Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Can you trust that permission pop-up on macOS?

wts.dev

Post reply on HN
Print view View original

151–160 of 261 posts

Re: Can you trust that permission pop-up on macOS?

#151

Post by nmgycombinator »

pornel wrote: post #149
xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

My non-techie relatives can't tell the difference between the local device password/passphrase and the iCloud/Apple ID password, so they'll enter them all until something works (I don't blame them, the UIs for these are unclear and inconsistent). Apple used to make fun of Vista's UAC, but they've ended up with the same patchwork of sudden prompts, and even weaker UI.

Yeah, to be perfectly honest, I understand. I think TCC is meant to be the primary consent system, but there are others (such as the Authorization system, and the Service Management framework).

Re: Can you trust that permission pop-up on macOS?

#152

Post by yencabulator »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

Seems like it's time to re-post this golden oldie: The Line of Death https://textslashplain.com/2017/01/14/the-line-of-death/

Re: Can you trust that permission pop-up on macOS?

#153

Post by nixpulvis »

muppetman wrote: post #45

I remember the I'm a Mac and I'm a PC ads that mocked this on Vista. And now my Mac is worse than Vista. It's so annoying.

The tradeoff between security and extensibility is something which seems to be unavoidable.

But the goalposts have moved a bit. At least macOS is not plagued with malicious processes like was common on windows. Or maybe I'm just careful?

Re: Can you trust that permission pop-up on macOS?

#155

Post by dpacmittal »

xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

This. Moved from Linux to Mac recently and I was so confused about the random root password pop-ups. It gives no explanation on which app or command is asking for root access or why it needs root access. So I started denying the request after granting access a few times. Now I don't get that pop-up anymore. I still have no idea what was causing those pop-ups and why they stopped

Re: Can you trust that permission pop-up on macOS?

#156

Post by sureIy »

musicale wrote: post #142
xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

The passkey pop-ups which are indistinguishable from javascript pop-ups are a particularly egregious security mistake.

What's the problem here? Javascript popups can't read your fingerprint so what would be the endgame of a fake passkey popup?

Re: Can you trust that permission pop-up on macOS?

#157

Post by sureIy »

p_ing wrote: post #93
muppetman wrote: post #52

Earlier quoted context omitted.

Every time I update an app I have to be told I downloaded it from the Internet and do I trust it. Can this app look on the local network? Constantly being nagged to the point I don't even check/care anymore. Exactly what Vista used to do.

This isn't what Vista "used to do". Vista had a single elevation popup dialog / shatter attack prevention screen. Any request that required elevation required this popup. macOS has not only elevation requests but entitlements. Using the local network is an entitlement. What macOS gets very wrong is any denied entitlements will re-prompt next time you perform that action with the app, which may simply be starting the…

Technically you're right. From an end-user standpoint, it's irrelevant. Apple's mock vista ad applies just as well to Ventura: they're all annoying and a security theater if the user is just told to input admin password into any random popup.

https://www.youtube.com/watch?v=VuqZ8AqmLPY

Re: Can you trust that permission pop-up on macOS?

#158

Post by nmgycombinator »

nmgycombinator wrote: post #13
e40 wrote: post #10

> The patch is released I assume that is with 15.5...

> which was patched in today's releases of macOS Sequoia 15.5 et al. Correct.

Correction (longer explanation elsewhere): only 15.5. Apple didn't patch it in the other two releases.

Re: Can you trust that permission pop-up on macOS?

#159

Post by aequitas »

aranchelk wrote: post #129
xp84 wrote: post #90

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to…

I really appreciate the integrated fingerprint reader in these cases. I usually run with my laptop screen closed (with external monitor) but open it specifically to authenticate in system dialogs.

Apple also sells a wireless keyboard with touchid integrated. Works great. Especially if you also set pam to use touchid for sudo. They’re not cheap though.

Re: Can you trust that permission pop-up on macOS?

#160

Post by nyanpasu64 »

cypherpunks01 wrote: post #78

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine. If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on t…

I don't even have a ~/Applications on macOS 15.4.1.
Post reply on HN