8 ms·

Hardening macOS (2018)

149 points by nomoreplease 5y ago

klodolph 5y ago
This is a nice starting point. It seems like it was written from someone who's fairly paranoid (not trying to judge the value or correctness of paranoia, here), which means that it's not too hard to customize it--if you are less paranoid, skip some of these steps.
ttul 5y ago
Frankly, if all you do is create a separate administrator user, leaving your day to day account as standard, and enable disk encryption, you’re going to be so much more secure than the default target. Encryption is super important because it secures your data in case your machine is stolen. There is an active market for identity data from stolen hard disks; don’t be that victim. It sucks.
- kccqzy 5y ago
  I've done this for several years now. I also value this approach for psychological reasons: whenever you do need to perform some sysadmin action, you invariably need to type the password for the admin account rather than your usual login or unlock password. This different password is enough to make me pause and think whether this administrative action is really worth doing.
- dmix 5y ago
  > Encryption is super important because it secures your data in case your machine is stolen. If your machine is stolen and off* I always turn my computer(s) and phone off before entering airports and other similar areas. They can ask me before Cellebriting them. Not that I've ever done anything wrong, it's just for the ethics of it all. Privacy is critically important.
  - burlesona 5y ago
    Also, I've witnessed first hand someone come into a cafe I where I was working, walk up to another person who was on their laptop, snatch the open laptop as the person was typing on it, and bolt out into a waiting getaway car. That laptop was fully open and logged into everything. This is obviously a rare case but it just goes to show that you can have pretty darn good security and there are still attack vectors that you won't be hardened against.
    - codetrotter 5y ago
      I’ve been thinking it’d be neat to have a program running that watches the web camera continuously and if you look away from the screen then it locks the computer after 1 minute. And if you disappear from the image it locks it immediately. This would also immediately lock the computer in the case of someone snatching it from you, even though the main use case I had in mind is just for falling asleep and for leaving the room. Dunno if it’d drain too much battery. Also having the camera active indicator led glow all the time would be annoying. And it would also mean that you unfortunately no longer know if other software on your computer is recording your face while you are sitting there.
      - ccheney 5y ago
        Perhaps tie into bluetooth instead. If your Watch or iPhone goes out of range, lock the machine.
        poorman 5y ago
        Perhaps an accelerometer for when it's snatched quickly.
        toxik 5y ago
        Should actually be pretty easy to implement
        finnh 5y ago
        Unlox app does this - its primary feature is to use FaceID on an iPhone to unlock a mac, but it also has an AutoLock feature if said phone goes out of bluetooth range. The signal level threshold is configurable so you can keep it on a pretty short leash. (no relation, just a happy customer)
  - outime 5y ago
    >Not that I've ever done anything wrong, ... When you see that people need to write this disclaimer even on this website it feels like the privacy ship has long sailed.
  - ilikepi 5y ago
    >> Encryption is super important because it secures your data in case your machine is stolen. > If your machine is stolen and off* It's possible to configure macOS to wipe FileVault keys from memory when transitioning to a hibernation state. Assuming this works as designed, it might help in a snatch-and-grab situation if the thief closed the lid of the laptop. I would assume competent LEAs would take measures to keep their target's machine awake however.
  - acdha 5y ago
    > If your machine is stolen and off* Locked. macOS has used the IOMMU to block access to RAM from external devices for many years and on the newer Macs you’d need to compromise the T2 as well.
    - dmix 5y ago
      Five-eyes nation states probably had that long ago https://www.zdnet.com/article/hackers-claim-they-can-now-jailbreak-apples-t2-security-chip/ https://www.zdnet.com/article/hackers-claim-they-can-now-jai...
      - acdha 5y ago
        Five Eyes is a signals intelligence cooperative — they’re not grabbing your laptop at Starbucks. That brings me to the second part of why this fear mongering is pointless: if the black-bag types are interested in you, they’re going to use the password they recorded you entering when you last turned it on or just hold you until you unlock it. If your threat model includes state-level force, you’re way outside of what consumer electronics can help you with. For most people, the risk is more along the lines of whether someone who steals your backpack can cash out relatively quickly. Needing a complex exploit chain is not a high risk there - and, again, if you’re carrying something that valuable I’d be thinking more about the odds of them forcing you to unlock it. Finally, the article you linked is talking about a jail break exploit: notably neither checkm8 or checkra1n will help you if you don’t already know the device password.
