Can you trust that permission pop-up on macOS?

377 250 1 year ago

sefrost• 1 year ago

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know.

I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

nmgycombinator47• 1 year ago

I'm not aware of the "helper tool" popup, but I would definitely be skeptical of it. Even if it is Slack, Slack is just a messaging application. I don't know what legitimate need it would have for a helper tool. I would ask Slack support, though (and hopefully you can get a real answer and explanation).

1oooqooq2• 1 year ago

Slack is just a messaging application

its sold more as a way to store and all conversations than the ability to be a messaging application.

the original pitch was to make all information, even private conversation of previous employees, searchable.

makeitdouble2• 1 year ago

Slack is just a messaging application.

I kinda like this angle. While Slack makes an effort to work basically everywhere with low effort, I wonder what would follow if it wasn't the case.

For instance if for some stupid legal reason Slack was banned from macos, how many people would just switch to another OS ? I'd bet it would be a non trivial amount of users at this point.

dcrazy• 1 year ago

This dialog comes from the System Management framework [1]. Slack is probably installing a privileged helper tool (conceptually similar to a setuid root binary) so that it can update itself regardless of where it is installed or which user originally installed it.

[1] https://developer.apple.com/documentation/servicemanagement/...

QuercusMax3• 1 year ago

Seems like it should only need to do this once. I get this with almost every Slack and VSCode update. The correct solution for me is to quit Slack.app and let my company's management software do the update for me.

nmgycombinator47• 1 year ago

A software updater was going to be my best guess at what this was. I guess I understand the flexibility it brings, but it definitely does have some security trade-offs.

e402• 1 year ago

I installed Slack from the app store and never see this popup.

accrual• 1 year ago

Discord does this as well I believe. I often needed to enter the administrator password to install a helper after the system had been off for a couple days.

1shooner• 1 year ago

I get this from every Electron-based app that I have run as multiple OS users.

kccqzy• 1 year ago

That does sound like it could be exploited, but with only as much exploitability as some random app that requires your password (for analogy consider a Linux binary that refuses to run unless being run as root). Ultimately it's a matter of deciding whether you trust the developer of the app and whether you trust this app is really from that developer. The day Apple prevents users from giving root access to a third-app app is when the Mac fully becomes a walled garden, and you can expect pages of HN complaints.

Overall I think it's good paranoia to not grant root permissions to apps that do not clearly need them such as Slack.

aziaziazi• 1 year ago

Being paranoid, would it be possible that another app already installed (but not trusted enough to give privilege, let’s say a shady mouse driver or screenshot app) detect when slack (more trustfully) does launch to open a dialog at that precise time and deceive the user? Let’s say the shady app is named « SIack » or something close enough to be missed - but brand itself as innocents « screenshotPro4000 » in the app itself graphics so you’re not suspicious.

nmgycombinator47• 1 year ago

The day Apple prevents users from giving sudo access to a third-app app is when the Mac fully becomes a walled garden, and you can expect pages of HN complaints.

I can see this happening, but it probably won't anytime soon. macOS is still open enough, and with the assumption that sometimes processes need root (see third-party Launch Daemons).

It would probably break quite a lot. But I wouldn't be surprised if they eventually gradually move macOS in that direction.

haiku2077• 1 year ago

I get this popup all the time.

It contains no information that I can reasonably use to match a decision on whether or not to allow it, so I always click cancel on it.

jonplackett4• 1 year ago

These types of ‘security’ blockers are so dumb because they train people to act dumb. Even if they’re real, the next time they may not be.

It’s like how my bank often calls and wants me to give them my personal info for ‘data protection’ before we can speak. These are legit bank calls, training people to give out personal info to strangers.

hbn• 1 year ago

As of the latest macOS update, every app is now asking every few days if it can have access to devices on your local network, or something to that tune. My theory right now is it's something in chromium that automatically asking for this and Electron apps will do this out of the box, but I can't remember which apps exactly have been doing this.

Regardless, yes it causes the exact issue you're talking about. I don't even read what the popups say anymore, I'm just blindly hitting an accept button.

codebje• 1 year ago

If someone cold calls me and asks me to verify myself, I refuse.

