9 ms·
A practical guide to securing macOS
- leetbulb 10y agoVery nice. Thank you for this! :)
- ents 10y agoBe careful. Some of these tools do not include any way to reverse their settings. A friend followed one of these guides and we had to reinstall the OS to get some wireless tech working again (Might have been AirDrop).
- wool_gather 10y agoAirDrop is pretty finicky anyways. Is there any further detail you can provide here?
- ysleepy 10y agoNice resource. But what I miss most, is a deeper analysis of the different launchd services and agents. - Especially which ones can be disabled and what features will be impacted. It is quite opaque, especially considering the verbose descriptions of Windows Services out of the box. I want to disable all these, for me, useless features: handoff, geo, maps, icloud, push, commCenter, spotlight web, siri, social integration, diagnostics reporting, and many more. It has been a very annoying experience of seemingly unrelated parts of the OS breaking when Disabling anything, - and log spamming of unsuccessful attempts of using it.
- callalex 10y agoThe parts of the OS you are describing were not designed in a modular way. It seems to me like you are using the wrong operating system if you want this level of control.
- ysleepy 10y agoAh, I'm holding it wrong. :P I use FreeBSD, Linux and Windows. I like macOS, I want to use it, but not under a facist rule of the one holy way. It is a tool and should not push policy through arbitrary limitations. But it seems we are caught in a war of lock-in ecosystem providers. Kind of a more realistic version of the much used picture of corporation-states or societies in sci-fi. Apart from this, hypothetically I might not only an end-user but also an admin who has to implement certain policies. The argument is never sound, there is always an economic or practical tradeoff and you are stuck somewhere and have to make it work and yours.
- gok 10y agoWhat part of macOS do you like and want to use?
- ysleepy 10y agoThe UI is polished, Commercial and refined Apps are available and technological it is a reasonably sound design. I have my *nix shell with software from macports as well. I just don't have the motivation or time anymore to make linux fit my personal computer needs, it always ends up in rabbit holes of tangles to accomplish many things and when you are actually trying to accomplish something unrelated to playing with it.
- rahoulb 10y agoDo you think the two might be related? One is modular and configurable and ends up in rabbit holes of tangles and the other is monolithic and controlling but keeps the trains running on time?
- ysleepy 10y agoSure they are related. But its not black and white, and not an absolute correlation. macOS itself is actually designed in a very modular way if you look at the message based integration of components via XPC and "do one thing" daemons. I have accepted that I must forfeit some personal preferences in the Apple ecosystem, but I choose to draw the line with not being able to disable intrusive and privacy related features/components. A similar complaint can be made about Windows, which is more monolithic in its design in my view, but it offers (as mentioned in my top-level comment) proper descriptions and a UI to disable services. Also there are many tools like Win10Privacy and such available which disable a lot, without making the system to constantly misbehave. "trains on time" - While I appreciate the metaphor, when considered carefully, it is more likely linux and the pragmatic approach that makes the "trains run on time" in many fields. (embedded and server-side)
- mahyarm 10y agoI really want a wiki for OSX processes & apple urls, integrated with little snitch & other app/network analyzers too. That way we can find out what is gamed, or passd, or what the hell is pancake.apple.com for.
- astrange 10y agoThey should all have man pages already. (That's Game Center and Passbook/Wallet though.)
- 0xCMP 10y agoI used to follow the changes a lot on this repo. Lots of great discussion in the issues of balancing practicality and security. Like @ents mentioned though, there are some un-reversible changes if you do everything they recommend. Although it'll make you more secure. I don't do most of this. I'm waiting until I decide to wipe my Mac and have plenty of time to play with it. (which is going to be when exactly? Not sure.)
- gist 10y ago> I'm waiting until I decide to wipe my Mac and have plenty of time to play with it. Clone a copy of your drive (use something like super duper) and then simply boot from the cloned drive. The clone drive can be another physical drive (attached via USB) or just use disk utility to create a separate partition and clone a copy there.
- 0xCMP 10y agoYea I guess I could do that. Play around with it and see how it feels and then I can wipe it over again if I want to.
- jrcii 10y agoFuck Hacker News and the liberal thought-police pieces of shit that moderate it.
