item></parent_chain><comment><author>joejohnson</author><text>The parent comment isn&apos;t defending Apple; @tptacek is pointing out that this issue won&apos;t impact a large number of users, that the headline is misleading, and that maybe ZDNet is sensationalizing a minor issue.</text></comment>