Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

191–200 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#191

Post by traceroute66 »

nmgycombinator wrote: post #148
ssd646 wrote: post #144

Earlier quoted context omitted.

I never said it sends your plaintext password. It says it 'encrypts' your password, because it needs to access your Keychain. The dialog says this, but there is no way to opt out. You are 100% wrong. EDIT: https://apple.stackexchange.com/questions/467137/are-keychai...

As someone who dove deep into keychain items for a previous write-up, I believe you are misunderstanding this situation. As far as I understand it, many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain that's different than the iCloud keychain, with items that are not sent to iCloud. And besides all that, to my knowledge your local machine password (the passw…

> many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain

Yes. That's pretty obvious to anyone who opens Keychain Access.

On the left you will see the following under "default keychains" :

    - login
    - iCloud
> Your computer password is used to unlock your local keychain, but it itself is not stored in your keychain.

Yes. That's a fundamental, and again obvious requirement. Your keychain has to be encrypted somehow, and this is (IIRC) derived from your user password.

Software developers can further secure keychain by using enclave tied keychain entries[1].

[1] https://developer.apple.com/documentation/security/protectin...

Re: Can you trust that permission pop-up on macOS?

#192

Post by jclardy »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

They should really make it open as a dialog attached to the system preferences window, and within that include what app/service is requesting permissions. Having the free floating window isn’t good for anyone, and duplicating the settings app would at least make it slightly more difficult to fake.

Re: Can you trust that permission pop-up on macOS?

#193

Post by traceroute66 »

cypherpunks01 wrote: post #78

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine. If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on t…

> as every single app installer suggests

Not every single app installer, only those app installers written by incompetent devs.

Those written by educated devlopers give you the option to install "for all users" or "just me" (or words to that effect).

Re: Can you trust that permission pop-up on macOS?

#194

Post by traceroute66 »

bigyabai wrote: post #53
nmgycombinator wrote: post #48

Earlier quoted context omitted.

Out of curiosity, what do you find annoying about it?

Oh god, don't get me started... 1. iCloud nags never go away if you don't log into iCloud 2. Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype 3. Functionally useless subscription slopware like AppleTV+ comes installed by-default for no reason 4. Package management is a colossal clusterfuck that can't even enforce package parity across system architectures 5. Apple sti…

> iCloud nags never go away if you don't log into iCloud

I don't get people who buy macs and refuse to login to iCloud.

You don't have to use iCloud for storage or anything else, all that can be disabled in settings.

The biggest benefit of logging into iCloud is protection if your device gets stolen. It means the thiefs can't just wipe and resell your device. It means you can track and remote-wipe it in Find My.

Re: Can you trust that permission pop-up on macOS?

#197

Post by tempaccount420 »

workfromspace wrote: post #178
xp84 wrote: post #84

Earlier quoted context omitted.

Speaking of installed-by-default, it's even more stupid that you can't even uninstall apps like Photos. Supposedly it's 'required for your Mac to function.' I'm sorry, I do not have a need for a photo library on a computer used exclusively to write software.

+1 I dont understand why Macos cant be more like iOS

Unrelated, but I wish they merged macOS and iOS into the best of both, but... they would probably make macOS worse if they tried

Re: Can you trust that permission pop-up on macOS?

#198

Post by saagarjha »

nmgycombinator wrote: post #122
josephg wrote: post #120

Earlier quoted context omitted.

> These experiences have been why I’ve not a big fan of “capabilities” as a concept. The UX around them is awful, and almost has to be. I don't think the UX has to be awful. The problem is just that they're kinda half baked on macos, and bolted on, and not really a first class citizen. There's no reason you couldn't have: - A preferences dialog showing which long-lived capabilities you've granted to which application…

As someone who's looked into the internals of macOS for a bit now, this is all incredibly fascinating. However, I am curious: do you think capabilities could be implemented like this at a really low level? Part of me thinks we have the security models we do in POSIX is because they're simple enough to represent in C code. The capability systems you're mentioning sound cool, but they sound a lot more complex. And if t…

Capability systems are often simpler. The issue is that a lot of Mac software expects POSIX so moving away from that would break a lot of things.

Re: Can you trust that permission pop-up on macOS?

#199

Post by saagarjha »

ronnieboy493 wrote: post #179
xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

If macOS still attached modals to windows I think this might be less of an issue [0]. Not fixed, but less bad. In the previous screenshot, the modal lays over the toolbar which really reads as "part of the application". Steve Jobs, when demoing Aqua, made a point of the pain that is detached modals[1]. But here we are, detached modals, because of Apple's weird fetish for mobile UI on everything. --- [0] https://kagi.…

This is pretty straightforward for a malicious application to simulate.

Re: Can you trust that permission pop-up on macOS?

#200

Post by pjmlp »

muppetman wrote: post #45

I remember the I'm a Mac and I'm a PC ads that mocked this on Vista. And now my Mac is worse than Vista. It's so annoying.

Yes, Windows has had quite a few years to improve the experience of UAC, on the other hand there are plenty of other stuff to complain about.
Post reply on HN