[cryptoz]

How is this possible? I wouldn’t have thought that it could open your applications without you logging in? How does it know who you are? How does it know which applications to open? If you’re not logged in yet, is is just logging in for you automatically but not showing you?

Seems like a huge security bug. This isn’t being exploited? Wild stuff.

Reminds me of when you could hear a FaceTime call coming through but if you chose not to answer it, no worries! Your iPhone will turn on your camera anyway! And send your video to the calling party!

[delfinom]

Vast majority of all laptop and even phone usage is single user. They could literally be doing

if macbook_has_only_one_account():

preloadapps()

[cryptoz]

But how? - surely they don't store the passwords in plain text locally? Does the OS have a function to log in a user while bypassing their credentials? I would have assumed that it is impossible for the OS to preloadapps() when it doesn't have access to the user's apps in the first place.

But apparently it does! shrug

So why tell the user that they need to log in first? If they are the only user account on the system and the OS can access the user's files and apps without logging in, why have the user event set a password in the first place? It seems like a fake login, a false sense of security. And a massive security issue. If the user can just open the lid and that means that code is now running under their own account but they have not authorized a log in, that's just dangerous.

[delfinom]

The OS at its core doesn't care about credentials. As long as there is a root process, which there is for init. It can simply execute a process as another user id.

With how modern macbooks and many other laptops work nowadays, you are rarely fully turning off the device and simply hibernating it constantly which keeps everything loaded in memory.

I don't deny there are security implications. But it's an Apple design choice. lol