Love this guy's research, such good presentation!
Thank you very much! Although I'm not a guy, just fyi! I'm just a person :)
Can you trust that permission pop-up on macOS?
21–30 of 261 posts
Re: Can you trust that permission pop-up on macOS?
#22Honestly, I don't really trust any permissions popups on anything anymore. They are often porous enough to count as "security theater".
Re: Can you trust that permission pop-up on macOS?
#23My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.
I get this popup all the time.
It contains no information that I can reasonably use to match a decision on whether or not to allow it, so I always click cancel on it.
Re: Can you trust that permission pop-up on macOS?
#24Honestly, I don't really trust any permissions popups on anything anymore. They are often porous enough to count as "security theater".
I honestly think this is a good skepticism to have. I generally don't hit "Accept" (or "Allow" or whatever) on any permission pop-up unless I know exactly what it's doing and what I need it for.
Re: Can you trust that permission pop-up on macOS?
#25My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.
This dialog comes from the System Management framework [1]. Slack is probably installing a privileged helper tool (conceptually similar to a setuid root binary) so that it can update itself regardless of where it is installed or which user originally installed it. [1]: https://developer.apple.com/documentation/servicemanagement/...
Discord does this as well I believe. I often needed to enter the administrator password to install a helper after the system had been off for a couple days.
Re: Can you trust that permission pop-up on macOS?
#26Earlier quoted context omitted.
> Slack is just a messaging application its sold more as a way to store and all conversations than the ability to be a messaging application. the original pitch was to make all information, even private conversation of previous employees, searchable.
Damn. That sounds pretty dystopian. But typical for American corporate life.
Why? Companies already have to retain the data (in case of lawsuits, etc.).
Slack is also used because it allows to create persistent channels that are searchable. So they often end up being a knowledge base for the company.
Re: Can you trust that permission pop-up on macOS?
#27My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.
These types of ‘security’ blockers are so dumb because they train people to act dumb. Even if they’re real, the next time they may not be.
It’s like how my bank often calls and wants me to give them my personal info for ‘data protection’ before we can speak. These are legit bank calls, training people to give out personal info to strangers.
Re: Can you trust that permission pop-up on macOS?
#28It took Apple a full year to release the fix. That is a very long time.
2024-05-04 I leave several additional update messages as I continue testing my PoC
2025-05-12 The patch is released
Re: Can you trust that permission pop-up on macOS?
#29My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.
These types of ‘security’ blockers are so dumb because they train people to act dumb. Even if they’re real, the next time they may not be. It’s like how my bank often calls and wants me to give them my personal info for ‘data protection’ before we can speak. These are legit bank calls, training people to give out personal info to strangers.
As of the latest macOS update, every app is now asking every few days if it can have access to devices on your local network, or something to that tune. My theory right now is it's something in chromium that automatically asking for this and Electron apps will do this out of the box, but I can't remember which apps exactly have been doing this.
Regardless, yes it causes the exact issue you're talking about. I don't even read what the popups say anymore, I'm just blindly hitting an accept button.
Re: Can you trust that permission pop-up on macOS?
#30My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.
These types of ‘security’ blockers are so dumb because they train people to act dumb. Even if they’re real, the next time they may not be. It’s like how my bank often calls and wants me to give them my personal info for ‘data protection’ before we can speak. These are legit bank calls, training people to give out personal info to strangers.
If someone cold calls me and asks me to verify myself, I refuse.
If it’s an expected call or they give me a good reason to, I’ll call their listed contact number back.
So far I have not missed out on anything of consequence by refusing to identify myself to someone who initiated contact with me.