If it’s an expected call or they give me a good reason to, I’ll call their listed contact number back.

So far I have not missed out on anything of consequence by refusing to identify myself to someone who initiated contact with me.

jq-r• 1 year ago

And it so annoying because it steals focus so as you're writting a message it suddenly stops taking your input and "helpfully" continues typing your text into the password box.

floatrock• 1 year ago

Not an os-x developer, but I've always wondered are there any OS guardrails against any (malicious) application showing a window styled the same way as that popup box and just stealing your password?

nmgycombinator47• 1 year ago

I mean, I don't know how there would be? Unless they were scanning the text of every pop-up for words convincing the user to enter their computer password. There would be no way to determine intention without some sort of language analysis.

rplnt• 1 year ago

And they somehow stack in time. So after a weekend it's popping up over and over until I give up and quit Slack. It's been like this for a year I'd say. There's no way to stop them and they always get focus, which is extremely annoying. How can I revoke this permission from Slack? Seems pretty abusive.

diebeforei485• 1 year ago

I use Slack as a web app, but not in the browser: https://support.apple.com/en-us/104996

Discord can be installed this way as well. It's (imo) a better usage experience than their Electron apps.

Nearly every Electron app is better this way.

gorfian_robot• 1 year ago

same but nordVPN

nyarlathotep_2• 1 year ago

VSCode does this too on work-issued Mac.

I've been ignoring both for literally years.

e402• 1 year ago

The patch is released

I assume that is with 15.5...

nmgycombinator47• 1 year ago

which was patched in today's releases of macOS Sequoia 15.5 et al.

Correct.

nmgycombinator47• 1 year ago

Correction (longer explanation elsewhere): only 15.5. Apple didn't patch it in the other two releases.

commandersaki• 1 year ago

Love this guy's research, such good presentation!

nmgycombinator47• 1 year ago

Thank you very much! Although I'm not a guy, just fyi! I'm just a person :)

JohnFen• 1 year ago

Honestly, I don't really trust any permissions popups on anything anymore. They are often porous enough to count as "security theater".

nmgycombinator47• 1 year ago

I honestly think this is a good skepticism to have. I generally don't hit "Accept" (or "Allow" or whatever) on any permission pop-up unless I know exactly what it's doing and what I need it for.

coolcase2• 1 year ago

And at $Corp I get constant popups to enter my password or confirm an action. Like 50-100 a day.

nmgycombinator47• 1 year ago

I bet threat actors are just salivating at the thought of giving you a fake password prompt.

silvestrov• 1 year ago

It took Apple a full year to release the fix. That is a very long time.

2024-05-04 I leave several additional update messages as I continue testing my PoC

2025-05-12 The patch is released

nmgycombinator47• 1 year ago

Yeah. I'm guessing there must be some legitimate (internal?) use cases for the behavior I found and they spent all that time working out the kinks to allow those edge cases while also not allowing malicious ones. Or perhaps it wasn't as high on their priority list as it required a higher level of user interaction (the user had to click "Allow"). In any case, though, I do believe that a year is a shockingly long time for them to take.

zoomTo125• 1 year ago

Almost a year to release a patch. If Apple takes that long, there is no hope for other vendors.

nmgycombinator47• 1 year ago

This is Apple-specific, though. So there aren't really any other vendors that are relevant to this specific scenario. I will say, they have been quicker with my other reports; taking just a few months as opposed to a full year.

kllrnohj• 1 year ago

Why is there no hope for other vendors?

EGreg2• 1 year ago

I once sent an email to Steve Jobs back in 2009 or so

I told him that the MacOS permissions dialog could easily be spoofed, and that Macs should have a secret phrase or icon that you choose that they’d display inside these dialogs, and prevent their screen capture like what they had been doing with their recent DRM features.

