Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

71–80 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#71

Post by louthy »

dylan604 wrote: post #70
louthy wrote: post #63

Earlier quoted context omitted.

Slight tangent: Apple TV constantly has MLS (major league soccer) and Apple TV+ in the left-side pop up Home menu, taking up real-estate for something I will never access. So annoying. Why, as someone from England — with arguably the best football league in the world — would I want to watch American Soccer? I don’t even watch the English league. The menu is: ——————— * Search * Home * Apple TV+ * MLS * Store * Library…

> Why, as someone from England — with arguably the best football league in the world — would I want to watch American Soccer? I don’t even watch the English league. So you're the type that doesn't watch the Special Olympics I take it? MLS is the geriatric retirement league for super star players, or the not quite good enough to play in the other leagues league. One season, I tried to get into MLS. At one point I trie…

I don’t watch football at all. If it’s not cricket… well it ain’t cricket!

But even if it was a channel dedicated to test cricket (the greatest sport in the history of sport), I would still resent the foisting. These are clearly anti-competitive practices and that always leads to worse products eventually.

Re: Can you trust that permission pop-up on macOS?

#72

Post by dylan604 »

makeitdouble wrote: post #68
nmgycombinator wrote: post #3

Earlier quoted context omitted.

I'm not aware of the "helper tool" popup, but I would definitely be skeptical of it. Even if it is Slack, Slack is just a messaging application. I don't know what legitimate need it would have for a helper tool. I would ask Slack support, though (and hopefully you can get a real answer and explanation).

> Slack is just a messaging application. I kinda like this angle. While Slack makes an effort to work basically everywhere with low effort, I wonder what would follow if it wasn't the case. For instance if for some stupid legal reason Slack was banned from macos, how many people would just switch to another OS ? I'd bet it would be a non trivial amount of users at this point.

or you know, just use the web app

Re: Can you trust that permission pop-up on macOS?

#73

Post by ben-schaaf »

nmgycombinator wrote: post #54
muppetman wrote: post #52

Earlier quoted context omitted.

Every time I update an app I have to be told I downloaded it from the Internet and do I trust it. Can this app look on the local network? Constantly being nagged to the point I don't even check/care anymore. Exactly what Vista used to do.

The local network popup thing is too overdone in my opinion. However, I do think it is a good choice (in some respects) for Apple to have the "this is a program downloaded from the Internet", even if it can be annoying. It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). It's a double-edged sword in my opinion. I think it's good that…

> It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe).

Apps on macOS need to be signed and notarised. Apple has the exact same capability to scan for malicious behaviour and revoke your keys regardless of how you publish. We all know the real reason they want to push apps towards the app store.

Re: Can you trust that permission pop-up on macOS?

#74

Post by nmgycombinator »

trollbridge wrote: post #67
nmgycombinator wrote: post #37

Earlier quoted context omitted.

I mean, at that point and app could just put up a fake prompt using the UI framework. And I think users would be more hesitant to type a full password than just click a button. But if you're talking about a bug similar to mine where an attacker could use the OS's own code against it and make it show a prompt with misleading content, you might be able to report it to Apple Product Security and maybe get a bounty.

I mean, a website could display a crafty popup-appearing box and try to get you to type in your username and password. Not really sure how you can prevent that. Vista used the “the background dims quite a bit” to try to deal with that.

Yeah. I think the key thing in my vulnerability is that it abused a legitimate OS prompt and had the consequences of that prompt be applied to something separate from what the prompt text itself said it would.

Re: Can you trust that permission pop-up on macOS?

#75

Post by sureglymop »

nmgycombinator wrote: post #37
EGreg wrote: post #33

I once sent an email to Steve Jobs back in 2009 or so I told him that the MacOS permissions dialog could easily be spoofed, and that Macs should have a secret phrase or icon that you choose that they’d display inside these dialogs, and prevent their screen capture like what they had been doing with their recent DRM features. Never heard back from him And it never got implemented. Any program can still continue to spo…

I mean, at that point and app could just put up a fake prompt using the UI framework. And I think users would be more hesitant to type a full password than just click a button. But if you're talking about a bug similar to mine where an attacker could use the OS's own code against it and make it show a prompt with misleading content, you might be able to report it to Apple Product Security and maybe get a bounty.

