You can't trust macOS Privacy and Security settings • Hacker News Board

Re: You can't trust macOS Privacy and Security settings

#161

Post by broheimz » Sat, Apr 11, 2026, 8:03 AM UTC

I tested my own device (following this article), and found mac-native apps seem to respond well to the toggling in privacy and security settings, while 3rd party apps do not.

Pretty scary considering the blast radius of Electron apps: huge attack surface (Chromium + Node.js), require permissive entitlements to function (e.g., disable-library-validation, allow-unsigned-executable-memory), JS code is often unencrypted/easy to modify, easy inheritance to all the TCC permissions the user granted to the app.

Popular Electron Apps: Claude Desktop app, Spotify, Slack, Discord, Microsoft Teams, VS Code, Notion, LM Studio...

Re: You can't trust macOS Privacy and Security settings

#162

Post by saagarjha » Sat, Apr 11, 2026, 8:19 AM UTC

jeremyjh wrote: post #153

saagarjha wrote: post #149

Earlier quoted context omitted.

This seems like it would not work well with state restoration

What would not work? Give a specific example. The app has access to its own state data regardless. If it needs permanent access to one of my folders where I maintain my data, all it has to do is ask once.

Yes, but then you quit the app. How is it going to read that folder again?

Re: You can't trust macOS Privacy and Security settings

#163

Post by jeremyjh » Sat, Apr 11, 2026, 11:24 AM UTC

saagarjha wrote: post #162

jeremyjh wrote: post #153

Earlier quoted context omitted.

What would not work? Give a specific example. The app has access to its own state data regardless. If it needs permanent access to one of my folders where I maintain my data, all it has to do is ask once.

Yes, but then you quit the app. How is it going to read that folder again?

It simply reads it. That is the whole point of explicit permission.

Re: You can't trust macOS Privacy and Security settings

#164

Post by bombcar » Sat, Apr 11, 2026, 12:48 PM UTC

steve1977 wrote: post #98

dangus wrote: post #45

Earlier quoted context omitted.

Whoa you are bringing back some memories. And it absolutely was a magic fix. I stand by it.

Safari is snappier now

But the Finder is not.

FTFF

Re: You can't trust macOS Privacy and Security settings

#165

Post by wutwutwat » Sat, Apr 11, 2026, 3:59 PM UTC

eviks wrote: post #36

That's the beauty of using a GUI-first operating system! > only way you can protect your Documents folder from access by Insent is to run the following command in Terminal: tccutil reset All co.eclecticlight.Insent then restart your Mac

> That's the beauty of using a GUI-first operating system!

What non-gui first OS are you running? DOS?

Re: You can't trust macOS Privacy and Security settings

#166

Post by wutwutwat » Sat, Apr 11, 2026, 4:02 PM UTC

epistasis wrote: post #55

eviks wrote: post #36

That's the beauty of using a GUI-first operating system! > only way you can protect your Documents folder from access by Insent is to run the following command in Terminal: tccutil reset All co.eclecticlight.Insent then restart your Mac

Jobs is turning in his grave. There are lots of stories of this conflict at NeXT and Mac OS X where there's a quick fix but not via GUI, which was one of the many things that incensed him.

> where there's a quick fix but not via GUI

This is every OS. Unless you're telling me linux users have never had to open terminal to change something? Or windows users never need to use powershell when installing the OS in order to create a local non-cloud account

Re: You can't trust macOS Privacy and Security settings

#167

Post by ksidjwicjwjd » Sat, Apr 11, 2026, 4:27 PM UTC

mh8h wrote: post #35

layer8 wrote: post #32

Earlier quoted context omitted.

The problem is that this given permission doesn’t show in Files & Folders, and after turning it on and off there it still persists. The only way to revoke it is using some CLI command and restart the computer.

That's not what's happening here. Forget about the first 5 steps. If you install the app and start from step 6, the behaviour will be the same. If the user chooses the Documents folder in the browse window in an app, the app can use the contents of the Documents folder without the need for that permission in the Settings page. The Privacy settings applies only to access to the Documents folder without the user intera…

Eeeeeh not quite. It depends on the app. Take Adobe’s apps, for instance, you may revoke access to documents but they will still create a bunch of cache and setting files in there whether you want it or not, there simply is no way to revoke these permissions—and these are not files created by the user in any conceivable way.

Re: You can't trust macOS Privacy and Security settings

#168

Post by ksidjwicjwjd » Sat, Apr 11, 2026, 4:29 PM UTC

iAMkenough wrote: post #90

nativeit wrote: post #82

Earlier quoted context omitted.

Don’t applications running under your user account have access to your user’s home folder by default?

No. You get prompted something like “Application wants access to your Documents folder” and “Application wants access to your Downloads folder” on first attempt of each folder.

Not always though. Adobe’s apps seem to be able to do whatever fuck they want whenever they want. I want so badly to stop them from creating a bunch of bullshit files in my Documents folder but there simply is no way to do it.

Re: You can't trust macOS Privacy and Security settings

#169

Post by ksidjwicjwjd » Sat, Apr 11, 2026, 4:37 PM UTC

eep_social wrote: post #133

sillyfluke wrote: post #50

Earlier quoted context omitted.

Speaking of GUI weirdness, I've seen a couple of relatively newer macbooks do this thing where the laptop is shutdown with wifi disabled, but after login on startup the wifi icon displays the wifi scanning mode as if the wifi is enabled and looking for networks before reverting to the wifi disabled display icon. Is this a GUI bug or is the wifi disabled setting overrided for a split second on startup? I haven't looke…

based on my experience, I suspect the latter similar, user-hostile behaviors I have found include: - wifi network passwords are persisted through a system wipe and reinstall in recovery mode - a phone home is required by an activation step during installation - bluetooth is always re-enabled after an upgrade

> bluetooth is always re-enabled after an upgrade

Not user-hostile in the least. This is to ensure that the Mac can find Magic input devices.

Re: You can't trust macOS Privacy and Security settings

#170

Post by minitech » Sat, Apr 11, 2026, 6:45 PM UTC

nativeit wrote: post #79

relaxing wrote: post #29

Earlier quoted context omitted.

It’s really poorly written. After reading it all I still can’t figure out what’s the mechanism by which revoked permissions are hanging around, which is what would actually be interesting here.

My impression is that the revoked permissions do not persist. Rather, an interactive window running under the user’s name has implied access to the user’s home folders, regardless of what’s been set under “Files & Folders” (which still applies for background/non-interactive processes). I could absolutely be missing something here, but the title would be accurate in saying, “MacOS ACLs aren’t terribly intuitive”. But…

> Rather, an interactive window running under the user’s name has implied access to the user’s home folders, regardless of what’s been set under “Files & Folders” (which still applies for background/non-interactive processes).

No, that’s not true at all. Granting permission using the folder picker is required.