Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

141–150 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#141

Post by nmgycombinator »

ryukafalz wrote: post #132
nmgycombinator wrote: post #122

Earlier quoted context omitted.

As someone who's looked into the internals of macOS for a bit now, this is all incredibly fascinating. However, I am curious: do you think capabilities could be implemented like this at a really low level? Part of me thinks we have the security models we do in POSIX is because they're simple enough to represent in C code. The capability systems you're mentioning sound cool, but they sound a lot more complex. And if t…

Capabilities themselves can certainly be implemented at a very low level; you might implement them as an array of capabilities associated with each process: https://en.wikipedia.org/wiki/C-list_%28computer_security%29 As that page points out, POSIX file descriptors are effectively c-lists. A capability operating system would use similar mechanisms to control access to resources other than just open files. The other t…

Oh nice! I'll take a look at these.

Re: Can you trust that permission pop-up on macOS?

#142

Post by musicale »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

The passkey pop-ups which are indistinguishable from javascript pop-ups are a particularly egregious security mistake.

Re: Can you trust that permission pop-up on macOS?

#143

Post by nmgycombinator »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

Hijacking this current top comment to let everyone know there is an important update to this article: https://news.ycombinator.com/item?id=43969087

Re: Can you trust that permission pop-up on macOS?

#144

Post by ssd646 »

DowsingSpoon wrote: post #123
ssd646 wrote: post #97

Earlier quoted context omitted.

When logging into iCloud, they show a pop-up asking for the local password to the computer. And then they upload that password to the iCloud servers.

Please provide evidence for a claim that logging into iCloud necessarily sends your plaintext local password to the server.

I never said it sends your plaintext password.

It says it 'encrypts' your password, because it needs to access your Keychain. The dialog says this, but there is no way to opt out.

You are 100% wrong.

EDIT: https://apple.stackexchange.com/questions/467137/are-keychai...

Re: Can you trust that permission pop-up on macOS?

#145

Post by trollbridge »

1oooqooq wrote: post #121
trollbridge wrote: post #64

Earlier quoted context omitted.

In environments like this, my trusted colleagues and I communicated using Signal (and before that, WhatsApp). One somewhat paranoid department that was convinced they were being spied on (they weren’t; I saw the Slack admin dashboard and management was too cheap to pay for the retention and spying features) maintained the use of an ancient Jabber based group chat for their own internal communications.

if signal is on company hardware, they have crowdstrike for that.

This was around 8 years ago, but there was no MDM installed on our cell phones, regardless of if BYOB or company paid for device.

The only restriction was if you went to China, you took a burner phone (one of the old company phones, usually) and weren’t supposed to ever use it again once you left. I think they just sold them to a liquidator.

Re: Can you trust that permission pop-up on macOS?

#146

Post by trollbridge »

nmgycombinator wrote: post #100
p_ing wrote: post #94

Earlier quoted context omitted.

In macOS 15, there is no GUI bypass. Right click -> Open no longer works. xattr is "the way". I'm sure someone has probably created an Automation or something for it.

There's a small section in System Settings that they don't really tell you about that pops up when the OS blocks a file from opening. You can then override the block there. Yes, it's extremely annoying.

I have an alias set in my shell for `xattr -d ~/Downloads/.{dmg,zip,z}`.

Re: Can you trust that permission pop-up on macOS?

#147

Post by nmgycombinator »

kalleboo wrote: post #130
sureglymop wrote: post #75

Earlier quoted context omitted.

I wonder why they don't add a little led to their laptops that would indicate that it really is the system asking for your password. Kind of like the camera led.

When they had the touchbar on the MacBook Pros, they would put the authentication in there since that was something only the OS could take full control over.

That's honestly a pretty smart move.

Re: Can you trust that permission pop-up on macOS?

#148

Post by nmgycombinator »

ssd646 wrote: post #144
DowsingSpoon wrote: post #123

Earlier quoted context omitted.

Please provide evidence for a claim that logging into iCloud necessarily sends your plaintext local password to the server.

I never said it sends your plaintext password. It says it 'encrypts' your password, because it needs to access your Keychain. The dialog says this, but there is no way to opt out. You are 100% wrong. EDIT: https://apple.stackexchange.com/questions/467137/are-keychai...

As someone who dove deep into keychain items for a previous write-up, I believe you are misunderstanding this situation. As far as I understand it, many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain that's different than the iCloud keychain, with items that are not sent to iCloud.

And besides all that, to my knowledge your local machine password (the password you use to login) isn't stored in a keychain item, so there's no way it could make itself into the iCloud keychain, or your local keychain.

You may be mistaking some explanations. Your computer password is used to unlock your local keychain, but it itself is not stored in your keychain. Your local keychain is also not your iCloud keychain, it's not stored in iCloud.

Again, I'm not an Apple developer, so there may be stuff I don't know, but I am a developer in general and I have researched this. The above is my current understanding.

Re: Can you trust that permission pop-up on macOS?

#149

Post by pornel »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

My non-techie relatives can't tell the difference between the local device password/passphrase and the iCloud/Apple ID password, so they'll enter them all until something works (I don't blame them, the UIs for these are unclear and inconsistent).

Apple used to make fun of Vista's UAC, but they've ended up with the same patchwork of sudden prompts, and even weaker UI.

Re: Can you trust that permission pop-up on macOS?

#150

Post by kalleboo »

nmgycombinator wrote: post #147
kalleboo wrote: post #130

Earlier quoted context omitted.

When they had the touchbar on the MacBook Pros, they would put the authentication in there since that was something only the OS could take full control over.

That's honestly a pretty smart move.

Yeah it's a shame it's just such an overengineered/expensive thing.
Post reply on HN