32 ms·

“Google Drive” would like to receive keystrokes from any application

145 points by bathtub365 7y ago

onreact 7y ago
Intriguing! Can you please provide a bit more of context?
- bathtub365 7y ago
  I wish I could, I just had the dialog pop up out of nowhere while I was using my laptop. I have no idea why it wants this access.
djsumdog 7y ago
So there's no Apple APIs for global shortcuts and apps like Lastpass and Google Drive have to request all keystrokes to implement one? Has this problem been fixed on Wayland? Because I remember it having the same issue.
- jjeaff 7y ago
  That's what I was wondering. I just came across this with the Google calendar API. I was annoyed that the Facebook business appointments gcal sync wanted full access to read all my calendars and any calendars shared with me. All I want is for it to be able to add appts. But apparently, the gcal api doesn't have the granularity to even allow full access to a single calendar.
- tehwebguy 7y ago
  Does anyone know if it can be manually added by the user later?
dudus 7y ago
I guess this is some security model on Catalina. I couldn't find any info on what features of Google drive specifically would not work if you deny but there are plenty of questions online for different applications. Here's one for last pass: https://forums.lastpass.com/viewtopic.php?f=12&t=349965 https://forums.lastpass.com/viewtopic.php?f=12&t=349965
rsync 7y ago
So google drive is also a keylogger ? Not surprising. I wonder - is there a way to look up app permissions without actually installing them ? Which is to say, can I, using my web browser, browse either the apple app store, or google play store, and research, in advance, what a particular app is going to request (or demand) access to ?
- dessant 7y ago
  I doubt Google Drive is a keylogger. Apps should be able to register global shortcuts and get notified when a shortcut is triggered. There is an open source client app for Google Play called Aurora Store, it lists declared permissions and known trackers within the app. The data is provided by Exodus Privacy: https://reports.exodus-privacy.eu.org/en/reports/com.google.android.apps.docs/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.google....
d33 7y ago
Isn't it just badly implemented shortcut support?
limeblack 7y ago
Bad keyboard shortcut or bad drag and drop support maybe?
dortmunder13 7y ago
Lastpass says: "The app needs this permission to provide a global, system-wide shortcut to bring up the search field, so that users can quickly locate a vault entry and copy passwords or launch sites. You can deny this permission request, as the Mac application will continue to work. It will just disable this function from working." I bet it's similar here, they want a system-wide shortcut to get to google drive. Seems like an oddly named permission.
- inetknght 7y ago
  A system-wide shortcut to get to something which other applications aren't able to use is a Bad Thing. For example: if you're in Notepad, how do you save your file to Google Drive? Or for example: if you're in Notepad, why do you need your password?
  - dan-robertson 7y ago
    On the other hand it’s hard to predict all the ways a feature might be used so why restrict it’s flexibility to your own imagination.
- mirthflat83 7y ago
  I like how they named it. If you can get permission for systemwide keystrokes it is also obviously able to see what you’re typing in other apps. More straightforward for those who are not tech oriented.
  - jjeaff 7y ago
    But why would that permission be needed at all for this use case? Is there not a simple "allow us to create a keyboard shortcut" permission?
  - sukilot 7y ago
    Only because MacOS doesn't provide a more specific shortcut functionality. It should let an app register the specific keystrokes to get notified by, and doesn't need to notify which app was foreground when the shortcut was invoked.
teamspirit 7y ago
I don't understand, I use skhd [0] which uses global shortcuts for things like window switching and I've never seen such a request. Unless asking for accessibility permission is the same thing, which I doubt (but admittedly don't know for certain). [0] https://github.com/koekeishiya/skhd https://github.com/koekeishiya/skhd
- sukilot 7y ago
  Accessibilty is even more powerful/general control than this. https://www.howtogeek.com/297083/why-do-some-mac-apps-need-to-control-this-computer-using-accessibility-features/ https://www.howtogeek.com/297083/why-do-some-mac-apps-need-t...
  - teamspirit 7y ago
    Indeed it is. I clearly had it confused. Thanks!
mistersys 7y ago
This is really just an example of the impressive security policies of macOS, if I'm not mistaken as long as you have admin permissions you can trivially create a keylogger on Windows 10 without any such special permissions.
- Loranubi 7y ago
  Well if you have admin permissions, you should be allowed to do anything.
  - acdha 7y ago
    That philosophy has been very helpful to malware authors over the years. The modern approach has been to make that less of a binary decision and make sure the user can see it happening and change their mind: e.g. allow you to write an app which does something privileged but require a prompt and prevent it from hiding its actions.
dorianmariefr 7y ago
also happened to me on a random game downloaded from the App Store: https://i.imgur.com/dr0YVVG.png https://i.imgur.com/dr0YVVG.png
- ThePowerOfFuet 7y ago
  You should let Apple know about that at iTunesStoreSupport@apple.com.
coding123 7y ago
History catching up to today's security environment. This is also how permissions and APIs evolve over time. Apple (and hopefully other OSes) is likely working on a global hotkey hook system, that has a less intrusive permission requirement. Unfortunately it will take YEARs before applications in general start using that. And this is Absolutely the correct thing for the OS to do.
therealmarv 7y ago
I strongly suggest this alternative software for the desktop: https://www.insynchq.com/ https://www.insynchq.com/ Worth every penny and is (for me) the better Desktop client.
floatingatoll 7y ago
Using dynamic overriding to intercept and NSLog calls to UIKeyCommand should be sufficient to find out precisely what key(s) they’re setting listeners for, but I don’t have the experience to finish this idea. Someone who’s familiar with dylib injecting would know: https://stackoverflow.com/a/27608606 https://stackoverflow.com/a/27608606

