Live data from Hacker News

macOS has checked app signatures online for over 2 years

eclecticlight.co

231–240 of 458 posts

Re: macOS has checked app signatures online for over 2 years

#231
Security and privacy are not parallel concerns, they’re orthogonal. Strong security absolutely does not imply utmost privacy. I find this to be the most dangerous misconception of the late privacy trend. You can’t just turn security and privacy dials to 11. They’re actually two ends of the same dial, or opposing poles of the same sphere. To increase privacy you must move away from perfect security.

Why? Because security is all about who you trust (and who you don’t). Privacy is about concealing things from people you trust (and especially from those you don’t). Security is best served with strong identity and periodic integrity checks/monitoring. Privacy is best served via anonymity and opacity. If something is private, by definition there lacks the transparency to audit its integrity.

So what I lament is not that a company is trying to achieve both, but rather that as a consumer I’m not educated on the topic and able to make a choice as to where I want to set the dial.

You will continue to see “headlines” like this so long as socially we’re obsessed with trying to implement both security and privacy and fall subject to marketing suggesting some service provides the maximum of both.

If you trust Apple to verify the integrity of apps on your devices and secure your system from unwanted software, then you trust Apple to maintain the privacy around the data needed to achieve such. That’s the whole value prop of their platform and ecosystem. It’s a walled garden with abundant privacy koolaid fountains.

The only reason this is news is because people don’t understand the privacy vs security dichotomy. And because Apple does not provide a way for consumers to choose just how much security they’re comfortable with.

If you don’t trust Apple then stop pretending you do by using their hardware/ecosystem.

Re: macOS has checked app signatures online for over 2 years

#232
> What has been puzzling me ever since is that these OCSP checks have been well-known for a couple of years,

This is where you’re wrong. It was known, but not well-known. Users do not expect an HTTP request to be blocking their application executions.

Personally, I don’t see why CRL is not sufficient. Yes I want malicious signatures blacklisted, but can’t I just get a list instead? Some of the reasons CRL is no longer used do not apply to code signatures.

Re: macOS has checked app signatures online for over 2 years

#233

The only charitable understanding of this program is that Apple has no actual table connecting software to hashes, but that they could use the information to understand outbreaks of botnets/spyware that they could then help inform ISPs/global law enforcement to help stop. Is this even reasonable?

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

>The requests contain only app hashes.

No, application hashes are never sent. People are confusing OCSP and notarization. The requests sent via OCSP check the developer certificate. Notarization checks are done over HTTPS.

Re: macOS has checked app signatures online for over 2 years

#234

Earlier quoted context omitted.

> Whilst I agree with the sentiment, it does occur to me just how many kindles I see with ads. True, although the price difference for the Kindle is about 20%. If the discount on a Macbook Air was similar, I'm sure it would be well subscribed.

The discount for what? There are no ads on the Mac.

> If the option was a mac with privacy vs a mac without privacy but $10 cheaper

OP was comparing the Kindle with ads discount to an imaginary Mac without privacy discount.

Re: macOS has checked app signatures online for over 2 years

#235
post #223
post #210

> Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them. I agree that anyone critiquing Appl…

Why can't Apple download all footprints of bad apps locally instead of monitoring every single invocation of apps? Is second execution of an app the same security risk as the first one? That's the design flaw.

You mean bad certificates rather than applications.

OCSP can be locally cached, and Apple's implementation does exactly that. But eventually you'll have to refresh the cache and then the implementation needs to be fault tolerant (Apple's wasn't).

OCSP leaks what vendors your installed applications are from. The list of leaked certificates changes daily, so any good implementation is going to check again at least several times a week. If you download the entire database, you're just consuming hundreds of megabytes of bandwidth/storage but aren't removing the need to refresh/expire the cache.

I'd argue the two biggest flaws Apple's system has is bad fault tolerance and also no user accessible opt out (even if just for emergencies).

Re: macOS has checked app signatures online for over 2 years

#236
post #86

Earlier quoted context omitted.

The act of breaching privacy is technically difficult to prohibit in a way many of us would find palatable. What should be targeted is the product of said breaches. Something like the blood diamond approach. If your company has PII, then you by law must be able to produce a consented attestation chain all the way back to the source. If you do not, then you're charged a fine for every piece of unattested PII on every…

I thonk we are both arguing that clear consent must be present, and the customer must have clearly agreed to whatever you are doing with the data - that appears similar to GDPR. However, how do you prove John Doe has actually agreed to this? What if John says he did not click accept button? Do we require digital signature with certificates, given that most people don't have them or know how to use them? I think the p…

It's analogous to the credit card fraud problem, no? E.g. disputing charges and chargebacks?

I don't work in that space, but my understanding is that the card processors essentially serve as dispute mediators in those instances.

So it would seem unavoidable (although not great) to have some sort of trusted, third-party middle person between collectors and end users, who can handle disputes and vouch for consent.

Blockchain doesn't seem like a solution, given that the problem is precisely in the digital-physical gap. E.g. I have proof of consent (digital) but no way to tie it to a (disputed) act of consent (physical).

Re: macOS has checked app signatures online for over 2 years

#237
post #223
post #210

> Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them. I agree that anyone critiquing Appl…

Why can't Apple download all footprints of bad apps locally instead of monitoring every single invocation of apps? Is second execution of an app the same security risk as the first one? That's the design flaw.

[deleted]

Re: macOS has checked app signatures online for over 2 years

#238

Earlier quoted context omitted.

>maybe blockchain will solve the problem of trust among humans Absolutely not. https://www.schneier.com/blog/archives/2019/02/blockchain_an...

There's so much wrong with this post I'm not even sure where to start. Literally almost every paragraph starts something untrue. The whole article is written from a false understanding.

[deleted]

Re: macOS has checked app signatures online for over 2 years

#239
post #223
post #210

> Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them. I agree that anyone critiquing Appl…

Why can't Apple download all footprints of bad apps locally instead of monitoring every single invocation of apps? Is second execution of an app the same security risk as the first one? That's the design flaw.

The black list of malware is called Xprotect and dates back to 2009. This check for revoked certificates is a different security layer.

The second check of an app is necessary to check for revocation: for a developer that decides that they've been compromised and wants to stop execution of their software. The alternative would be to use certificate revocation lists instead of OCSP. CRL lists can get long, so OCSP is often preferred to CRLs.

Re: macOS has checked app signatures online for over 2 years

#240

Earlier quoted context omitted.

They should care. The checks are sent unencrypted over HTTP to Apple's OCSP.

Since they don’t identify specific apps you use, so what’s your point?

As far as I understand it, most vendors ship a single digit amount of apps. If you start the Tor browser, everyone on your network will know. If you start Firefox, everyone on your network will know you started a Mozilla product, most likely Firefox. If you start the Zoom client, everyone on your network knows you started the Zoom client.

I don't think the "it's only the vendor" defense of Apple is any good.

Post reply on HN