Never heard back from him

And it never got implemented. Any program can still continue to spoof it and grab your system password.

nmgycombinator47• 1 year ago

I mean, at that point and app could just put up a fake prompt using the UI framework. And I think users would be more hesitant to type a full password than just click a button. But if you're talking about a bug similar to mine where an attacker could use the OS's own code against it and make it show a prompt with misleading content, you might be able to report it to Apple Product Security and maybe get a bounty.

trollbridge7• 1 year ago

I mean, a website could display a crafty popup-appearing box and try to get you to type in your username and password. Not really sure how you can prevent that.

Vista used the “the background dims quite a bit” to try to deal with that.

sureglymop• 1 year ago

I wonder why they don't add a little led to their laptops that would indicate that it really is the system asking for your password. Kind of like the camera led.

muppetman4• 1 year ago

I remember the I'm a Mac and I'm a PC ads that mocked this on Vista. And now my Mac is worse than Vista. It's so annoying.

nmgycombinator47• 1 year ago

Out of curiosity, what do you find annoying about it?

muppetman4• 1 year ago

Every time I update an app I have to be told I downloaded it from the Internet and do I trust it. Can this app look on the local network? Constantly being nagged to the point I don't even check/care anymore. Exactly what Vista used to do.

bigyabai5• 1 year ago

Oh god, don't get me started...

1. iCloud nags never go away if you don't log into iCloud

2. Apple Music is just an advertisement by default and "conveniently" opens every sound file mimetype

3. Functionally useless subscription slopware like AppleTV+ comes installed by-default for no reason

4. Package management is a colossal clusterfuck that can't even enforce package parity across system architectures

5. Apple still doesn't trust their users enough to have modern amenities like a native Vulkan runtime or Nvidia GPU drivers

Vista was terrible, but it didn't suffer from this level of identity crisis.

nixpulvis• 1 year ago

The tradeoff between security and extensibility is something which seems to be unavoidable.

But the goalposts have moved a bit. At least macOS is not plagued with malicious processes like was common on windows. Or maybe I'm just careful?

skinkestek• 1 year ago

Neither was Windows if you knew what you were doing.

I ran Windows XP for years without antivirus back in the early 2000s and so did others.

pjmlp2• 1 year ago

Yes, Windows has had quite a few years to improve the experience of UAC, on the other hand there are plenty of other stuff to complain about.

thewebguyd2• 1 year ago

At least Windows now makes the UAC dialog distinct from the rest of the OS and any other Window. macOS (and most linux DEs too) just look like any other application dialog, easily spoofed.

UAC on Windows opens up on the secure desktop, which is isolated in protected memory and not accessible to other processes. It's also visually distinct, hiding all other UI elements, and nothing else can present the actual secure desktop, only UAC can. Granted, I've seen some fairly convincing looking fake prompts (that regular users would fall for) but to me they were still obviously fake, and they were unable to hide all UI elements like UAC does.

The secure desktop for UAC is also supposed to help prevent cursor offsets and other attacks (replacing the system cursor with fake one that shows as if it's over the "no" button but is actually going to click on "yes").

macOS could really use something like that for it's prompts, and I don't know why any other OS hasn't implemented something like UAC's secure desktop.

ziml773• 1 year ago

I find Linux even more annoying when it requires elevation. I get a password prompt rather than a yes/no dialog. I don't care about defending against an attack where I left my computer unlocked while I wasn't watching it, so the password request is pointless. The only thing I need to see is that I'm elevating something and the only extra security I want is that, like on Windows, it's impossible for an application to automate clicking yes.

Last I checked there was no solution for this on Linux though. Heck I couldn't even find a way to switch it to use biometrics.

muppetman4• 1 year ago

You can just make sudo not require a password... You'll never see any prompt again then.

yieldcrv• 1 year ago

Apple confirms that I will be credited

congratulations on the credit

and they also paid you $1,000,000 or whatever their top bug bounty payout is right?

nmgycombinator47• 1 year ago

No word from them on the payout, yet. They only start deciding on if and how much to pay after the patch. I know for a fact it doesn't fall under the $1,000,000 reward tier as that is for their Private Cloud Compute platform. But it may fall under some of their other categories.

cypherpunks01• 1 year ago

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine.

