Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening macOS

blog.bejarano.io

Post reply on HN
Print view View original

41–50 of 78 posts

Re: Hardening macOS

#41

Post by miles »

notafraudster wrote: post #35
ricardbejarano wrote: post #27

Earlier quoted context omitted.

Thanks for the feedback! Standard accounts are recommended by Apple itself as a best practice in lieu of administrator accounts. Also, sudo is not available in standard accounts which protects against any would-be vulnerability. I updated the post regarding application sources. I changed Google DNS with Cloudflare's 1.0.0.1. Others also mentioned the fact that suggesting a VPN provider is risky, so I also removed it.…

I didn't say for the standard account to use sudo; I said for it to use su to switch to an admin account, and then use sudo from the admin account -- as a point of illustration that if you have the admin password, it's game over, whether or not you're currently signed in as an admin or an unprivileged user. Unless standard accounts don't have access to "su" at all, but I can't see that being the case without locking…

> Even if you didn't know the username of the admin account, /etc/passwd is 0644 so you could look it up as an unprivileged user

Users don't appear in /etc/passwd on Mac OS X https://superuser.com/questions/191330/users-dont-appear-in-...

Re: Hardening macOS

#42

Post by ricardbejarano »

chmars wrote: post #38
comboy wrote: post #13

Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system. This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.

Just one example: In Safari, Open 'safe' files after downloaded is enabled by default … (Yep, 'safe' files, not safe files, it's almost like a long-running joke by some Safari developer.)

Thanks for pointing that out! I can't believe I missed that!

Re: Hardening macOS

#43

Post by mjlee »

I'd also consider adding a firmware password if you're at all worried about unattended physical access to your mac. It will prevent your OS/boot order from being tampered with, preventing a variety of attacks.

Less important with T2 on the latest macs, but still worth considering.

Re: Hardening macOS

#44

Post by userbinator »

comboy wrote: post #13

Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system. This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.

a security team working full time on developing the system

They've missed a few things. This is a memorable one: https://news.ycombinator.com/item?id=15800676

Re: Hardening macOS

#46

Post by anothergoogler »

comboy wrote: post #13

Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system. This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.

Why do you expect somebody to persuade you not to be blase about security? If enjoy playing in the street, knock yourself out.

Re: Hardening macOS

#48

Post by gpm »

comboy wrote: post #13

Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system. This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.

Because the security team doesn't choose the defaults. They have some input, but other teams also have input and will cause settings to be enabled that have negative security consequences. E.g. "tell Apple everytime you connect to a wifi network to check for captive portals".

Because the security team's goal is MacOS as a whole, and not your individual computer. So they have an incentive to enable things like automatic bug reports that harm your personal security but contribute to the overall security (not to mention usability) of the MacOS ecosystem.

Re: Hardening macOS

#49

Post by konart »

>Go to System Preferences > Security & Privacy > Firewall > Firewall Options… and check Block all incoming connections

Thanks, but no, I need this one.

The whole guide is for people feeling paranoid.

PS: I'm not trying to say you should not make your machine more secure, but blocking\locking "all the stuff" is not a sane option either.

Re: Hardening macOS

#50

Post by infogulch »

miles wrote: post #26
infogulch wrote: post #25

Earlier quoted context omitted.

Those permissions are necessary for any blocker to perform its function. And while the threat models for blockers and vpns are different, I agree that I would trust a local blocker [threat: extension hijack via auto-update; mitigation: very public source and update policy] much more than I would trust any third party vpn [threat: their 'no logging' policy is insufficient or they don't honor it; mitigation: 'we promis…

> Those permissions are necessary for any blocker to perform its function. Not blockers for Safari like Wipr that use Content Blocking Extensions: https://giorgiocalderolla.com/wipr.html

Content Blocking Extensions are pretty neat from a privacy perspective, but they're quite limited in functionality since they're basically glorified block lists (why you'd pay $2 for a list that's freely published is another question) and it requires support from the platform. uBlock supports a lot of features that CBE apps can't.
Post reply on HN