Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening macOS

blog.bejarano.io

Post reply on HN
Print view View original

61–70 of 78 posts

Re: Hardening macOS

#61

Post by chmars »

ricardbejarano wrote: post #40
chmars wrote: post #36

Interesting: If I deny System Services location access for 'Setting Time Zone', my iMac 5K changes the color temperature … (Security & Privacy / Location Services / System Services / Details / Setting Time Zone)

It's due to Night Shift, set it to a custom schedule (or enable location services but only for time zone settings)

Yep, but why can't I run Night Shift without locations services? My time zone is, after all, known … And I would even enter my exact location if possible.

(I don't really mind location services with regard to Apple, however, for an iMac, location services are pretty useless.)

Re: Hardening macOS

#62

Post by garg »

konart wrote: post #49

>Go to System Preferences > Security & Privacy > Firewall > Firewall Options… and check Block all incoming connections Thanks, but no, I need this one. The whole guide is for people feeling paranoid. PS: I'm not trying to say you should not make your machine more secure, but blocking\locking "all the stuff" is not a sane option either.

Are you running a server on your mac? If not, then who do you want to allow remotely connecting to your mac? Connections established/initiated by your machine still go through when you enable that setting.

Re: Hardening macOS

#63

Post by staticassertion »

idle_zealot wrote: post #60
pfschell wrote: post #57

Earlier quoted context omitted.

What do you need it for that it actually prevents? I've used this for close to a decade, and it has never broken anything. Sounds like FUD mate.

Ssh and p2p stuff are two examples off the top of my head. For p2p, you lose the ability for peers to initiate a connection with you if you block incoming traffic.

Why not block all incoming connections except on those ports?

Re: Hardening macOS

#64

Post by weeks »

"I recommend rolling your own email server"

This is actively harmful advice. Do not roll your own email. Use a well-known provider with a solid security track record.

Re: Hardening macOS

#65

Post by saagarjha »

userbinator wrote: post #44
comboy wrote: post #13

Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system. This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.

a security team working full time on developing the system They've missed a few things. This is a memorable one: https://news.ycombinator.com/item?id=15800676

Of course, that was a bug, not an explicit choice to favor usability over security.

Re: Hardening macOS

#66

Post by saagarjha »

chmars wrote: post #61
ricardbejarano wrote: post #40

Earlier quoted context omitted.

It's due to Night Shift, set it to a custom schedule (or enable location services but only for time zone settings)

Yep, but why can't I run Night Shift without locations services? My time zone is, after all, known … And I would even enter my exact location if possible. (I don't really mind location services with regard to Apple, however, for an iMac, location services are pretty useless.)

You can use Night Shift, just not with a dynamically changing schedule.

Re: Hardening macOS

#67

Post by asveikau »

comboy wrote: post #13

Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system. This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.

You're putting the macOS team on a pedestal. Accounts I read elsewhere are it's a pretty barebones crew and I bet there are many components sitting unmaintained release to release with bad defaults to boot.

Re: Hardening macOS

#68

Post by doctorless »

“Warning: if your threat model is a state-sponsored agency, you are better off without macOS, see OpenBSD.”

While my excessively paranoid self is inclined to agree, I am curious as to the author’s reasoning here.

Re: Hardening macOS

#69

Post by ricardbejarano »

doctorless wrote: post #68

“Warning: if your threat model is a state-sponsored agency, you are better off without macOS, see OpenBSD.” While my excessively paranoid self is inclined to agree, I am curious as to the author’s reasoning here.

I consider Apple to be the only respectable bigtech left, that said, I can't avoid to make the following reasoning:

- Apple is US-based, therefore subject to PRISM (and any other surveillance program we don't know about)

- There's a long record of companies going rogue on users for legal reasons

- Apple makes macOS

- macOS is not fully open-source

This means that there's the possibility of macOS turning it's back on users, and that would make me refuse macOS if I were the target of someone with enough money and time.

On why OpenBSD, it's because of it's excellent track of security vulnerabilities (only 2 in 20+ years). Tails and Qubes are also great, but they haven't been out there for as long as OpenBSD has and I think the BSDs deserve some more love.

Edit: CoreOS has some great security features too, such as a read-only /usr. I also believe ChromeOS has some similar features.

Re: Hardening macOS

#70

Post by PhantomGremlin »

notafraudster wrote: post #34
PhantomGremlin wrote: post #12

Earlier quoted context omitted.

To give specific examples, it is totally unclear why the article recommends creating an unprivileged account (the default user account is already unprivileged without entering a password for anything That's not correct. The first account created is an Admin account. It has more privileges than a Standard account. Try the following in macOS High Sierra 10.13.6 as a Standard account then again as an Admin account. Open…

It's true the group on /Applications is "admin", and thus mechanically there exist things that the default user account can do than an unprivileged account can't do. Not to put you on the spot, but, can you think of an example that isn't a toy example and actually reflects a potential harm? Okay, so I can write to Applications. But I can't use that ability to install an application that actually has permissions to do…

Okay, so I can write to Applications. But I can't use that ability to install an application that actually has permissions to do anything real, right?

Apple's System Integrity Protection only applies to pre-installed programs. I just now screwed around with the following object and the system let me do it:

   /Applications/Firefox.app/Contents/MacOS/firefox
If I can do that from Terminal, then what's to stop some malicious JavaScript from doing that IRL? Once user installed programs in /Applications are fair game, it becomes much easier to subvert macOS.

By allowing untrusted binaries, you're essentially saying to the world "Go ahead, run any binary you want on my computer as an unprivileged user. macOS will protect my system from you".

Not me. I'd rather make it just that much more difficult to keep malware off my computer. Setting aside everything else, the whole meltdown/spectre thing is enough for me to want to minimize the random untrusted code I run.

And even if macOS itself is safe, those random binaries can still exfiltrate all my user data as an unprivileged user. They can mine Monero. They can participate in a botnet. All of that is possible without subverting macOS.

No. Just no.

Post reply on HN