I wonder why they don't add a little led to their laptops that would indicate that it really is the system asking for your password. Kind of like the camera led.

Re: Can you trust that permission pop-up on macOS?

#76

Post by bigyabai »

charcircuit wrote: post #69
bigyabai wrote: post #57

Earlier quoted context omitted.

> It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). This is exploitation of developers, plain and simple. Apple should secure their runtime, not roleplay as a software rent-a-cop that manually (and fallibly) inspects submissions. The App Store is a blatant moneymaking racket, on mobile and desktop alike. "Security" is a fig leaf fo…

Apple does both. They secure the runtime and review apps.

And to NSO Group's delight, they don't review SMS messages or Safari contents either. The "curated security" shtick is a lie, it does not protect anyone and doesn't function reliably in the first place. Both targeted malware and generic scams are rampant and unrestrained on iOS. Many of them are promoted as iPhone Search Ads, or suggested Siri results.

The knock-on effects it has are even worse. By relying on this game of shuffling private entitlements around, Apple has less incentive to actually review what developers are doing with them. Look at the Uber iPhone app's screenrecord permissions, or when TikTok stole iOS clipboards.

Apple uses "secure" review as an excuse to not review apps or secure their runtime.

Re: Can you trust that permission pop-up on macOS?

#77

Post by EGreg »

trollbridge wrote: post #67
nmgycombinator wrote: post #37

Earlier quoted context omitted.

I mean, at that point and app could just put up a fake prompt using the UI framework. And I think users would be more hesitant to type a full password than just click a button. But if you're talking about a bug similar to mine where an attacker could use the OS's own code against it and make it show a prompt with misleading content, you might be able to report it to Apple Product Security and maybe get a bounty.

I mean, a website could display a crafty popup-appearing box and try to get you to type in your username and password. Not really sure how you can prevent that. Vista used the “the background dims quite a bit” to try to deal with that.

I just told you how… it would show your special icon or phrase inside so you’d confirm it before you typed anything.

The phrase would be managed through a system screen, like a login screen

Re: Can you trust that permission pop-up on macOS?

#78

Post by cypherpunks01 »

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine.

If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on their own, with non-admin permissions. The only exceptions I've found are Tailscale and other stuff that needs higher level OS integration.

Edit since upvotes: Non-admin user operation was recommended by the Pareto Security app, see info on this specific item: https://paretosecurity.com/mac/checks/not-using-admin

All Pareto security checks: https://paretosecurity.com/mac/checks

App: https://paretosecurity.com/mac and https://github.com/paretoSecurity/pareto-mac

Re: Can you trust that permission pop-up on macOS?

#79

Post by makeitdouble »

dylan604 wrote: post #72
makeitdouble wrote: post #68

Earlier quoted context omitted.

> Slack is just a messaging application. I kinda like this angle. While Slack makes an effort to work basically everywhere with low effort, I wonder what would follow if it wasn't the case. For instance if for some stupid legal reason Slack was banned from macos, how many people would just switch to another OS ? I'd bet it would be a non trivial amount of users at this point.

or you know, just use the web app

If it was a legal ban I'd assume Apple would go pretty far to make it happen, app or not.

Re: Can you trust that permission pop-up on macOS?

#80

Post by viraptor »

bigyabai wrote: post #53
nmgycombinator wrote: post #48

Earlier quoted context omitted.

Out of curiosity, what do you find annoying about it?

Oh god, don't get me started... 1. iCloud nags never go away if you don't log into iCloud 2. Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype 3. Functionally useless subscription slopware like AppleTV+ comes installed by-default for no reason 4. Package management is a colossal clusterfuck that can't even enforce package parity across system architectures 5. Apple sti…

> Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype

Not only that, but you get the advertisement every time it starts and then it doesn't play the actual file. So unless you join the service the process is: try to open the audio file, close the advert, go back to source, open the file again.

Post reply on HN