If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on their own, with non-admin permissions. The only exceptions I've found are Tailscale and other stuff that needs higher level OS integration.

Edit since upvotes: Non-admin user operation was recommended by the Pareto Security app, see info on this specific item: https://paretosecurity.com/mac/checks/not-using-admin

All Pareto security checks: https://paretosecurity.com/mac/checks

App: https://paretosecurity.com/mac and https://github.com/paretoSecurity/pareto-mac

Etheryte• 1 year ago

Unfortunately many (most?) application developers don't know this either, and many of them go so far as to explicitly require their apps to be installed in /Applications, they simply won't work otherwise.

xp847• 1 year ago

No comment on the overall topic, but I have long made a practice of installing into $HOME/Applications instead[1], and it's rare for me to encounter software that cares. A few apps have added popups to explain to beginners "Hey, you're running me from the Downloads folder, uhh, want me to properly move myself to /Applications/?" but that's about it.

The only apps I run from /Applications that aren't part of the OS are the ones that still use "Installers" like Adobe apps, because I assume they spew crap all over anyway. I haven't tried moving those, but I wouldn't be surprised if they deeply cared.

[1] The idea being that I could then migrate more easily by copying the whole home directory, and thus all my apps that didn't require "installation" would come over.

Klonoar3• 1 year ago

Apple themselves have a quirk in some cases where apps that aren’t in an Applications folder get mounted as read-only.

Granted I haven’t seen the bug in awhile, but I also never saw acknowledgement of it being fixed so…

nmgycombinator47• 1 year ago

Fascinating! Personally, I need an admin account in my daily work, so I wouldn't do this, but for those it could help it definitely looks interesting.

mulmen2• 1 year ago

You can still choose to install apps to ~/Applications if you are an admin.

nyanpasu64• 1 year ago

I don't even have a ~/Applications on macOS 15.4.1.

p_ing4• 1 year ago

You need to manually create it.

mschnell• 1 year ago

In the Finder it is translated to your system language. For example, „Programme“ in German. It is still Applications in the terminal.

throwaway2905• 1 year ago

If you install an app in ~/Applications, it can auto update without root, but any sus code can overwrite it without root rights too

pbhjpbhj• 1 year ago

Which is madly insecure, right?

mike_hearn7• 1 year ago

Nope, that was fixed several releases back. macOS doesn't use the concept of a root user for years. It's there in the APIs for backwards compatibility but the actual enforced permission model is nothing like UNIX.

1. Apps can't tamper with each others files. Try writing an app that writes to another app's bundle, even if it's in $HOME, and you'll find you can't. One way to test this quickly is to ensure that your terminal app doesn't have "Manage applications" privilege in the settings app, restart it, then use vim to open a file in a bundle that appears to have user write permissions. You'll find it is read only.

2. root can't make arbitrary changes to the system unless you disable SIP (requires messing around in recovery mode terminals).

traceroute663• 1 year ago

as every single app installer suggests

Not every single app installer, only those app installers written by incompetent devs.

Those written by educated devlopers give you the option to install "for all users" or "just me" (or words to that effect).

HnUser12• 1 year ago

Oh interesting, thank you! I wonder doing this will fix the issue where slack repeatedly asks admin password for updating.

stefandesu• 1 year ago

I knew that ~/Applications exists, but never really used it until I started at my new job where I didn’t have admin permissions by default. Now I’ve configured Homebrew to install casks into ~/Applications and it works for almost all applications.

pier25• 1 year ago

Adobe Creative Cloud will keep multiple processes running in the background even when you explicitly configure it to not do that in the OS settings.

MiddleEndian3• 1 year ago

Creative Cloud is malware IMO.

xp847• 1 year ago

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something.

Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to try dragging it out of the browser viewport or switching tabs to see if it is fake or real.

The only protection against this kind of stuff is to NOT teach users that legitimate software pops up random "enter your password" dialogs in front of your work without any prompting. That's what these dialogs are doing.

Display a colorful flashing icon in the menu bar. Use an interstitial secure screen like Windows does. Whatever. But the modern macOS 'security' UI is wildly bad.

ssd6462• 1 year ago

When logging into iCloud, they show a pop-up asking for the local password to the computer. And then they upload that password to the iCloud servers.

