Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

Post reply on HN
Print view View original

221–230 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#221

Post by stavros »

chippiewill wrote: post #217
StavrosK wrote: post #188

Earlier quoted context omitted.

Isn't "it's in our financial interests right now" about as much "love" as you'll get for anything by a corporation? Saying "Apple has no love for privacy, they're only doing it because it sells" sounds moot to me, every company only does things because they sell.

That's quite an extreme-end of capitalist way of looking at it. Companies build a vision or image for how they behave and a lot of that is going to be driven by marketability. For example Microsoft has taken a very pro-developer stance since Satya Nadella took over. Not just because it's directly profitable to be pro-developer, but because it helps their long term image, culture etc. This goes a long way to explainin…

> Not just because it's directly profitable to be pro-developer, but because it helps their long term image, culture etc.

And thus is indirectly profitable.

> That's quite an extreme-end of capitalist way of looking at it.

It's only extreme if you can show that companies routinely take the moral stance even when it impacts their short- or long-term profitability. Is Microsoft good now despite its best interests, just because it decided to take a moral stance?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#222

Post by user-the-name »

fsflover wrote: post #194
user-the-name wrote: post #179

Earlier quoted context omitted.

No real push to use sandboxing or to limit access to personal information. Any app you install can do anything it wants with all of your data.

Can't you run apps on behalf of restricted users?

Not easily, no. Doing so is a big kludge, rather than being part of a system actually designed to offer useful security measures.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#223

Post by TheRealDunkirk »

yholio wrote: post #145
webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Apple has no love for privacy nor ever had. They are in a market position where their main competitors - Google primarily, Microsoft and Amazon - are highly dependent on revenue streams extracted by monetizing personal information. Apple is in a position to cut that stream without affecting its bottom line, so it does it and claims privacy as a core value. I won't look a gift horse in the mouth, but I have no doubt t…

Having been a programmer through the 90's, and watched Microsoft (and Oracle, et. al.) through their most malfeasant years, I'm very cautious about giving companies the benefit of the doubt. However, the fact that Apple is leaving hundreds of billions of dollars on the table by NOT monetizing their aggregated user data does seem to indicate that their will is strong here, and that "they" mean what "they" say about privacy. The kind of money they AREN'T making from this move would try any mortal's soul.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#224

Post by KraftKacke »

mvanbaak wrote: post #209
ddtaylor wrote: post #201

Earlier quoted context omitted.

IMO that's a big problem. They are completely different risk categories. My FDE password is absurdly long and complicated, since I never want someone who gains physical access to get all my data, but my Linux user account password isn't as long since it's main purpose is to stop someone from getting passed my lock screen if I was to leave my system unattended.

Both are 'physical access'. If one does not power down your system, your FDE is unlocked. So they only need your Linux user account password to get access to the data on your disk. FDE only protects your data when it's locked. Normally this is when your system is shut down.

Separation is still recommended.

Storage encryption can be attacked differently than a running system.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#225

Post by my123 »

SXX wrote: post #207
my123 wrote: post #193

Earlier quoted context omitted.

On the M1, that's by design. If you install macOS on an external volume it doesn't have that behaviour. On the internal disk, it's there because they carried over the iOS infrastructure, where your login password is the FDE one. macOS also now boots before asking for your password, like iOS. (the OS volume itself isn't encrypted and is read-only, the data volume is encrypted with your password)

How do you know it's "by design"? By default macOS was always using this encryption scheme, but there was always possibility to have an optional FDE. Now this is broken and I can't even manage to get macOS installed when any encrypted partition is present since it's also cause installer to fail. I obviously find it being absolutely terrible "design" decision since there no way on earth anyone can count disk encryptio…

Apple Silicon Macs use per-file encryption tied to the credentials: https://support.apple.com/en-gb/guide/security/secf6276da8a/...

Was carried over from iOS.

A way to bypass it _should_ be possible, but will entail having the System volume of the volume group to have different properties than the Data part.

Otherwise the OS will fail to load. (on Apple Silicon Macs, macOS is fully booted already when you input the password, so if you encrypt macOS...)

On older Macs, a Preboot UEFI application application prompts you for the password prior to booting.

