login password bug

profx

ill never 4get watsisname
i just found that when you login either at the terminal or at the main login window it dosent matter what you enter in the password field so long as it starts with your actual password.
eg
user profx
pass *****122345jhlkjhlkhl

where the * is the actual password. It seems that it only checks character for character against the netinfo password, once it checks all the characters it thinks should be there it continues. It dosent check the length of the password.
what i said above is pure speculation on why it would behave like this, i dont actually know!;)
The only thing that it seems to affect once logged in is keychain (used in mail etc). It asks you to put in your password again.

Does this happen to anyone else?
 
interesting...

i just set up another user and tried the same thing but it gave me login incorrect. (as it is supposed to). But my main account still acts as described as above.

Now i am completely bamboozled.:confused:

Any ideas anyone?
 
I believe it's because only the first eight characters are hashed

[nocturn:~] xxx% openssl passwd
Password:morethaneight
Warning: truncating password to 8 characters
qxhTkuPB0ldpE
 
Back
Top