7 ms·

> I chose the example of ~/Library/Safari/LocalStorage because Safari names the files in this directory according to the web sites that you visit! Also note tha

> I chose the example of ~/Library/Safari/LocalStorage because Safari names the files in this directory according to the web sites that you visit! Also note that the output of long format ls -l contains the last modification date of the files. Thus, one possible privacy violation from this technique is to learn the user's web browsing history. Its a pretty serious issue if any random app can read your browsing history. Even more so that Apple hasnt fixed it more than one year after the author reported it.

kzrdude 6y ago
If that is a serious issue, it says a lot about how goalposts have moved the last decades. We haven't been able to expect anything less than every program being able to read all your files.
- Wowfunhappy 6y ago
  I don't necessarily have an issue with the idea that every app I install can read all my files. It's not great, because it forces me to place a lot of trust in every application, but if the alternative is compromising what those apps can do, or bombarding me with security prompts... well, I can see both sides of that argument. However, if we are going to go down the path of compromising functionality and adding lots of annoying prompts, then that strategy had better actually work! If despite all of these annoyances apps can still read my browsing history, that means I also still need to trust every application I install, so I'd definitely prefer we just went back to where we started.
- warkdarrior 6y ago
  From early on, Android had strict separation of files across apps. I would think users are generally aware and expecting that apps do not have full access to all of their data.
  - vorpalhex 6y ago
    So many Android apps immediately request file access because they need it for updates, profiles, etc. Users absolutely blindly grant it because it's such a common permission and give it no second thought. The Android sandbox is a terrible example here.
- sneak 6y ago
  On unix systems that still use a 1970s permissions model, this is true, but it's been fixed on mobile devices for ages, and macOS desktops for over a year (this bug notwithstanding). Ransomware (enabled by bitcoin payments to anonymous recipients) really changed the game on desktop in the last few years. Apple stepped up, but there's crickets on the matter in Windows- and Linux-land, aside from the people who have been containerizing their desktop apps[1]. [1]: https://github.com/jessfraz/dockerfiles/blob/master/chrome/stable/Dockerfile https://github.com/jessfraz/dockerfiles/blob/master/chrome/s...
fbelzile 6y ago
No, not any random app. You knowingly chose to install the app. It either came from the App Store or it was notarized by Apple. There are just so many reasons why software needs to access your hard drive. My app, for example, needs to write files in ~/Library/Application Support/Chrome in order to add native messaging permissions for my extension. Can you imagine the number of "Karens" that are going to email me because they "caught" me trying to "steal their data" if they add restrictions to this folder? Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good. I agree with the blog post. Apple seems to be more focused with "security theatre" right now (or at least half-assed security for the sake of marketing). They do things like add easy-to-implement (via their FileManager class) file access warnings to appease most non-technical users. But at the same time ignore bigger looming threats like apps accessing the Internet. I think the issue isn't the warnings, it's what the warnings are about. Anyway, my guess is that Apple will be adding network access warnings in the future (since it seems they re-wrote a large chunk of the networking code recently) but let's not deny the two-faced marketing speak going on right now and fact that they do stuff like making it impossible to inspect network traffic from Apple apps. The hand-wavy "trust us" argument shouldn't work for Apple either. Why do I have to trust Apple more than a third party developer?
- boogies 6y ago
  > Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good. Browsing history is not sensitive‽
  - codezero 6y ago
    I think they are implying apple can’t control the sensitivity of third party tools across the board, so it’s up to chrome to figure out how to protect your browsing history, and they need to improve their file system layout or APIs to protect their users.
    - 6y ago
dubya 6y ago
Just out of curiosity, is there an allowed way to access directories like this? Sudo doesn't let me see the contents of the ~/Library/Safari directory. Can non-Apple programs access this, like backup programs? Can I bless a script to access this? Can Mozilla or others import bookmarks from Safari any more?
- shuckles 6y ago
  The report shows that given a path, any app can access file metadata or learn that no such file exists outside the sandbox. It does not show access to file data itself. The Safari specific part of the report is data leak caused by the fact that Safari embeds sensitive information (URLs) into file metadata (name). I believe you can access those directories by either enabling Full Disk Access for the process of interest or by disabling System Integrity Protection.
  - dubya 6y ago
    Thanks. "macos full disk access" seem to be the magic keywords for find out about this.

kzrdude 6y ago

If that is a serious issue, it says a lot about how goalposts have moved the last decades. We haven't been able to expect anything less than every program being able to read all your files.

