Title

The password-related hint field must not be used. (Cat I impact)

Discussion

If a hint is provided, the user is presented with the hint after three failed authentication attempts. Password-related information provided in the field could compromise the integrity of the password. Adding contact information for your organization’s technical support is convenient and does not compromise password integrity.

Check Content

1. Open System Preferences->Accounts Panel, for each account. 2. Click 'reset password' (Change Password for current user). 3. Ensure no data exists in the password hints field. 4. Click Cancel. If any accounts have hints data, this is a finding. NOTE: The password hints field may include contact information for the organization's technical support.

Fix Text

1. Open System Preferences -> Accounts Panel, for each account. 2. Click 'reset password' (Change Password for current user). 3. Remove any data in the password hints field. NOTE: The password hints field may include contact information for the organization's technical support.

Additional Identifiers

Rule ID: SV-38532r1_rule

Vulnerability ID: V-25307

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.