Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening macOS

blog.bejarano.io

Post reply on HN
Print view View original

21–30 of 78 posts

Re: Hardening macOS

#21

Post by brilee »

teddyh wrote: post #2

The appearance of this is significant. For many years, I was annoyed whenever I saw one of these “hardening” or “securing” guides (for any platform), without knowing why. But I eventually figured it out: If you have to do extra steps to your system to “harden” it or otherwise secure it, it is either a toy system not meant for production use, or it is an old system which has ossified and needs hardening because of a l…

It's been a truism in security that the less usable you make your systems, the more your users will work around it, thereby defeating the security. E.g. passwords written stickies to defeat password expiration rules.

There's a sweet spot for security for the average user, where it's secure but usable enough that the user doesn't attempt to defeat it. For users who are willing to put up with less usable systems, more security can be had.

Re: Hardening macOS

#22

Post by ricardbejarano »

matthewmacleod wrote: post #18
teddyh wrote: post #2

The appearance of this is significant. For many years, I was annoyed whenever I saw one of these “hardening” or “securing” guides (for any platform), without knowing why. But I eventually figured it out: If you have to do extra steps to your system to “harden” it or otherwise secure it, it is either a toy system not meant for production use, or it is an old system which has ossified and needs hardening because of a l…

You’re talking nonsense. There have been hardening guides for macOS for ages. Linux too. In reality, security is a sliding scale between “everything is root and there’s no password lmao” and “so secure it’s impossible to actually do anything useful”. Different risk levels are appropriate for different users in different situations. For example, this guide talks about turning off a bunch of features that I use a lot -…

I don't think he meant "failure" so much but rather criticise the fact that operating systems sometimes deliver not-the-greatest defaults. To be fair, macOS has a very strong default set, this just takes it the extra mile.

Re: Hardening macOS

#23

Post by chris_wot »

This is great, but does anyone have a good in-depth reference for administering MacOS systems? I constantly have difficulties doing in-depth analysis and administration of MacOS systems, and that's really only because I just don't know where to go for good information.

Re: Hardening macOS

#24

Post by winrid »

Curious, what are some opinions of those "endpoint security" solutions that companies make engineers install on their laptops? Effective, intrusive? What's your experience.

Re: Hardening macOS

#25

Post by infogulch »

miles wrote: post #9

Thanks to the author for compiling and sharing this guide. Two of the recommendations have the potential to make your Mac less secure: 1. > …install an ad blocker (I recommend uBlock Origin) While uBlock Origin has a great track record, it requires these permissions: * Access your data for all websites * Read and modify privacy settings * Access browser tabs * Access browser activity during navigation That is a lot o…

Those permissions are necessary for any blocker to perform its function. And while the threat models for blockers and vpns are different, I agree that I would trust a local blocker [threat: extension hijack via auto-update; mitigation: very public source and update policy] much more than I would trust any third party vpn [threat: their 'no logging' policy is insufficient or they don't honor it; mitigation: 'we promise, mmkay?']

A self-hosted vpn would be better, but has its own problems [threats: you're uniquely identifiable by your vpn ip, you don't update fast enough to avoid security breaches, you don't configure it correctly and expose yourself to additional security breaches]. Given the difficulty of hosting and managing your own vpn infrastructure I couldn't recommend it for almost anyone.

Re: Hardening macOS

#26

Post by miles »

infogulch wrote: post #25
miles wrote: post #9

Thanks to the author for compiling and sharing this guide. Two of the recommendations have the potential to make your Mac less secure: 1. > …install an ad blocker (I recommend uBlock Origin) While uBlock Origin has a great track record, it requires these permissions: * Access your data for all websites * Read and modify privacy settings * Access browser tabs * Access browser activity during navigation That is a lot o…

Those permissions are necessary for any blocker to perform its function. And while the threat models for blockers and vpns are different, I agree that I would trust a local blocker [threat: extension hijack via auto-update; mitigation: very public source and update policy] much more than I would trust any third party vpn [threat: their 'no logging' policy is insufficient or they don't honor it; mitigation: 'we promis…

> Those permissions are necessary for any blocker to perform its function.

Not blockers for Safari like Wipr that use Content Blocking Extensions: https://giorgiocalderolla.com/wipr.html

Re: Hardening macOS

#27

Post by ricardbejarano »

notafraudster wrote: post #3

I like the title and premise of the article, but a list of tips with no description makes this feel like the standard "Tweak Ur Registry" article. I know OP is the author so I'm not trying to be a jerk, but I think adding details would improve things. To give specific examples, it is totally unclear why the article recommends creating an unprivileged account (the default user account is already unprivileged without e…

Thanks for the feedback!

Standard accounts are recommended by Apple itself as a best practice in lieu of administrator accounts. Also, sudo is not available in standard accounts which protects against any would-be vulnerability.

I updated the post regarding application sources.

I changed Google DNS with Cloudflare's 1.0.0.1. Others also mentioned the fact that suggesting a VPN provider is risky, so I also removed it.

I know some steps are redundant coming from a brand new installation, but not everyone is willing to format their drive right now, so those steps are included as well.

Again, thanks for the feedback!

Re: Hardening macOS

#28

Post by marcc »

winrid wrote: post #24

Curious, what are some opinions of those "endpoint security" solutions that companies make engineers install on their laptops? Effective, intrusive? What's your experience.

They can be effective or intrusive, it depends on the implementation. I've used one (Fleetsmith) on MacOS and configured it to be non-intrusive. It was able to enforce some of the items in this blog post (encrypted drives with key escrow, screen saver with password time), and it also was able to require latest updates for some software such as Chrome, Docker, Slack, etc.

We don't use this for engineers only, we use endpoint security for every laptop in the company. We did decide to set up a different profile for engineers though, and remained thoughtful about what to enforce. Additionally, we set up a canary profile to roll out new changes or policies and listen to feedback and problems before blindly rolling out changes to every developer machine in the company.

Re: Hardening macOS

#29

Post by ricardbejarano »

chris_wot wrote: post #23

This is great, but does anyone have a good in-depth reference for administering MacOS systems? I constantly have difficulties doing in-depth analysis and administration of MacOS systems, and that's really only because I just don't know where to go for good information.

The sources I recall while writing this:

- https://github.com/drduh/macOS-Security-and-Privacy-Guide

- https://github.com/CISOfy/lynis

- https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.s...

- https://help.apple.com/machelp/mac/10.12/index.html#/mh11389

- http://newosxbook.com/files/moxii3/AppendixA.pdf

Hope it helps!

Re: Hardening macOS

#30

Post by ricardbejarano »

floatingatoll wrote: post #20
zakk wrote: post #5

Thanks for the nice guide. I wouldn’t use Google DNS as a default though, they don’t have a good record when it comes to respecting privacy.

It’s ironic to see a guide to securing anything recommend using plaintext MITM-able DNS rather than instructing users to build and configure a safe DNS-over-HTTPS resolver to the exact same IPs.

IIRC, Google DNS and Cloudflare DNS both support "DNS over TLS" and "DNS over HTTPS", that's the reason I recommend them in the first place.
Post reply on HN