macOS has checked app signatures online for over 2 years • Hacker News Board

Re: macOS has checked app signatures online for over 2 years

#431

Post by egsmi » Thu, Nov 26, 2020, 5:35 PM UTC

ClumsyPilot wrote: post #426

egsmi wrote: post #353

Earlier quoted context omitted.

https://developer.apple.com/videos/play/wwdc2019/703/ The second half of the talk is about the "hardened runtime" And in the wider tech press https://appleinsider.com/articles/19/06/03/apples-macos-cata... "Mac apps, installer packages, and kernel extensions that are signed with Developer ID must also be notarized by Apple in order to run on macOS Catalina" Even on hacker news https://news.ycombinator.com/item?id=211…

Firstly, this is not 'advertised' - this is not a material average apple consumer reads. Secondly, it does not actually say anything about the OS phoning home and preventing the user from launching an app. The appleinside talks vaguelt of 'Notarisation', something thay can be inplemented in a variety of ways, like signing application with a certificate

Here is a Forbes article (do “normal” people read Forbes?) that says to run apps in Catalina one will need permission from Apple. It even anticipated this problem with the server. Sure, it doesn’t mention sockets but remember this is for normal people and I think people are smart enough to assume that Apple is probably not giving permission to launch an App by carrier pigeon.

There are 100s of articles like this. Gatekeeper was a keynote feature.

https://www.forbes.com/sites/ewanspence/2019/12/28/apple-mac...

Re: macOS has checked app signatures online for over 2 years

#432

Post by [deleted] » Thu, Nov 26, 2020, 5:52 PM UTC

angry_octet wrote: post #383

ascagnel_ wrote: post #166

Earlier quoted context omitted.

> The other thing I'd like to see is the app open immediately, w/ the check happening asynchronously in the background. (This seems like super-basic good engineering to me.) No idea if they're planning to fix that or not. How would this work? The point of the check is to block malware from running, and opening without the check would, by definition, negate the entire system. If malware authors get wise to the async s…

Surely this check could be done on install/first run, then cached? If you want rapid blacklisting, a frequent call to Apple to say "anything new blacklisted?" would suffice. Same as push notification.

[deleted]

Re: macOS has checked app signatures online for over 2 years

#433

Post by ogre_codes » Thu, Nov 26, 2020, 5:54 PM UTC

saurik wrote: post #423

ogre_codes wrote: post #220

Earlier quoted context omitted.

> I'm fascinated in this affaire how technically knowledgeable people loose common sense to defend their favorite brand What I find weird is regardless of what the discussion is involving Apple, someone needs to pop in with one of these theories about Apple tribalism. Very very few people are in fact "defending" Apple here. Even among those few, the sentiment is largely that this is bad and Apple is fixing it.

I presume the comment is about the article, which it quotes, so it doesn't matter how few such people exist.

It takes some serious mental gymnastics to see how that part of his comment relates to the article.

Re: macOS has checked app signatures online for over 2 years

#434

Post by m463 » Thu, Nov 26, 2020, 6:51 PM UTC

Bud wrote: post #134

m463 wrote: post #63

Earlier quoted context omitted.

I first started getting an idea that something was amiss with apple years and years ago. "Apple machines don't get viruses" Everyone "knew" that. Everyone knew that apple machines were secure. Turns out there were plenty of things going on with apple just like other companies. The difference was that apple would actively persecute (even prosecute) people who explored or discovered these things. Basically apple market…

Please cite evidence for these extraordinary claims. Who, precisely, did Apple "prosecute" for "exploring" security issues? Please don't post made-up things in public. As an aside, no, everyone did not "know" that Macs don't get viruses. But yes, most informed people were aware that Macs were somewhat less susceptible to malware for a while. Please don't exaggerate wildly.

I cannot find the specific articles, but there were security researchers who would find some sort of apple problem and would be contacted by apple and go dark. This was probably the era when osx was getting off the ground. I assume they were protecting their brand, but I always thought it was a little ingenuine (on the other hand, security researchers are not all college professors with good intentions)

I think apple finally had to cave when there problems too large to ignore.

https://www.ibtimes.com/apple-yanks-mac-virus-immunity-claim...

Re: macOS has checked app signatures online for over 2 years

#435

Post by m463 » Thu, Nov 26, 2020, 6:56 PM UTC

cdubzzz wrote: post #64

m463 wrote: post #57

Earlier quoted context omitted.

I believe you are trying to think about this rationally, but this is not the only thing going on. When a mac boots up or changes network location, a long list of processes on your machine (like AppleIdAuthAgent, identityservicesd, , and maybe 10 or 20 more) connect to various apple servers associating your actual identity with the ip address. It will continue to do these kinds of things while you are online. And all…

Do you have sources for this? I don’t doubt you, I’d just be interested to read some details about what exactly those services are doing/sending.

this is from observations of my own machines.

I would suggest you install little snitch, turn off everything, and then boot your machine. Maybe switch from ethernet to wifi and observe the kinds of popups you get.

Another method, though hard to associate with specific processes, would be to run tcpdump -i .