- someonehere 5y ago
  A well known macOS It developer created an app that can give you admin rights and take them away with an app. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges Essentially you can still be the admin on your account but this app can make you a general user. When you need to install anything, run the app and grant yourself temporary admin rights. If you deploy this to employees with a management system, you can define default reversion to general user. It addresses the need to not allow users to be admins all the time, grants only when the need it for installation.
  - nulld3v 5y ago
    Interesting, sounds like graphical sudo.
KLVTZ 5y ago
Somewhat related: I always find myself clearing the drive in order to install the latest macOS. Perhaps psychological, but it always gives me a fresh starting point that is benefited by an implicit boost in performance. While it does require some time for setup, and much of what I do is manual, I never regret it --almost like spring cleaning.
- mtmail 5y ago
  I keep a file listing software I installed and my usual settings I need to set. Some 30 packages, including UI tools. The homebrew package installer supports a 'Brewfile' which will install everything in one step. https://thoughtbot.com/blog/brewfile-a-gemfile-but-for-homebrew https://thoughtbot.com/blog/brewfile-a-gemfile-but-for-homeb...
  - deleted 5y ago
    [deleted]
- mulmen 5y ago
  Maybe I am getting old but I find “starting fresh” to be extremely expensive. I recently had to do this with my work MacBook which cannot restore from Time Machine for... reasons. I don’t know what settings I changed six months or a year or four years ago. I just know that my mouse should scroll that way, not this way. Time Machine makes sure these settings persist between disasters so I don’t generally try to track them. Historically upgrades maintained the settings where they make sense. Over time my environment adapted to my preference. But with the recent more drastic changes in Big Sur (and my fresh start) I find myself constantly having to re-learn really basic things like how to manage notifications. What used to be one click is three, or gestures that used to do one thing (drag right to dismiss) now do something unexpected (dismiss all notifications for an app). I don’t know how much of this is a setting and how much is just new behavior. It has been an infuriating experience. I don’t even know how to use my computer and I feel powerless. I also have very little motivation to learn the “new” way because I know it will just change again in a year. So the time I invest now will be wasted. It’s extremely demoralizing. One of the hardest things I do during the day is try to navigate my desktop environment. I have an adversarial relationship with my MacBook. There’s very little cognitive energy left to do my actual job. I don’t feel like it is improving, my computer is just in my way.
satysin 5y ago
Discussion from the last time this was posted in 2018 - https://news.ycombinator.com/item?id=18099835 https://news.ycombinator.com/item?id=18099835 Also the macOS Security and Privacy Guide may be of interest https://github.com/drduh/macOS-Security-and-Privacy-Guide https://github.com/drduh/macOS-Security-and-Privacy-Guide as discussed on HN last year https://news.ycombinator.com/item?id=24242890 https://news.ycombinator.com/item?id=24242890
- Pokepokalypse 5y ago
  Also there's this: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_11_V1R2_STIG.zip https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Appl...
  - codetrotter 5y ago
    Expired certificate
    - cassianoleal 5y ago
      Also, seriously? A link to a zip file with no context whatsoever in a thread about security?
dmix 5y ago
NSA released a now older OSX hardening PDF, still lots of relevant stuff: https://cirka.net/wiki/_media/macosx_hardening_tips.pdf https://cirka.net/wiki/_media/macosx_hardening_tips.pdf And NIST did a long form one as well for macOS Sierra (10.2) https://csrc.nist.gov/CSRC/media/Publications/sp/800-179/rev-1/draft/documents/sp800-179r1-draft.pdf https://csrc.nist.gov/CSRC/media/Publications/sp/800-179/rev... Hardening operating systems is extremely difficult, I put a ton of research into it, but making it harder for APTs is always valuable. Linux with GRSecurity used to be the gold standard. Not sure what is now. I noticed a lot of "zero days" or vulnerbilities target specific versions of popular software so there may be plenty of security in obscurity just based on the nature of the hacking business. And there's a huge shadowy hacking business if you weren't aware. And as a side note one thing I learned from grugq is that managing your identity online is worth 10 fold than any of this hardening business. Creating fake identities with real back stories and linkedin pages etc. That sort of thing. But that getting a little deep into the "shadowy arts" of the infosec world.
