Possible Login Screen Security Hole in Lion?

Question

I think that I have found a glitch in the login screen in Lion that allows a user to hack in to an account without a password! It appears to occur on Macbooks with OS X Lion and here is how to reproduce it:
Make sure that you account is password-protected and that you require a password 5 seconds after the screen saver/sleep begins. Also, be sure that you have the default "hot corner" settngs and OS X Lion. Lastly, make sure that Finder is on the farthest left icon on your dock and that your screen saver is set to spectrum!
Close all open windows to see your desktop.
Now, close you Macbook lid, wait 10 seconds, and open it up. You should see a screen similar to the one shown below, but with your wallpaper & info: 
Now forcefully (yes, forcefully) restart your Mac by pressing down command, control, and the power button at the same time.
Wait for your Mac to start up and you should see the same screen you saw (like the image above.)
Click in the battery/time/wifi signal/etc. area in the top right corner without mousing over the courner.
Now, mouseover the top right corner of the screen, as it will launch some kind of odd "mission control". From there, ANYONE can control your Mac without seeing your screen. From there, mouse over where you think Finder is on the dock (in the bottom-left corner of the dock) without mousing over and corners of the screen and click it. That SHOULD launch finder on your Mac.
The login screen should reappear! (Odd, isn't it?)
Now, mouseover the bottom-left corner and hold esc as soon as the screen turns completely dark. If sucessful, you should see your screensaver show up. While holding esc, move your mouse around towards the bottom-right corner. You should see your cursor over top of the "wheel of doom".
The screen should flicker and you have hacked in to your account! Funny, isn't it?
You should see finder over top of your desktop if you located finder correctly in step 7! Cool?
If you are not sucessful, restart the entire process from step 4 and skip steps 7-8. If it doesn't work out for you after a few attemps, give up! Let's not waste any time on hacking in to an account (unless you are a hacker.)
Is it just me or can anyone else reproduce this? If it occurs (or not), please list your Macbook's specs and details in a reply.

Answer 1

jonathan_2005 wrote:
One of the options in the security panel permits a user to require that a username and password be entered to login once the screen saver locks your account.
The option is "Require password to wake this computer from sleep or screen saver"
Although one would assume that the credentials required to wake the computer is the username/password of the account that was being used when the computer went into sleep mode or the screen saver.
Never assume
WRONG!!! Anyone with an account on the machine can enter their username/password and wake the computer and voila that user now has control of the machine as the former user. That's right you guessed it HUGE security hole.
Anyone with a standard user account? Are you quite sure?
Anyone thinking that they can wake away from their machine and have the screen saver or sleep mode protect their account after a specified period of time is sadly mistaken. Anyone with an account on the machine can enter their own username and password and drop right into your account right where you left off.
I never think that way. A more secure lock is ensured by using the screen lock feature of the keychain.
Can you believe this stuff?
Not sure what stuff you refer to.
No warning, no release note to tell you of such a poorly designed "security" option.
Would you believe that anyone can access your computer? Stolen computers are regularly started up without much problem.
Apple please fix what must have been an oversight or at least tell people about this intentional design BEFORE they find anyone can wake the computer and become you as a user.
You are writing to other users like yourself here, not Apple.
I also presume you are new to the Mac world.