The password-related hint field must not be used.

From MAC OSX 10.6 Workstation Security Technical Implementation Guide

Part of OSX00335-Do not use password-related hint field

Associated with IA controls: IAAC-1

SV-38532r1_rule The password-related hint field must not be used.

Vulnerability discussion

If a hint is provided, the user is presented with the hint after three failed authentication attempts. Password-related information provided in the field could compromise the integrity of the password. Adding contact information for your organization’s technical support is convenient and does not compromise password integrity.

Check content

1. Open System Preferences->Accounts Panel, for each account. 2. Click 'reset password' (Change Password for current user). 3. Ensure no data exists in the password hints field. 4. Click Cancel. If any accounts have hints data, this is a finding. NOTE: The password hints field may include contact information for the organization's technical support.

Fix text

1. Open System Preferences -> Accounts Panel, for each account. 2. Click 'reset password' (Change Password for current user). 3. Remove any data in the password hints field. NOTE: The password hints field may include contact information for the organization's technical support.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.