Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS has checked app signatures online for over 2 years

eclecticlight.co

Post reply on HN
Print view View original

241–250 of 458 posts

Re: macOS has checked app signatures online for over 2 years

#241

Post by [deleted] »

bitL wrote: post #223
JackC wrote: post #210

> Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them. I agree that anyone critiquing Appl…

Why can't Apple download all footprints of bad apps locally instead of monitoring every single invocation of apps? Is second execution of an app the same security risk as the first one? That's the design flaw.

[deleted]

Re: macOS has checked app signatures online for over 2 years

#242

Post by heelix »

tzs wrote: post #201
_puk wrote: post #52

Earlier quoted context omitted.

Whilst I agree with the sentiment, it does occur to me just how many kindles I see with ads. Is there any data released on ads Vs no ads versions? That's the closest comparator I can think of.

I've never had a non-eInk Kindle, so maybe it is different for them, but I've had eInk Kindles both with and without ads. My first was without ads. Since you can add the "without ads" option to a "with ads" Kindle later by paying the difference, I bought my second with ads to see how bad it was. Here are the only differences I've noticed: • With ads, the sleep screen displays some artwork from a book Amazon is sellin…

Heh. With ads, this was always one of the ways I could embarrass my Bride. You are reading '50 Shades of Grey' or whatever trashy novel shows up on the cover of her gadget. Always makes her blush.

Re: macOS has checked app signatures online for over 2 years

#243

Post by JackC »

flemhans wrote: post #226
JackC wrote: post #210

> Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them. I agree that anyone critiquing Appl…

How many revocations do they do? How about just downloading the whole list to the clients which they can check offline.

It sounds like that's how it used to work, and then it changed for some reason, maybe to do with the size of the list and a need for faster updates.

Actually that unknown exposes the problem with the original article's demand that critics explain what they want to replace Apple's system. No one outside of Apple is in a position to design a system that addresses all of the design constraints -- we don't even know what they all are. But we are in a position to assert some additional design constraints, such as requiring that the system not leak developer certs to eavesdroppers every time an application is run, and expect Apple to figure out a solution that takes them into account.

Re: macOS has checked app signatures online for over 2 years

#244

Post by sudosysgen »

kortilla wrote: post #154
sudosysgen wrote: post #141

Earlier quoted context omitted.

No one suggested they are. But they still make it much less likely for the average Joe to put money and effort to protect their privacy, and this is known to those that make major pricing decisions.

We’re talking about Apple here. People who can afford a Mac over a cheap pc/chrome book already have disposable income and are making trade-offs with it.

That is not really true. Many people of lower income will buy a Mac after their cheap laptops break because they perceive them, correctly or not, to be the most reliable and thus less expensive on the long term laptops. Sometimes even second hand.

Also, Chromebooks are not viable alternatives for many people especially of lower income. Having to rely on being always online is an issue when you can't always guarantee having internet. Been there, done that.

Re: macOS has checked app signatures online for over 2 years

#245

Post by dkonofalski »

wintermutestwin wrote: post #62
pacifika wrote: post #30

Earlier quoted context omitted.

It's been good practice for a long time to "freeze" or "render" the tracks out after the song is finished so that the song can be loaded without the plugins.

True, but this shouldn't be necessary in response to anti-consumer behavior.

This is not anti-consumer behavior. Consumers are, overall, protected when they can verify the source of an application or extension on their computers. Their freedom may be limited but it's not a black-and-white "this is anti-consumer".

Re: macOS has checked app signatures online for over 2 years

#246

Post by WhyNotHugo »

dcow wrote: post #231

Security and privacy are not parallel concerns, they’re orthogonal. Strong security absolutely does not imply utmost privacy. I find this to be the most dangerous misconception of the late privacy trend. You can’t just turn security and privacy dials to 11. They’re actually two ends of the same dial, or opposing poles of the same sphere. To increase privacy you must move away from perfect security. Why? Because secur…

While security and privacy are not parallel, they are not orthogonal either.

