4 ms·

I’d like a bit more detail. Instructions to repro ideally. Too much is left out of the video (show me the items it will access and the access permissions for th

I’d like a bit more detail. Instructions to repro ideally. Too much is left out of the video (show me the items it will access and the access permissions for those items) and I’m inclined to think it’s staged or Mr. Wardle didn’t understand something fundamental (e.g. if you built/debugged the app on the same system where you made the video, you may have already authorized the app to fetch items from the keychain.)

mvdwoord 9y ago
So would I.. normally quick to dismiss. I'm not familiar with Mr Wardle, but he seems to have some serious followers. I was hoping someone here has some background information.
benashford 9y ago
It showed the "unknown developer" warning box when running the app, would that have been shown if the app was already authorised to access the keychain?
- delinka 9y ago
  Yes. It's not "access to the keychain" but "access to this item" and it's a simple "the binary $NAME with $DIGEST has permission to access this item." Technically, if you can create another executable binary with the same name and digest, you can access the same keychain item.
  - jakobegger 9y ago
    nope. Keychain checks the code signature of the app.
    - delinka 9y ago
      Finding that hard to believe if the binary isn't code-signed.
      - jakobegger 9y ago
        You are right, I initially misread your comment, I thought it said that Keychain only checks the app name. The security framework uses some kind of digest / signature to verify that the app hasn't changed if the binary is not code signed. Apple's docs are scarce on details, see eg [1] which just says that the security framework makes sure the app wasn't altered. But I am pretty sure the app name is ignored. Most macOS services use the bundle identifier. However, if the app is code signed, the security framework automatically grants newer versions of the app permission if they have been signed with the same certificate. [1]: https://developer.apple.com/documentation/security/1400622-sectrustedapplicationcreatefromp?language=objc https://developer.apple.com/documentation/security/1400622-s...

mvdwoord 9y ago

So would I.. normally quick to dismiss. I'm not familiar with Mr Wardle, but he seems to have some serious followers. I was hoping someone here has some background information.

benashford 9y ago

It showed the "unknown developer" warning box when running the app, would that have been shown if the app was already authorised to access the keychain?

delinka 9y ago
Yes. It's not "access to the keychain" but "access to this item" and it's a simple "the binary $NAME with $DIGEST has permission to access this item." Technically, if you can create another executable binary with the same name and digest, you can access the same keychain item.
- jakobegger 9y ago
  nope. Keychain checks the code signature of the app.
  - delinka 9y ago
    Finding that hard to believe if the binary isn't code-signed.
    - jakobegger 9y ago
      You are right, I initially misread your comment, I thought it said that Keychain only checks the app name. The security framework uses some kind of digest / signature to verify that the app hasn't changed if the binary is not code signed. Apple's docs are scarce on details, see eg [1] which just says that the security framework makes sure the app wasn't altered. But I am pretty sure the app name is ignored. Most macOS services use the bundle identifier. However, if the app is code signed, the security framework automatically grants newer versions of the app permission if they have been signed with the same certificate. [1]: https://developer.apple.com/documentation/security/1400622-sectrustedapplicationcreatefromp?language=objc https://developer.apple.com/documentation/security/1400622-s...