145 points by bathtub365 7y ago

onreact 7y ago

Intriguing! Can you please provide a bit more of context?

bathtub365 7y ago
I wish I could, I just had the dialog pop up out of nowhere while I was using my laptop. I have no idea why it wants this access.

djsumdog 7y ago

So there's no Apple APIs for global shortcuts and apps like Lastpass and Google Drive have to request all keystrokes to implement one? Has this problem been fixed on Wayland? Because I remember it having the same issue.

jjeaff 7y ago
That's what I was wondering. I just came across this with the Google calendar API. I was annoyed that the Facebook business appointments gcal sync wanted full access to read all my calendars and any calendars shared with me. All I want is for it to be able to add appts. But apparently, the gcal api doesn't have the granularity to even allow full access to a single calendar.
tehwebguy 7y ago
Does anyone know if it can be manually added by the user later?

dudus 7y ago

I guess this is some security model on Catalina. I couldn't find any info on what features of Google drive specifically would not work if you deny but there are plenty of questions online for different applications. Here's one for last pass: https://forums.lastpass.com/viewtopic.php?f=12&t=349965 https://forums.lastpass.com/viewtopic.php?f=12&t=349965

rsync 7y ago

So google drive is also a keylogger ? Not surprising. I wonder - is there a way to look up app permissions without actually installing them ? Which is to say, can I, using my web browser, browse either the apple app store, or google play store, and research, in advance, what a particular app is going to request (or demand) access to ?

dessant 7y ago
I doubt Google Drive is a keylogger. Apps should be able to register global shortcuts and get notified when a shortcut is triggered. There is an open source client app for Google Play called Aurora Store, it lists declared permissions and known trackers within the app. The data is provided by Exodus Privacy: https://reports.exodus-privacy.eu.org/en/reports/com.google.android.apps.docs/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.google....

d33 7y ago

Isn't it just badly implemented shortcut support?

limeblack 7y ago

Bad keyboard shortcut or bad drag and drop support maybe?

dortmunder13 7y ago

Lastpass says: "The app needs this permission to provide a global, system-wide shortcut to bring up the search field, so that users can quickly locate a vault entry and copy passwords or launch sites. You can deny this permission request, as the Mac application will continue to work. It will just disable this function from working." I bet it's similar here, they want a system-wide shortcut to get to google drive. Seems like an oddly named permission.

inetknght 7y ago
A system-wide shortcut to get to something which other applications aren't able to use is a Bad Thing. For example: if you're in Notepad, how do you save your file to Google Drive? Or for example: if you're in Notepad, why do you need your password?
- dan-robertson 7y ago
  On the other hand it’s hard to predict all the ways a feature might be used so why restrict it’s flexibility to your own imagination.
mirthflat83 7y ago
I like how they named it. If you can get permission for systemwide keystrokes it is also obviously able to see what you’re typing in other apps. More straightforward for those who are not tech oriented.
- jjeaff 7y ago
  But why would that permission be needed at all for this use case? Is there not a simple "allow us to create a keyboard shortcut" permission?
- sukilot 7y ago
  Only because MacOS doesn't provide a more specific shortcut functionality. It should let an app register the specific keystrokes to get notified by, and doesn't need to notify which app was foreground when the shortcut was invoked.

teamspirit 7y ago

I don't understand, I use skhd [0] which uses global shortcuts for things like window switching and I've never seen such a request. Unless asking for accessibility permission is the same thing, which I doubt (but admittedly don't know for certain). [0] https://github.com/koekeishiya/skhd https://github.com/koekeishiya/skhd

sukilot 7y ago
Accessibilty is even more powerful/general control than this. https://www.howtogeek.com/297083/why-do-some-mac-apps-need-to-control-this-computer-using-accessibility-features/ https://www.howtogeek.com/297083/why-do-some-mac-apps-need-t...
- teamspirit 7y ago
  Indeed it is. I clearly had it confused. Thanks!

mistersys 7y ago

This is really just an example of the impressive security policies of macOS, if I'm not mistaken as long as you have admin permissions you can trivially create a keylogger on Windows 10 without any such special permissions.

Loranubi 7y ago
Well if you have admin permissions, you should be allowed to do anything.
- acdha 7y ago
  That philosophy has been very helpful to malware authors over the years. The modern approach has been to make that less of a binary decision and make sure the user can see it happening and change their mind: e.g. allow you to write an app which does something privileged but require a prompt and prevent it from hiding its actions.

dorianmariefr 7y ago

also happened to me on a random game downloaded from the App Store: https://i.imgur.com/dr0YVVG.png https://i.imgur.com/dr0YVVG.png

ThePowerOfFuet 7y ago
You should let Apple know about that at iTunesStoreSupport@apple.com.

coding123 7y ago

History catching up to today's security environment. This is also how permissions and APIs evolve over time. Apple (and hopefully other OSes) is likely working on a global hotkey hook system, that has a less intrusive permission requirement. Unfortunately it will take YEARs before applications in general start using that. And this is Absolutely the correct thing for the OS to do.

therealmarv 7y ago

I strongly suggest this alternative software for the desktop: https://www.insynchq.com/ https://www.insynchq.com/ Worth every penny and is (for me) the better Desktop client.

floatingatoll 7y ago

Using dynamic overriding to intercept and NSLog calls to UIKeyCommand should be sufficient to find out precisely what key(s) they’re setting listeners for, but I don’t have the experience to finish this idea. Someone who’s familiar with dylib injecting would know: https://stackoverflow.com/a/27608606 https://stackoverflow.com/a/27608606