You can have both. Integrity checks can be done anonymously (e.g.: you could have a p2p network of devices sharing a signed database of certificate revocations).

Encrypting something gives me privacy. Signing something gives me security. Encrypting a signed package gives me both.

Re: macOS has checked app signatures online for over 2 years

#247

Post by als0 »

epistasis wrote: post #239
bitL wrote: post #223

Earlier quoted context omitted.

Why can't Apple download all footprints of bad apps locally instead of monitoring every single invocation of apps? Is second execution of an app the same security risk as the first one? That's the design flaw.

The black list of malware is called Xprotect and dates back to 2009. This check for revoked certificates is a different security layer. The second check of an app is necessary to check for revocation: for a developer that decides that they've been compromised and wants to stop execution of their software. The alternative would be to use certificate revocation lists instead of OCSP. CRL lists can get long, so OCSP is…

I've been wondering why CRL couldn't be used if the OCSP goes down or no reply is received. That way you get the benefits of both. Any reason why this would be a bad idea?

Also are CRLs really that bad in practice? I know it would be a bad idea on a smartphone but is it really an issue on a laptop?

Re: macOS has checked app signatures online for over 2 years

#248

Post by ethbr0 »

_jal wrote: post #228
ethbr0 wrote: post #86

Earlier quoted context omitted.

The act of breaching privacy is technically difficult to prohibit in a way many of us would find palatable. What should be targeted is the product of said breaches. Something like the blood diamond approach. If your company has PII, then you by law must be able to produce a consented attestation chain all the way back to the source. If you do not, then you're charged a fine for every piece of unattested PII on every…

- Can you demonstrate the provenance of every phone number, email address and other contact mode on your phone? Note people's birthdays? Sure, you only want to target companies. Make sure you choose your acquaintances wisely, I guess, or make sure you record their grant of permission to email them, because people abuse laws like this to harass each other every single day. - This also punishes possession, not use. If…

> Sure, you only want to target companies

Yes. There are many laws (e.g. accounting) that only apply to companies, when it's scale that amplifies harm.

> possession, not use

How are they different, in this context? The latter requires the former, and the former is unprofitable without the latter.

> how are you going to audit Ford or Geico?

As you note, similarly to how we audit now, albeit hopefully more proactively. If the law requires a signed off third-party PII audit, and holds an auditor legally liable for signing off on one... I expect the problem would (mostly) take care of itself.

PII is always going to be a game of edge cases, but we've managed to make it work with PCI and PHI in similarly messy domains.

Right now, companies have GDPR & CCPA to nudge them in data architecture. National laws would just further that. I can attest to major companies retooling how they handle and track consumer data just due to the CCPA.

Re: macOS has checked app signatures online for over 2 years

#249

Post by benhurmarcel »

epistasis wrote: post #239
bitL wrote: post #223

Earlier quoted context omitted.

Why can't Apple download all footprints of bad apps locally instead of monitoring every single invocation of apps? Is second execution of an app the same security risk as the first one? That's the design flaw.

The black list of malware is called Xprotect and dates back to 2009. This check for revoked certificates is a different security layer. The second check of an app is necessary to check for revocation: for a developer that decides that they've been compromised and wants to stop execution of their software. The alternative would be to use certificate revocation lists instead of OCSP. CRL lists can get long, so OCSP is…

Probably it's not necessary to check for revocation that often though. It could even be argued that it's only needed when the binary is updated.

And it's absolutely not normal to fail if that revocation check doesn't succeed anyway.

Re: macOS has checked app signatures online for over 2 years

#250

Post by jonnytran »

hanniabu wrote: post #207
triangleman wrote: post #113

Earlier quoted context omitted.

>maybe blockchain will solve the problem of trust among humans Absolutely not. https://www.schneier.com/blog/archives/2019/02/blockchain_an...

There's so much wrong with this post I'm not even sure where to start. Literally almost every paragraph starts something untrue. The whole article is written from a false understanding.

Can you please explain what those untrue statements are and what his false understanding is?
Post reply on HN