DowsingSpoon• 1 year ago

Please provide evidence for a claim that logging into iCloud necessarily sends your plaintext local password to the server.

whartung• 1 year ago

The thing I hate about these things is I have no idea why they’re asking this, and no idea what happens if I say No, even how to “manage” these settings should I wish to change it.

The UX is different from the apps saying “Hey, open the preferences panel and give us XXX” and there you can see the app, the capability toggle, decide to turn it on, or even go back to turn it back off.

These experiences have been why I’ve not a big fan of “capabilities” as a concept. The UX around them is awful, and almost has to be.

“Enable <root my computer> to enjoy your new app fully. “ This is what you get if the vendors have any say in what the messages should be.

Not really helpful.

josephg2• 1 year ago

These experiences have been why I’ve not a big fan of “capabilities” as a concept. The UX around them is awful, and almost has to be.

I don't think the UX has to be awful. The problem is just that they're kinda half baked on macos, and bolted on, and not really a first class citizen. There's no reason you couldn't have:

- A preferences dialog showing which long-lived capabilities you've granted to which application. (Which is almost exactly what the accessibility preferences pane already is.) Ideally this UI could have a log of ways in which the application has used that capability recently and the ability to revoke it. Maybe even the ability to review the app's use of the capability. Show the review score to other users when the app asks for the permission.

- A little blob of text saying why the application is asking for the specified permission. iOS requires this from all 3rd party apps. So its kinda weird that MacOS is missing explanatory text entirely on these popups.

- Clear indication of what would happen if you said no.

- Interdiction. In a good capability systems (eg SeL4), a capability object doesn't tell you what you can do with it. Eg, you can't ask a file handle which file its actually associated with. This means you can craft your own "virtual" capability which fakes the expected behaviour and pass that to an app instead. Any calls made using the capability come to you. Whenever phone apps ask for access to my contact address book, I'd love to be able to say yes, but give them access to like 100mb of fake entries instead.

- And on top of interdiction: logging, call whitelisting, "Little snitch", etc.

- More fine grained capabilities. I don't want to give any app a "root my computer" capability. I don't want that to be a thing applications ever need or get access to.

I think macos's problem is that its trying to bolt on capabilities after the fact. POSIX isn't built around capabilities. As a result, app developers don't think in terms of capabilities, and they expect their apps (new and old) to work without them. In a real capability based OS, fopen() should probably take a capability as a parameter. But making that change would require changing just about every program ever written for the platform. And modifying the standard library of all programming languages.

Groxx• 1 year ago

Capabilities are what lets you open a file picker from an app that cannot read your files, giving you a seamless and secure interaction with no extra UI.

They are definitely not always awful.

spoonsort• 1 year ago

Yes, this is the whole issue with these kinds of systems. The message gets lost in translation to the user. An OG java applet would say "this app is signed, do you want to continue", and the engineer at the bottom is the only one that knows what that even really means, which is that the applet gets to run outside the sandbox if the user runs it. Windows UAC is similar, as are most Linux desktop security mechanisms.

matthewfcarlson2• 1 year ago

What is the threat model of clicking on a fake popup? Isn't it a no-op because it isn't actually coming from the system?

matthewfcarlson2• 1 year ago

Just realized that it asked for your system password if you don't have Touch ID.

aranchelk• 1 year ago

I really appreciate the integrated fingerprint reader in these cases. I usually run with my laptop screen closed (with external monitor) but open it specifically to authenticate in system dialogs.

aequitas• 1 year ago

Apple also sells a wireless keyboard with touchid integrated. Works great. Especially if you also set pam to use touchid for sudo. They’re not cheap though.

phendrenad2• 1 year ago

Plot twist: That dialog never existed! You already fell for it!

musicale• 1 year ago

The passkey pop-ups which are indistinguishable from javascript pop-ups are a particularly egregious security mistake.

sureIy2• 1 year ago

What's the problem here? Javascript popups can't read your fingerprint so what would be the endgame of a fake passkey popup?

nmgycombinator47• 1 year ago

Hijacking this current top comment to let everyone know there is an important update to this article: https://news.ycombinator.com/item?id=43969087

pornel• 1 year ago

My non-techie relatives can't tell the difference between the local device password/passphrase and the iCloud/Apple ID password, so they'll enter them all until something works (I don't blame them, the UIs for these are unclear and inconsistent).