Sometimes it's more useful to run tcpdump and do a capture, then play it back later because DNS lookups by tcpdump itself make it more chatty than it should be. You could also run it with -n but you get less information.

Re: macOS has checked app signatures online for over 2 years

#436

Post by m463 » Thu, Nov 26, 2020, 7:03 PM UTC

athms wrote: post #284

m463 wrote: post #43

Earlier quoted context omitted.

[X] Query OCSP responder servers to confirm the current validity of certificates You can uncheck this box in firefox. You cannot uncheck anything in macos. Arguably firefox won't let you opt-out of automatic updates and a bunch of other annoying stuff, but apple is significantly worse.

>Arguably firefox won't let you opt-out of automatic updates Yes it will, but you need to create a policy and be using version 60 which includes the Enterprise Policy Engine. https://support.mozilla.org/en-US/products/firefox-enterpris... The Enterprise Policy Generator add-on will help create the policy file.

Yeah, but removing it from settings was not something I liked.

I actually did the enterprise thing when I found out about it:

  sudo defaults write /Library/Preferences/org.mozilla.firefox EnterprisePoliciesEnabled -bool TRUE"
  echo "sudo defaults write /Library/Preferences/org.mozilla.firefox DisableAppUpdate -bool TRUE

But I could still not prevent firefox from trying to phone home:

  shavar.services.mozilla.com
  firefox.settings.services.mozilla.com

Re: macOS has checked app signatures online for over 2 years

#437

Post by zapzupnz » Thu, Nov 26, 2020, 8:54 PM UTC

exoji2e wrote: post #416

dkonofalski wrote: post #340

Earlier quoted context omitted.

Of course it impacts the user... And if Epic was found doing something illegal and was shut down or bankrupted, that would also impact the user. Your over-simplification that it's a "business disagreement" is disingenuous and incomplete. The signature revocation system you're claiming is simply to "protect their business model" is the same system that allows Apple to immediately shut down any malware that makes its w…

I was not claiming the revocation system only has the purpose of protecting Apple's business model, but its one of the purposes. Even though I agree that in the Epic case, most of the blame lies with Epic, I still have a problem with Apple: the signature revocation system is used for more things than removing malware. I think it is user hostile and anti consumer to disable installed apps on other grounds, because the…

> I'd like to be able to run programs and apps on my machine that are not Apple-approved.

I thought you could anyway. You would right-click the app in Finder and choose Open — from then on, it would continue to open.

Or is that a different mechanism?

Re: macOS has checked app signatures online for over 2 years

#438

Post by _dmd » Thu, Nov 26, 2020, 11:33 PM UTC

pram wrote: post #408

_dmd wrote: post #399

What I find a lot scarier is that macOS seems to store your local user's password as a hash with Apple. A few months ago I was signing in on my MacBook, and it asked me (assuming because I did not have a mobile number attached) for my Hackintosh local user's password to 2FA. May be buried in the depths of the EULA, but I most definitely never agreed for my LOCAL account password to be uploaded to Apple. At least sign…

If you’re using iCloud then that’s coming from keychain. That’s how you can reset the local password with your Apple ID.

Never been using iCloud, on any of my Apple devices

Re: macOS has checked app signatures online for over 2 years

#439

Post by Cpoll » Fri, Nov 27, 2020, 12:30 AM UTC

kstrauser wrote: post #230

hanniabu wrote: post #207

Earlier quoted context omitted.

There's so much wrong with this post I'm not even sure where to start. Literally almost every paragraph starts something untrue. The whole article is written from a false understanding.

If you’re going to claim Schneier is wrong on crypto stuff, you’ll want to bring a suitcase of evidence along if you want people to take your claim seriously.

Schneier is good at times, but he doesn't always do as much due diligence as he should, and he never bothers to interact with his comment threads, answer questions, or publish retractions.

As a result, I've had more than one experience of arguing with people who take his old blog posts as gospel without ever thinking critically about them.

His article denouncing the XKCD password scheme is a gem, he doesn't bother (if it were anyone else I'd be less charitable and say doesn't know how) to calculate the entropy, and then he proposes an alternate scheme he invented that almost certainly provides less entropy and is more vulnerable to dictionary attacks.

Re: macOS has checked app signatures online for over 2 years

#440

Post by krrrh » Fri, Nov 27, 2020, 1:21 AM UTC

AshWolfy wrote: post #400

krrrh wrote: post #194

Earlier quoted context omitted.

The article points out that while there are drawbacks to checking app signatures, there have also been documented benefits in terms of uncovering vulnerabilities and making systems more secure, which also has direct privacy benefits to the users whose systems don't become compromised by malware. The balancing act between freedom and security is never going to not be a debate. Engaging in it in good faith as in the li…

Signature checking is not what people are mad about, the only way to get anything not bad from this situation is in the most abstract view that signature checking is not bad thats the problem with people who dismiss Klein and her "oeuvre" you are so desperate to stay in the middle you refuse to see evidence right in front of your face

Sometimes people just draw different conclusions because they have different values and priorities or willingness to accept incremental progress.

I’m not dismissing Klein, I referred to her “oeuvre” out of my respect for her as an artist.