5 ms·
Apple did one thing very well: they ask for a password when doing something potentially harmful, but made sure that the password popup is rare enough that you w
by speleding 15y ago
Apple did one thing very well: they ask for a password when doing something potentially harmful, but made sure that the password popup is rare enough that you won't be trained to blindly fill it in.
That one thing has more security value than any of the advanced security techniques listed in the article like "stack canaries" and "fine grained ACL".
It's too bad there are so many security consultants that focus on the technology instead of user behaviour. If they would just look at the statistics they'd see that >90% of security issues are not technology issues, they are behavioural issues.
Sure, it would be nice to have a few of those advanced security techniques in OS X if they don't cause too much usability or performance issues, but it will have very little effect on security as a whole.
- comex 15y agoHowever, you only need the password if you want to be root, and most of the stuff malware wants to do (including keylogging, which the article mentions; requiring root to intercept keyboards is only moderately useful if the regular user can gdb -p whatever app has the password field) does not require being root.
- X-Istence 15y agoIf you want to attach a debugger to a program in OS X you are required to be in a developer group, and it will ask you for a password. See: http://i.imgur.com/l6Ntz.png http://i.imgur.com/l6Ntz.png
- comex 15y agoOh, is this new in Lion or something? I've never seen that prompt before. (But in any case, there are other options such as clever use of DYLD_INSERT_LIBRARIES.)