Apple used to make fun of Vista's UAC, but they've ended up with the same patchwork of sudden prompts, and even weaker UI.

nmgycombinator47• 1 year ago

Yeah, to be perfectly honest, I understand. I think TCC is meant to be the primary consent system, but there are others (such as the Authorization system, and the Service Management framework).

yencabulator• 1 year ago

Seems like it's time to re-post this golden oldie: The Line of Death https://textslashplain.com/2017/01/14/the-line-of-death/

WA• 1 year ago

Thanks for posting. I’ve had this vividly in my mind for years, but didn’t remember the source. Makes so much sense.

dpacmittal• 1 year ago

This. Moved from Linux to Mac recently and I was so confused about the random root password pop-ups. It gives no explanation on which app or command is asking for root access or why it needs root access. So I started denying the request after granting access a few times. Now I don't get that pop-up anymore. I still have no idea what was causing those pop-ups and why they stopped

ronnieboy493• 1 year ago

If macOS still attached modals to windows I think this might be less of an issue [0]. Not fixed, but less bad. In the previous screenshot, the modal lays over the toolbar which really reads as "part of the application". Steve Jobs, when demoing Aqua, made a point of the pain that is detached modals[1].

But here we are, detached modals, because of Apple's weird fetish for mobile UI on everything.

---

[0] https://kagi.com/proxy/latest?c=LsHiRSPxhD29sXqLhdI0j1EsQ98n...

[1] https://youtu.be/6-fkYFV7rOY?t=242

nmgycombinator47• 1 year ago

Damn, that really puts things into perspective. Granted, attached modals presuppose there's a window to attach to. But I think that would probably be true 9 times out of 10.

saagarjha5• 1 year ago

This is pretty straightforward for a malicious application to simulate.

LexGray• 1 year ago

I think Apple took a step in this direction when they started forcing you to navigate to Security & Privacy to enable the modal the first time when launching an untrusted app.

They could probably add an opt-out step two for consumer level use where that step is also required for all root permissions requests. I would add a fast blink of the webcam light to prove trusted modal is open.

Currently it is incredibly clunky (they should put a notification at the top of the settings like for software updates), but you have some indication what app is triggering it and the dialogue could be hidden until it is time to review updates. Showing all entitlements and privacy settings should also be required any time a root password is requested with changes being noted as unusual, including changes in developer accounts.

jclardy• 1 year ago

They should really make it open as a dialog attached to the system preferences window, and within that include what app/service is requesting permissions. Having the free floating window isn’t good for anyone, and duplicating the settings app would at least make it slightly more difficult to fake.

walrus01• 1 year ago

To give an example of how little thought the non technical user pays to scary pop ups and warnings, people running MacOS and Chrome will regularly fall for full blue screen "your computer has been locked by windows, call Microsoft support at this phone number to unlock". It doesn't even enter into their minds that they're not running a windows computer before they even contemplate that it's just scam content presented in a full screen browser window.

deafpolygon• 1 year ago

This is why I've trained myself to ignore these dialogs if I did not perform any action that would then prompt it. It doesn't eliminate the risk but it rules out 80% of the low hanging fruit.

pkkkzip• 1 year ago

man, i think this really is the last time im buying Apple products, the string of CVEs, the many issues with hardware, iPhone as well....im over the hype and switching to Android and Windows

I miss being able to play games. I miss having a phone without lock-ins and security vulnerabilities that do not get patched.

muppetman4• 1 year ago

Oh you're going to _hate_ Windows - I say this as someone who switched in the last 2 years. MacOS can be very annoying, Windows is just one big advertisement these days in a badly skinned window manager.

