For those who want more: https://github.com/drduh/macOS-Security-and-Privacy-Guide
Hardening macOS
11–20 of 78 posts
Re: Hardening macOS
#12I like the title and premise of the article, but a list of tips with no description makes this feel like the standard "Tweak Ur Registry" article. I know OP is the author so I'm not trying to be a jerk, but I think adding details would improve things. To give specific examples, it is totally unclear why the article recommends creating an unprivileged account (the default user account is already unprivileged without e…
To give specific examples, it is totally unclear why the article recommends creating an unprivileged account (the default user account is already unprivileged without entering a password for anything
That's not correct. The first account created is an Admin account. It has more privileges than a Standard account.
Try the following in macOS High Sierra 10.13.6 as a Standard account then again as an Admin account. Open a terminal shell, and:
cd /Applications
touch fubar
Permission denied
Re: Hardening macOS
#13Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system.
This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.
Re: Hardening macOS
#14Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system. This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.
macOS is pretty secure by default but there are some extra steps you can take towards improving on that regard, Apple itself has a bunch of very basic steps listed here: https://help.apple.com/machelp/mac/10.12/index.html#/mh11389
Re: Hardening macOS
#15Why disable the captive portal detection? Is macOS detecting MITMing for you bad?
Re: Hardening macOS
#16Thanks to the author for compiling and sharing this guide. Two of the recommendations have the potential to make your Mac less secure: 1. > …install an ad blocker (I recommend uBlock Origin) While uBlock Origin has a great track record, it requires these permissions: * Access your data for all websites * Read and modify privacy settings * Access browser tabs * Access browser activity during navigation That is a lot o…
Thanks for your feedback!
I agree with your points and I updated the post so.
Re: Hardening macOS
#17Why disable the captive portal detection? Is macOS detecting MITMing for you bad?
> An attacker could trigger the utility and direct a Mac to a site with malware without user interaction, so it's best to disable this feature and log in to captive portals using your regular Web browser, provided you have first disable any custom dns and/or proxy settings.
See https://github.com/drduh/macOS-Security-and-Privacy-Guide#ca...
Re: Hardening macOS
#18The appearance of this is significant. For many years, I was annoyed whenever I saw one of these “hardening” or “securing” guides (for any platform), without knowing why. But I eventually figured it out: If you have to do extra steps to your system to “harden” it or otherwise secure it, it is either a toy system not meant for production use, or it is an old system which has ossified and needs hardening because of a l…
You’re talking nonsense. There have been hardening guides for macOS for ages. Linux too.
In reality, security is a sliding scale between “everything is root and there’s no password lmao” and “so secure it’s impossible to actually do anything useful”. Different risk levels are appropriate for different users in different situations. For example, this guide talks about turning off a bunch of features that I use a lot - like continuity and handoff between iOS and macOS. These features might feasibly be a security burden—as in, they might increase the attack area, despite having no known vulnerabilities—but in exchange they improve usability.
I can’t reasonably agree that this is some kind of indication of failure. MacOS is a consumer operating system; it seems like the security it offers is generally reasonably optimised for that role.
Re: Hardening macOS
#19For those who want more: https://github.com/drduh/macOS-Security-and-Privacy-Guide
One of my sources was this guide, it's great.
Re: Hardening macOS
#20Thanks for the nice guide. I wouldn’t use Google DNS as a default though, they don’t have a good record when it comes to respecting privacy.
It’s ironic to see a guide to securing anything recommend using plaintext MITM-able DNS rather than instructing users to build and configure a safe DNS-over-HTTPS resolver to the exact same IPs.