Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

121–130 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#121

Post by 1oooqooq »

trollbridge wrote: post #64
frollogaston wrote: post #18

Earlier quoted context omitted.

I don't really expect my 1:1 conversations on the company chat to be invisible to the company.

In environments like this, my trusted colleagues and I communicated using Signal (and before that, WhatsApp). One somewhat paranoid department that was convinced they were being spied on (they weren’t; I saw the Slack admin dashboard and management was too cheap to pay for the retention and spying features) maintained the use of an ancient Jabber based group chat for their own internal communications.

if signal is on company hardware, they have crowdstrike for that.

Re: Can you trust that permission pop-up on macOS?

#122

Post by nmgycombinator »

josephg wrote: post #120
whartung wrote: post #104

Earlier quoted context omitted.

The thing I hate about these things is I have no idea why they’re asking this, and no idea what happens if I say No, even how to “manage” these settings should I wish to change it. The UX is different from the apps saying “Hey, open the preferences panel and give us XXX” and there you can see the app, the capability toggle, decide to turn it on, or even go back to turn it back off. These experiences have been why I’v…

> These experiences have been why I’ve not a big fan of “capabilities” as a concept. The UX around them is awful, and almost has to be. I don't think the UX has to be awful. The problem is just that they're kinda half baked on macos, and bolted on, and not really a first class citizen. There's no reason you couldn't have: - A preferences dialog showing which long-lived capabilities you've granted to which application…

As someone who's looked into the internals of macOS for a bit now, this is all incredibly fascinating. However, I am curious: do you think capabilities could be implemented like this at a really low level? Part of me thinks we have the security models we do in POSIX is because they're simple enough to represent in C code.

The capability systems you're mentioning sound cool, but they sound a lot more complex. And if that's true, and they aren't built with irreducible complexity, then it would be possible to work around it by just pulling out bits and pieces from the system and abusing them.

Re: Can you trust that permission pop-up on macOS?

#123

Post by DowsingSpoon »

ssd646 wrote: post #97
xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

When logging into iCloud, they show a pop-up asking for the local password to the computer. And then they upload that password to the iCloud servers.

Please provide evidence for a claim that logging into iCloud necessarily sends your plaintext local password to the server.

Re: Can you trust that permission pop-up on macOS?

#124

Post by DecentShoes »

nmgycombinator wrote: post #54
muppetman wrote: post #52

Earlier quoted context omitted.

Every time I update an app I have to be told I downloaded it from the Internet and do I trust it. Can this app look on the local network? Constantly being nagged to the point I don't even check/care anymore. Exactly what Vista used to do.

The local network popup thing is too overdone in my opinion. However, I do think it is a good choice (in some respects) for Apple to have the "this is a program downloaded from the Internet", even if it can be annoying. It might also be a push to get developers to publish on the App Store (where Apple can be more sure (hopefully) that the apps are safe). It's a double-edged sword in my opinion. I think it's good that…

*the App Store where apple can be more sure they'll get a 30% cut

Re: Can you trust that permission pop-up on macOS?

#125

Post by matthewfcarlson »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

What is the threat model of clicking on a fake popup? Isn't it a no-op because it isn't actually coming from the system?

Re: Can you trust that permission pop-up on macOS?

#126

Post by matthewfcarlson »

matthewfcarlson wrote: post #125
xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

What is the threat model of clicking on a fake popup? Isn't it a no-op because it isn't actually coming from the system?

Just realized that it asked for your system password if you don't have Touch ID.

Re: Can you trust that permission pop-up on macOS?

#128

Post by nmgycombinator »

Jerry2 wrote: post #127

Author didn't disclose if got a reward for his work. Hope he did!

Thank you for your kind words. To respond: 1. I'm not a "he", I would prefer "they". 2. As I mentioned in another comment, I have not received word back yet on any reward.

Re: Can you trust that permission pop-up on macOS?

#129

Post by aranchelk »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

I really appreciate the integrated fingerprint reader in these cases. I usually run with my laptop screen closed (with external monitor) but open it specifically to authenticate in system dialogs.

Re: Can you trust that permission pop-up on macOS?

#130

Post by kalleboo »

sureglymop wrote: post #75
nmgycombinator wrote: post #37

Earlier quoted context omitted.

I mean, at that point and app could just put up a fake prompt using the UI framework. And I think users would be more hesitant to type a full password than just click a button. But if you're talking about a bug similar to mine where an attacker could use the OS's own code against it and make it show a prompt with misleading content, you might be able to report it to Apple Product Security and maybe get a bounty.

I wonder why they don't add a little led to their laptops that would indicate that it really is the system asking for your password. Kind of like the camera led.

When they had the touchbar on the MacBook Pros, they would put the authentication in there since that was something only the OS could take full control over.
Post reply on HN