6.1.2 Disable "Show password hints"

Information

Password hints are user created text displayed when an incorrect password is used for an account. Password hints make it easier for unauthorized persons to gain access to systems by providing information to anyone that the user provided to assist remembering the password. This info could include the password itself or other information that might be readily discerned with basic knowledge of the end user.

Solution

Perform the following to implement the prescribed state: Open System Preferences Select Users & Groups Select Login Options Uncheck Show password hints Alternatively: Run the following command in Terminal: sudo defaults write /Library/Preferences/com.apple.loginwindow RetriesUntilHint -int 0 Impact: The user can set the hint to any value including the password itself or clues that allow trivial social engineering attacks.

See Also

https://workbench.cisecurity.org/files/299

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-6

Plugin: Unix

Control ID: 6dd06c28ca985fc1cfc64b7863f6c65806c66b5c79f150f9fb5eb1e0a434b75b