- gok 10y agoThat time of year again? https://news.ycombinator.com/item?id=10148077 https://news.ycombinator.com/item?id=10148077
- tolmasky 10y agoIs there some way to have some faith from what you're getting from brew? In other words, can I verify installations from brew somehow?
- jesseendahl 10y agoYes, brew automatically checks that hashes of downloads match what was specified in the formula. This does mean you're trusting the formula maintainer(s), but anyone using brew is already doing that anyway. http://stackoverflow.com/a/25750690 http://stackoverflow.com/a/25750690
- jjn2009 10y ago>http://brew.sh/ http://brew.sh/ the home site shows a simple wget example for homebrew formulae the chain of trust is solid up until make and configure happen, at that point any number of things could happen so it's a question of whether or not you trust whatever scripts its running. unless homebrew has some sort of enforcement on what that script can do it could do anything. This is why its a really good thing that homebrew does not require root.
- mikemcquaid 10y ago> unless homebrew has some sort of enforcement on what that script can do Anything from our Homebrew/core (i.e. wget) uses the macOS sandbox to prevent writes outside of permitted locations.
- paultopia 10y agoFrankly, I am starting to have serious reservations about brew itself. It seems to now be forcing a self-update on every package installation, and that update somehow (I'm not a good enough *nix hacker to sort it out) gets some kind of elevated in the process privs: I've tried setting some of its component ruby scripts read-only and even changing ownership, and they still get force-updated on package installation.
- jamesgeck0 10y agoGuide should probably mention automatically updated Chrome extensions. There have been multiple cases where the owner of a popular extension sold it to a 3rd party that pushed out malicious updates. Tab Manager is the most recent instance that comes to mind: http://security.stackexchange.com/a/130600 http://security.stackexchange.com/a/130600 Chrome does disable extensions when an update requires new permissions, but that won't catch malicious updates to extensions that require extensive permissions for basic functionality.
- lima 10y agoAll my Chrome extensions are Git repositories in my home directory. Works really well and I can take a look at the changelog after pulling. Requires the extensions to be open source, of course.
- duskwuff 10y agoAnd means that Chrome will nag you about your "developer mode extensions" every time it starts up. I know why they do that, but it's still annoying. :(
- yeknap 10y agoThe price you pay for convenience vs security.
- wtbob 10y agoThis is similar to how Android warns me every single time I reboot that an unknown entity can observe my network traffic. The unknown entity, of course, is me (I've installed a certificate for my Streisand server). But still, it flashes a warning every single time. Of course, this means that if anyone ever does install a malicious certificate on my phone, I'll be none the wiser. Thanks Google!
- eneveu 10y agoThanks for mentioning your Streisand server. I had no idea this existed. This is amazing! Here is the GitHub repository if other people are interested: https://github.com/jlund/streisand https://github.com/jlund/streisand
- tolmasky 10y agoAny thoughts on doing work in virtual machines?
- brobinson 10y agoI have a MBP as my primary machine, and I do all of my development work in a VirtualBox VM running Ubuntu. MacOS seems a lot more stable without 40gb of development stuff installed.
- deleted 10y ago[deleted]
- tptacek 10y agoI like reading guides like this, and they're useful in a sort of encyclopedic sense, but the problem with them is that they're really a "practical guide to doing every conceivable security thing you could do" with macOS, which is in fact not the best way to secure your operating system. For instance: it's probably not the world's greatest idea to go out of your way to install Adium for secure messaging on a locked-down Mac. The cryptographic advice in this particular guide is not especially great. You can, for instance, safely ignore what it says about randomness (and, in particular, about how it interacts with FileVault's XTS block crypto). Its advice about password management is needlessly complex (if you trust Keychain, use Keychain Assistant to generate passwords, not OpenSSL --- but most of the cool kids just use 1Password, and they're right to do that).
- JumpCrisscross 10y ago> most of the cool kids just use 1Password Do you have a view on 1Password versus LastPass?
