then "Transmission" pushes an update that asks for read/write access to the whole home directory. There is no such entitlement: https://developer.apple.com/li

then "Transmission" pushes an update that asks for read/write access to the whole home directory. There is no such entitlement: https://developer.apple.com/library/mac/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html#//apple_ref/doc/uid/TP40011195-CH4-SW1 https://developer.apple.com/library/mac/documentation/Miscel... If you are talking about the 'open directory' dialog. Well, if a user is careless enough to just give a sandboxed app access to their complete home directory - tough luck. So I think sandboxing is basically useless against these kinds of attacks. No, it's not, because no entitlement allows blanket access to the user's home directory. Hence, an application cannot just encrypt all of the user's data.