Ask HN: How do you secure your Mac? • Hacker News Board

Re: Ask HN: How do you secure your Mac?

#11

Post by captainredbeard » Wed, Apr 17, 2019, 2:05 PM UTC

If you're paranoid:

- Full Disk Encryption - Use Little Snitch - Don't use iCloud - Disable SSH except for your account - Turn off remote login - Run developer software in Docker containers

Re: Ask HN: How do you secure your Mac?

#12

Post by [deleted] » Wed, Apr 17, 2019, 2:39 PM UTC

barrowclift wrote: post #4

While I strongly advise avoiding traditional "antivirus" software like Symantec, EtreCheck[1] if a wonderful diagnostic tool for checking your Mac's general health. Included in that health check is a full disk sweep for any known adware. I used it just this past year to help identify and remove some adware on my parents' computer just this past year, and would highly recommend. [1] https://etrecheck.com

[deleted]

Re: Ask HN: How do you secure your Mac?

#13

Post by kahlonel » Wed, Apr 17, 2019, 2:40 PM UTC

captainredbeard wrote: post #11

If you're paranoid: - Full Disk Encryption - Use Little Snitch - Don't use iCloud - Disable SSH except for your account - Turn off remote login - Run developer software in Docker containers

Genuine question: Is iCloud any more insecure than any other cloud service? I was thinking of shifting a lot of stuff to it.

Re: Ask HN: How do you secure your Mac?

#14

Post by _urga » Wed, Apr 17, 2019, 2:42 PM UTC

cerberusss wrote: post #2

What exactly is your threat model? Are you a developer of a very public software project? Are you a politician or a journalist? Or someone in HR? Or are you just an average Joe? And what software do you use regularly? Do you pirate software? These are important questions to answer, before you come up with how to secure your Mac. That said, I'm just an average developer. I hardly run anything non-standard. I do make s…

Assume it's for a software developer.

Regarding software: only system apps with the exception of say a password manager, code editor and git.

Re: Ask HN: How do you secure your Mac?

#15

Post by [deleted] » Wed, Apr 17, 2019, 2:51 PM UTC

kevinherron wrote: post #5

FileVault, strong system password, Little Snitch. Everything else (2FA, password manager) is not macOS specific.

[deleted]

Re: Ask HN: How do you secure your Mac?

#16

Post by jiscariot » Wed, Apr 17, 2019, 3:30 PM UTC

My primary concern is someone physically stealing my Macbook or iMac. They are personal devices and the content on them would not be much of interest to others, foreign governments or other entities.

I have Prey[1] installed. On both devices, I have "admin" credentials taped to the back. The account is actually a locked down user-level account with very little authority, other than being able to get on wifi/browse the internet, etc. I suppose this would be a honeypot of sorts. My thought being if someone walks off with it, I want to be able to gather as much info on them as possible. I haven't given a whole lot of thought to this, so definitely curious if there are issues with this approach.

[1]: https://preyproject.com/

Re: Ask HN: How do you secure your Mac?

#17

Post by umairmehmood » Wed, Apr 17, 2019, 3:40 PM UTC

captainredbeard wrote: post #11

If you're paranoid: - Full Disk Encryption - Use Little Snitch - Don't use iCloud - Disable SSH except for your account - Turn off remote login - Run developer software in Docker containers

How does FireVault work with Google cloud ?. I have a google cloud folder which is synced with my local drive. Now if I enable Firevault, it will encrypt all the data... but im not sure what will happen to the Google Drive folder on mac. How will google drive manage my encryption then.

Re: Ask HN: How do you secure your Mac?

#18

Post by aianus » Wed, Apr 17, 2019, 3:57 PM UTC

Shameless plug since it's relevant:

We built a Slack bot [0] that shames (in good humor) people in the office who leave unlocked laptops unattended. We had a similar system at Twitter where we would tweet a certain codeword on unlocked laptops and it was very effective in stopping that behavior.

[0] https://sniped.app/

Re: Ask HN: How do you secure your Mac?

#19

Post by drexlspivey » Wed, Apr 17, 2019, 4:01 PM UTC

I try to use Touch ID for everything it can be used for.

Touch ID for sudo http://osxdaily.com/2017/11/22/use-touch-id-sudo-mac/

Touch ID for SSH https://github.com/sekey/sekey (uses secure enclave)

I use this for 2FA https://krypt.co/ (uses secure enclave on your phone)

Touch ID for password management https://1password.com/

I upload dotfiles and other credentials in a keybase encrypted repo

Re: Ask HN: How do you secure your Mac?

#20

Post by lukewrites » Wed, Apr 17, 2019, 4:26 PM UTC

The thin I do that I think is most important is use Little Snitch (https://www.obdev.at/products/littlesnitch/index.html) to track/block/approve incoming and outgoing network requests.

It's how I caught a new Seagate external hard drive making calls to Baidu and Google. https://fosstodon.org/@lukewrites/100907932236227641