- paws 10y agoA friend recently introduced me to Keepass[1], it seems to be an open source 1Password. I'd be interested in opinions on that, especially @tptacek's. [1] http://keepass.info/ http://keepass.info/
- SadWebDeveloper 10y agoYou will probably get tons of bad comments on KeePass security (specially for 2.x the "Professional" version, since its developed with .NET C#) but KeePass threat model is way more easy to handle/secure than any of those cloud based password providers. Just remember to keep it updated and use password and key to protect your database. Plus remember to read the Security section for clarification on "ways to pwn you": http://keepass.info/help/base/security.html http://keepass.info/help/base/security.html
- 9point6 10y agoKeePass has open source clients on every major platform. A central cloud service using closed source applications for storing passwords just seems like an easy target for assailants.
- jdeibele 10y agoWas curious what would happen if you set the firmware to only boot from the startup disk and it crashed ... Seems like MacOS does the reasonable thing and prompts for the firmware password if you use a different disk. https://support.apple.com/en-ca/HT204455 https://support.apple.com/en-ca/HT204455
- pttrsmrt 10y agoStep one: Don't use macOS
- ralmidani 10y agoYou're probably being downvoted because you didn't elaborate, but I agree with your implied premise: proprietary software is inherently insecure.
- bigiain 10y ago> proprietary software is inherently insecure Unlike widely used and security-critical open source projects, right? Like, say, OpenSSL? ("All hardware sucks. All software sucks." This is at least as true these days as it was back on alt.sysadmin.recovery in the '90s)
- ralmidani 10y agoAt least in the case of free (as in freedom) software, the vulnerabilities can be exposed and patched. More importantly (and more relevant to this discussion), software freedom also tends to make it difficult for the original developer to hide malicious features.
- acdha 10y agoTheoretically, yes, but if you're going to make that claim you'd need some hard data showing that exploitable bugs either happen less frequently or are going and patched earlier. Care to show your data and analysis?
- bigiain 10y agoTo be fair - they didn't make that claim, just left it up to you to assume the dichotomy. It can be (and arguably is) true that "proprietary software is inherently insecure" - without requiring an opposite statement like "open source software is inherently secure" to also hold. (The wording in context _does_ strongly suggest that was the implied premise of the implied premise tho.)
- Theodores 10y agoHow often you find yourself locked out of your house obeys Murphy's Law, add lots of security and you will find yourself annoyingly locked out for silly reasons all the time. Have just the one simple lock on the door and you probably will not end up locked out, particularly given there is a key under the mat. I had a laptop of mine retrieved by the police from a big rubbish bin. The screen was broken, it did boot up though. Another time I had the broken screen after being hit by a car. These things happen and I am always sure I can get in even if keyboard/screen/mouse isn't an option. It is more useful for me to be able to somehow access my machine even if broken, I imagine there will be circumstances of that. When the police retrieved my laptop I wasn't exactly worried about my obvious login password or whether I had locked down that mysql port sufficiently. The thief wasn't even literate so those extreme security measures wouldn't have helped.
- rasz_pl 10y agoWow, and people laughed at all the Windows 10 antispy tools/script packs. Turns out this is the state of personal computing in 2016, nothing is decent out of the box anymore :(
- jmnicolas 10y ago"Is your adversary a three letter agency (if so, you may want to consider using OpenBSD instead)" If your adversary is a 3 letter agency you'd better use no computer at all. If they can't subvert the OS (witch I doubt) they'll subvert the hardware (hello Intel ME).
- tessela 10y agoI find really amusing the author does want to hide the installation from Apple, but recommends using Google DNS and Chrome for everything else.
- TurboHaskal 10y agoIs there a similar guide but for Windows? Google mostly shows you guides from merchants trying to get you buy AV licenses.
- rdslw 10y agoI'd gladly use one - if anyone have some links, please share. The one I've found: http://hardenwindows10forsecurity.com/index.html http://hardenwindows10forsecurity.com/index.html
- ergot 10y agoI quite enjoy this script called make_windows10_great_again.bat https://gist.github.com/IntergalacticApps/675339c2b805b4c9c6e9a442e0121b1d https://gist.github.com/IntergalacticApps/675339c2b805b4c9c6... Keep in mind this is a very rigorous script and modifies Windows10 beyond recognition. Infact it kind of makes Win10 appear and function more like Windows8