Wowfunhappy 6y ago
I don't necessarily have an issue with the idea that every app I install can read all my files. It's not great, because it forces me to place a lot of trust in every application, but if the alternative is compromising what those apps can do, or bombarding me with security prompts... well, I can see both sides of that argument. However, if we are going to go down the path of compromising functionality and adding lots of annoying prompts, then that strategy had better actually work! If despite all of these annoyances apps can still read my browsing history, that means I also still need to trust every application I install, so I'd definitely prefer we just went back to where we started.
warkdarrior 6y ago
From early on, Android had strict separation of files across apps. I would think users are generally aware and expecting that apps do not have full access to all of their data.
- vorpalhex 6y ago
  So many Android apps immediately request file access because they need it for updates, profiles, etc. Users absolutely blindly grant it because it's such a common permission and give it no second thought. The Android sandbox is a terrible example here.
sneak 6y ago
On unix systems that still use a 1970s permissions model, this is true, but it's been fixed on mobile devices for ages, and macOS desktops for over a year (this bug notwithstanding). Ransomware (enabled by bitcoin payments to anonymous recipients) really changed the game on desktop in the last few years. Apple stepped up, but there's crickets on the matter in Windows- and Linux-land, aside from the people who have been containerizing their desktop apps[1]. [1]: https://github.com/jessfraz/dockerfiles/blob/master/chrome/stable/Dockerfile https://github.com/jessfraz/dockerfiles/blob/master/chrome/s...

fbelzile 6y ago

No, not any random app. You knowingly chose to install the app. It either came from the App Store or it was notarized by Apple. There are just so many reasons why software needs to access your hard drive. My app, for example, needs to write files in ~/Library/Application Support/Chrome in order to add native messaging permissions for my extension. Can you imagine the number of "Karens" that are going to email me because they "caught" me trying to "steal their data" if they add restrictions to this folder? Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good. I agree with the blog post. Apple seems to be more focused with "security theatre" right now (or at least half-assed security for the sake of marketing). They do things like add easy-to-implement (via their FileManager class) file access warnings to appease most non-technical users. But at the same time ignore bigger looming threats like apps accessing the Internet. I think the issue isn't the warnings, it's what the warnings are about. Anyway, my guess is that Apple will be adding network access warnings in the future (since it seems they re-wrote a large chunk of the networking code recently) but let's not deny the two-faced marketing speak going on right now and fact that they do stuff like making it impossible to inspect network traffic from Apple apps. The hand-wavy "trust us" argument shouldn't work for Apple either. Why do I have to trust Apple more than a third party developer?

boogies 6y ago
> Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good. Browsing history is not sensitive‽
- codezero 6y ago
  I think they are implying apple can’t control the sensitivity of third party tools across the board, so it’s up to chrome to figure out how to protect your browsing history, and they need to improve their file system layout or APIs to protect their users.
  - 6y ago

dubya 6y ago

Just out of curiosity, is there an allowed way to access directories like this? Sudo doesn't let me see the contents of the ~/Library/Safari directory. Can non-Apple programs access this, like backup programs? Can I bless a script to access this? Can Mozilla or others import bookmarks from Safari any more?

shuckles 6y ago
The report shows that given a path, any app can access file metadata or learn that no such file exists outside the sandbox. It does not show access to file data itself. The Safari specific part of the report is data leak caused by the fact that Safari embeds sensitive information (URLs) into file metadata (name). I believe you can access those directories by either enabling Full Disk Access for the process of interest or by disabling System Integrity Protection.
- dubya 6y ago
  Thanks. "macos full disk access" seem to be the magic keywords for find out about this.