What you can do as a workaround:

Create a second account which you'll only use to unlock the drive and then run sudo fdesetup add -usertoadd unlockUser and then sudo fdesetup remove -user PrimaryUser. That'll give the rights to unlock the drive only to that unlock user.

You can also use sudo fdesetup removerecovery -personal to destroy the ability of the recovery key to unlock the drive.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#226

Post by tssva »

yorwba wrote: post #187
confiq wrote: post #156

Earlier quoted context omitted.

ironically, most of these companies are out of China because they don't want to comply with Chinese laws. Not apple https://applecensorship.com/

> ironically, most of these companies are out of China Of the three companies named: - Google's user-facing services (search, email, app store, docs, ...) are blocked, but Google Ads (which are censored) and Android (which comes without any content that would require censorship) are still sold. - Microsoft: I'm not aware of any of their products being unavailable. Windows is the dominant desktop operating system in C…

Google doesn't certify devices in the Chinese market which run Android. Android is open source. Devices made for the domestic Chinese market run versions of Android created by the manufacturers and lack Google apps and services.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#227

Post by GekkePrutser »

mvanbaak wrote: post #209
ddtaylor wrote: post #201

Earlier quoted context omitted.

IMO that's a big problem. They are completely different risk categories. My FDE password is absurdly long and complicated, since I never want someone who gains physical access to get all my data, but my Linux user account password isn't as long since it's main purpose is to stop someone from getting passed my lock screen if I was to leave my system unattended.

Both are 'physical access'. If one does not power down your system, your FDE is unlocked. So they only need your Linux user account password to get access to the data on your disk. FDE only protects your data when it's locked. Normally this is when your system is shut down.

True but it's a slightly different category as he wouldn't leave his system on but locked in a potential high risk scenario.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#228

Post by SXX »

my123 wrote: post #225
SXX wrote: post #207

Earlier quoted context omitted.

How do you know it's "by design"? By default macOS was always using this encryption scheme, but there was always possibility to have an optional FDE. Now this is broken and I can't even manage to get macOS installed when any encrypted partition is present since it's also cause installer to fail. I obviously find it being absolutely terrible "design" decision since there no way on earth anyone can count disk encryptio…

Apple Silicon Macs use per-file encryption tied to the credentials: https://support.apple.com/en-gb/guide/security/secf6276da8a/... Was carried over from iOS. A way to bypass it _should_ be possible, but will entail having the System volume of the volume group to have different properties than the Data part. Otherwise the OS will fail to load. (on Apple Silicon Macs, macOS is fully booted already when you input the p…

Thank you very much. I'll try to setup it using additional user as you explained.

Is it possible to make sure that encryption key only available using this "unlock" user passphrase?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#229

Post by my123 »

SXX wrote: post #228
my123 wrote: post #225

Earlier quoted context omitted.

Apple Silicon Macs use per-file encryption tied to the credentials: https://support.apple.com/en-gb/guide/security/secf6276da8a/... Was carried over from iOS. A way to bypass it _should_ be possible, but will entail having the System volume of the volume group to have different properties than the Data part. Otherwise the OS will fail to load. (on Apple Silicon Macs, macOS is fully booted already when you input the p…

Thank you very much. I'll try to setup it using additional user as you explained. Is it possible to make sure that encryption key only available using this "unlock" user passphrase?

You can use sudo fdesetup list -verbose which tells you which users have their password attached as an unlock token for a given volume.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#230

Post by catmanjan »

heinrichhartman wrote: post #189
StavrosK wrote: post #188

Earlier quoted context omitted.

Isn't "it's in our financial interests right now" about as much "love" as you'll get for anything by a corporation? Saying "Apple has no love for privacy, they're only doing it because it sells" sounds moot to me, every company only does things because they sell.

By choosing which markets you operate in and which products you develop you have a fair bit of influence which things are in your "financial interest". E.g. creating a company with a business model which benefits from taxing CO2 emissions (Tesla) is morally great. Whereas having a business model which benefits from cheap oil (VW) is less so. Product decisions (electric vs. fuel engines) have a large effect on your lo…

If Apple knew it could make more money in say for example, arms dealing, wouldn't it be obliged to pivot to serve the shareholders? I guess it's somewhat democratic as shareholders could vote against it for moral reasons
Post reply on HN