trealira• 1 year ago

Yeah, I basically keep Windows just for Word and Excel and Windows-exclusive video games, and use Linux most of the time because of this. There's no perfect system out there.

seeknotfind• 1 year ago

Trust nothing.

lapcat• 1 year ago

From the beginning, TCC has been a house of cards. It only impedes legitimate developers and tortures users with permission prompts that Apple ridiculed back in the day, while malicious apps can easily bypass the "security" (theater) in countless ways that researchers continue to uncover and report. I'm not a professional security researcher, just a Mac developer, but I've discovered a number of bypasses myself. It's almost as if Apple engineers don't even understand the technology they're using. And maybe they don't! How many remain from the pre-iPhone era?

mrtesthah• 1 year ago

The continuous incorporation of basic system features into TCC has drastically increased the friction of deploying enterprise management software on Macs (especially for education), to the point where I would question the overall value proposition.

I say this as a dedicated macOS (Cocoa) developer since 2003.

Jerry2• 1 year ago

Author didn't disclose if got a reward for his work. Hope he did!

nmgycombinator47• 1 year ago

Thank you for your kind words. To respond: 1. I'm not a "he", I would prefer "they". 2. As I mentioned in another comment, I have not received word back yet on any reward.

sexy_seedbox• 1 year ago

Maybe they'll put you into their "Hall of Fame"

nmgycombinator47• 1 year ago

An important correction, so hopefully this bubbles to the top (this will be appearing on the post as well):

A previous version of this article mentioned below that this CVE was patched in macOS Sequoia 15.5 et al., but I was a bit mistaken in that. Despite being released today as well, it appears that macOS Ventura 13.7.6 and macOS Sonoma 14.7.6 are not patched against this vulnerability.

I wrote that sentence assuming that Apple would have included a patch in all of the releases. It was only later, when I checked the security release notes, that I saw I was not credited under the other two releases. I reached out to Apple to clarify if these releases were patched. As of writing, I have not heard back.

I chose to do my own testing and spun up a virtual machine. After some difficulties I got it updated to macOS Sonoma 14.7.6 and was able to compile and run my proof of concept. It still worked. I would assume the same is true for macOS Ventura 13.7.6. I'm not sure why Apple didn't include the patch in these two releases.

I will update the post when I have more information and/or context.

nmgycombinator47• 1 year ago

Edit made: Ventura and Sonoma will remain vulnerable. Apple made the decision to only patch this in Sequoia.

gitroom• 1 year ago

tbh i just don't trust any of these permission dialogs at this point - makes me wonder if good security even starts with the ui or it's all just kinda broken underneath?

nottorp• 1 year ago

Well, today Mac OS told me Chrome wants to access bluetooth, which of course I denied.

So I guess sometimes the permission system works.

kristel100• 1 year ago

At this point, “permission fatigue” is real. You almost get trained to click ‘Allow’ just to get work done—which defeats the whole point. Would love a tiered trust model, not binary prompts.

freddie_mercury• 1 year ago

You almost get trained to click ‘Allow’ just to get work done

I had an interesting experience of this with a normal/non-technical user when my wife asked for help setting up some money remittance app. Early in the install it popped up some dialog, something about whether you wanted to transfer money via credit card or...except she clicked the "OK" button before I could read more than that. As in, she clicked it literally as fast as she could process there was a pop-up and move her finger there.

I asked her why she clicked the pop-up away without reading it, it might have been important...and she literally began to argue with me that there hadn't been a pop-up and what was I talking about.

Just like how our brain has learned to edit out blinking, it seems like (at least in some circumstances) her brain has learned to edit out pop-ups and essentially muscle memory is clicking "Okay" as fast as possible to get back to whatever she was doing.

geekraver• 1 year ago

This is one of those places where having a selected “security image” makes sense. That popup should not just be easily spoofed text.

nmgycombinator47• 1 year ago

I agree with you. However, in this case, I was abusing a legitimate OS prompt (not just making my own), so I don't know if a security image would be a barrier there. It would definitely be one for instances where malicious apps make their own pop-ups.

Can you trust that permission pop-up on macOS?

Related Stories