Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

81–90 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#81

Post by charcircuit »

bigyabai wrote: post #76
charcircuit wrote: post #69

Earlier quoted context omitted.

Apple does both. They secure the runtime and review apps.

And to NSO Group's delight, they don't review SMS messages or Safari contents either. The "curated security" shtick is a lie, it does not protect anyone and doesn't function reliably in the first place. Both targeted malware and generic scams are rampant and unrestrained on iOS. Many of them are promoted as iPhone Search Ads, or suggested Siri results. The knock-on effects it has are even worse. By relying on this ga…

But they do secure their runtime. It's not an excuse not to.

Re: Can you trust that permission pop-up on macOS?

#82

Post by zakki »

nmgycombinator wrote: post #54
muppetman wrote: post #52

Earlier quoted context omitted.

Every time I update an app I have to be told I downloaded it from the Internet and do I trust it. Can this app look on the local network? Constantly being nagged to the point I don't even check/care anymore. Exactly what Vista used to do.

The local network popup thing is too overdone in my opinion. However, I do think it is a good choice (in some respects) for Apple to have the "this is a program downloaded from the Internet", even if it can be annoying. It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). It's a double-edged sword in my opinion. I think it's good that…

Microsoft was right.

Re: Can you trust that permission pop-up on macOS?

#83

Post by rplnt »

sefrost wrote: post #2

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

And they somehow stack in time. So after a weekend it's popping up over and over until I give up and quit Slack. It's been like this for a year I'd say. There's no way to stop them and they always get focus, which is extremely annoying. How can I revoke this permission from Slack? Seems pretty abusive.

Re: Can you trust that permission pop-up on macOS?

#84

Post by xp84 »

bigyabai wrote: post #53
nmgycombinator wrote: post #48

Earlier quoted context omitted.

Out of curiosity, what do you find annoying about it?

Oh god, don't get me started... 1. iCloud nags never go away if you don't log into iCloud 2. Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype 3. Functionally useless subscription slopware like AppleTV+ comes installed by-default for no reason 4. Package management is a colossal clusterfuck that can't even enforce package parity across system architectures 5. Apple sti…

Speaking of installed-by-default, it's even more stupid that you can't even uninstall apps like Photos. Supposedly it's 'required for your Mac to function.' I'm sorry, I do not have a need for a photo library on a computer used exclusively to write software.

Re: Can you trust that permission pop-up on macOS?

#85

Post by Etheryte »

cypherpunks01 wrote: post #78

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine. If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on t…

Unfortunately many (most?) application developers don't know this either, and many of them go so far as to explicitly require their apps to be installed in /Applications, they simply won't work otherwise.

Re: Can you trust that permission pop-up on macOS?

#86

Post by nmgycombinator »

sureglymop wrote: post #75
nmgycombinator wrote: post #37

Earlier quoted context omitted.

I mean, at that point and app could just put up a fake prompt using the UI framework. And I think users would be more hesitant to type a full password than just click a button. But if you're talking about a bug similar to mine where an attacker could use the OS's own code against it and make it show a prompt with misleading content, you might be able to report it to Apple Product Security and maybe get a bounty.

I wonder why they don't add a little led to their laptops that would indicate that it really is the system asking for your password. Kind of like the camera led.

That's an interesting idea. I do think it would be nice to have some way of knowing "is this prompt coming from the operating system or some third-party app?". However, I don't think it would have helped in the case of my vulnerability, because it abused a legitimate OS prompt.

Re: Can you trust that permission pop-up on macOS?

#87

Post by TylerE »

muppetman wrote: post #52
nmgycombinator wrote: post #48

Earlier quoted context omitted.

Out of curiosity, what do you find annoying about it?

Every time I update an app I have to be told I downloaded it from the Internet and do I trust it. Can this app look on the local network? Constantly being nagged to the point I don't even check/care anymore. Exactly what Vista used to do.

The one that I find really obnoxious is granting permission to read from a “removable” drive. Like the one my steam library lives on.

Re: Can you trust that permission pop-up on macOS?

#89

Post by diebeforei485 »

sefrost wrote: post #2

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know. I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

I use Slack as a web app, but not in the browser: https://support.apple.com/en-us/104996

Discord can be installed this way as well. It's (imo) a better usage experience than their Electron apps.

Nearly every Electron app is better this way.

Re: Can you trust that permission pop-up on macOS?

#90

Post by xp84 »

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something.

Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to try dragging it out of the browser viewport or switching tabs to see if it is fake or real.

The only protection against this kind of stuff is to NOT teach users that legitimate software pops up random "enter your password" dialogs in front of your work without any prompting. That's what these dialogs are doing.

Display a colorful flashing icon in the menu bar. Use an interstitial secure screen like Windows does. Whatever. But the modern macOS 'security' UI is wildly bad.

Post reply on HN