Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

41–50 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#41

Post by jq-r »

sefrost wrote: post #2

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

And it so annoying because it steals focus so as you're writting a message it suddenly stops taking your input and "helpfully" continues typing your text into the password box.

Re: Can you trust that permission pop-up on macOS?

#42

Post by beezlewax »

hbn wrote: post #29
jonplackett wrote: post #27

Earlier quoted context omitted.

These types of ‘security’ blockers are so dumb because they train people to act dumb. Even if they’re real, the next time they may not be. It’s like how my bank often calls and wants me to give them my personal info for ‘data protection’ before we can speak. These are legit bank calls, training people to give out personal info to strangers.

As of the latest macOS update, every app is now asking every few days if it can have access to devices on your local network, or something to that tune. My theory right now is it's something in chromium that automatically asking for this and Electron apps will do this out of the box, but I can't remember which apps exactly have been doing this. Regardless, yes it causes the exact issue you're talking about. I don't e…

This is chrome for sure. There a bunch of threads if you search the actual error message you'll get hits on stackoverflow and in apple forums

Re: Can you trust that permission pop-up on macOS?

#43

Post by nmgycombinator »

kccqzy wrote: post #17
sefrost wrote: post #2

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

That does sound like it could be exploited, but with only as much exploitability as some random app that requires your password (for analogy consider a Linux binary that refuses to run unless being run as root). Ultimately it's a matter of deciding whether you trust the developer of the app and whether you trust this app is really from that developer. The day Apple prevents users from giving root access to a third-ap…

> The day Apple prevents users from giving sudo access to a third-app app is when the Mac fully becomes a walled garden, and you can expect pages of HN complaints.

I can see this happening, but it probably won't anytime soon. macOS is still open enough, and with the assumption that sometimes processes need root (see third-party Launch Daemons).

It would probably break quite a lot. But I wouldn't be surprised if they eventually gradually move macOS in that direction.

Re: Can you trust that permission pop-up on macOS?

#44

Post by nartho »

accrual wrote: post #25
dcrazy wrote: post #4

Earlier quoted context omitted.

This dialog comes from the System Management framework [1]. Slack is probably installing a privileged helper tool (conceptually similar to a setuid root binary) so that it can update itself regardless of where it is installed or which user originally installed it. [1]: https://developer.apple.com/documentation/servicemanagement/...

Discord does this as well I believe. I often needed to enter the administrator password to install a helper after the system had been off for a couple days.

Discord, Slack and VS Code desktop apps are all built using Electron, so I'm guessing this is an Electron issue.

Re: Can you trust that permission pop-up on macOS?

#47

Post by nmgycombinator »

coolcase wrote: post #46
JohnFen wrote: post #22

Honestly, I don't really trust any permissions popups on anything anymore. They are often porous enough to count as "security theater".

And at $Corp I get constant popups to enter my password or confirm an action. Like 50-100 a day.

I bet threat actors are just salivating at the thought of giving you a fake password prompt.

Re: Can you trust that permission pop-up on macOS?

#49

Post by socalgal2 »

QuercusMax wrote: post #5
dcrazy wrote: post #4

Earlier quoted context omitted.

This dialog comes from the System Management framework [1]. Slack is probably installing a privileged helper tool (conceptually similar to a setuid root binary) so that it can update itself regardless of where it is installed or which user originally installed it. [1]: https://developer.apple.com/documentation/servicemanagement/...

Seems like it should only need to do this once. I get this with almost every Slack and VSCode update. The correct solution for me is to quit Slack.app and let my company's management software do the update for me.

I don't use slack except in the browser. I never get a prompt for VSCode. It must be one of your extensions.

Re: Can you trust that permission pop-up on macOS?

#50

Post by reaperducer »

jonplackett wrote: post #38
hbn wrote: post #29

Earlier quoted context omitted.

As of the latest macOS update, every app is now asking every few days if it can have access to devices on your local network, or something to that tune. My theory right now is it's something in chromium that automatically asking for this and Electron apps will do this out of the box, but I can't remember which apps exactly have been doing this. Regardless, yes it causes the exact issue you're talking about. I don't e…

I’m surprised Apple have let this happen. When you make an iOS app and requested permission for something - photo library or location etc. you MUST write out a sentence of what you’ll use it for which is shown to the user. Why not the same for Mac apps?

Why not the same for Mac apps?

How would Apple enforce that?

iOS apps go through the App Store, so proper behavior can be enforced.

The apps people are complaining about here are downloaded from the vendor. Apple is not involved.

Post reply on HN