The macOS system must remove password hints from user accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259544	APPL-14-003014	SV-259544r941254_rule		Medium

Description
User accounts must not contain password hints. Password hints leak information about passwords that are currently in use and can lead to loss of confidentiality.

STIG	Date
Apple macOS 14 (Sonoma) Security Technical Implementation Guide	2024-01-10

Details

Check Text ( C-63283r941252_chk )
Verify the macOS system is configured to remove password hints from user accounts with the following command: /usr/bin/dscl . -list /Users hint | /usr/bin/awk '{print $2}' | /usr/bin/wc -l | /usr/bin/xargs If the result is not "0", this is a finding.

Fix Text (F-63191r941253_fix)
Configure the macOS system to remove password hints from user accounts with the following command: for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do /usr/bin/dscl . -delete /Users/$u hint done