- Wowfunhappy 5y ago
  > NSA released a now older OSX hardening PDF, still lots of relevant stuff: > Disable Unnecessary Services: The following services can be found in /System/Library/ LaunchDaemons. Unless needed for the purpose shown in the second column, disable each service using the command below, which needs the full path specified: sudo launchctl unload -w PathToPlistFile Today, you can't do that unless you disable, well, a different security setting.
  - dmix 5y ago
    Well youre suppose to reenable the security feature blocking you afterwards
    - Wowfunhappy 5y ago
      Oh, I guess you can do that, but then you have to redo the whole rigamarole (three reboots) every time you install an update...
tingletech 5y ago
2018
sarsway 5y ago
Is there any good solution to choosing the admin password? I always hear a strong password is recommended, but this becomes very annoying very fast since you have to type it in quite often, and password managers can't help you here.
- bayindirh 5y ago
  mangle a longish sentence in your head and pepper it with typos, punctuation and numbers. e.g.: h0arseSt@br3bg#terYC0rt5d!t
  - calmaro34 5y ago
    funnily enough now h0arseSt@br3bg#terYC0rt5d!t is a terrible password to use ;)
    - bayindirh 5y ago
      Doesn’t matter. It’s already a variation of a well known password anyway. :)
      - betterq 5y ago
        horse staple battery correct? Now I have to change my password!
        bayindirh 5y ago
        Yep! :) Go, change it. Run!
  - Toutouxc 5y ago
    That's the worst way to create passwords. It's too chaotic, which makes it hard to remember, which forces the user to save it in a password manager (or worse, write it down). And since it's going into the password manager, you can just go full random.
fnord77 5y ago
that's a lot of work. How about some sort of script to do all this?
- memco 5y ago
  Here's a somewhat dated example of such a setup: https://github.com/memco/dotfiles https://github.com/memco/dotfiles. Basically, you just need the install.sh if all you care about is macOS preferences, but you can also add in something like the brewfile so that you can also install your apps. My brewfile leverages MAS so that I can install stuff from the app store in addition to what's available via brew. I haven't automated app preferences, but macOS and apps are just a clone, `./install.sh && brew bundle --file Brewfile` away.
- sinxccc 5y ago
  Use a one-click script to secure your computer is worse than do nothing.
  - fnord77 5y ago
    an IT dept is not going to do all this manually on hundreds of laptops.
deleted 5y ago
[deleted]
comboy 5y ago
And then you just brew install this-will-solve-my problem with 782 dependencies.
mixmastamyk 5y ago
Got a newer Mac from work and upgraded it to Big Sur—Big mistake. If I hadn't installed Little Snitch from a recommendation here I'd have not known it runs dozens of chatty network services by default with no way to disable them. Many communicating and uploading metrics to services like icloud and local bonjour, whether you use them or not. Not only that, but with the system volume is read only, so there is no obvious way to disable them from running without defeating other security. Any tips to disable these easily on the latest OS? All in all for company that touts privacy, I found it all a bit shocking really.
- aaomidi 5y ago
  This is how the OCSP standard works. It needs to be chatty.
  - sneak 5y ago
    The OS is extremely chatty even without OCSP.
  - mixmastamyk 5y ago
    Dozens was highlighted.
- smoldesu 5y ago
  That's always been one of my biggest gripes with Apple. Their security theater was particularly convincing for a while, but in recent years it's been going downhill, hard. The T2 chip was dedicated hardware for a prng generator, the "secure enclave" is based on technology that has been cracked for years, and their team actively ignores security researchers who report vulnerabilities to them. It's definitely one of the deciding factors keeping me on Linux.
- Klonoar 5y ago
  Much of what you're attributing to Big Sur existed in Catalina.
- sneak 5y ago
  Here's documentation of all of the stuff it talks to, if anyone's curious: https://sneak.berlin/20210202/macos-11.2-network-privacy/ https://sneak.berlin/20210202/macos-11.2-network-privacy/ (pcaps linked in the post, too.)
floatingatoll 5y ago
Some of these are good advice if you prioritize security over usability, as some legitimately need to do. Some of these have nothing at all to do with "Hardening macOS" and will have no measurable effect on security whatsoever, especially when state attackers are excluded from consideration (as the page itself states). Why are these things mixed together into a single guide? Or, to present one specific example of this mixed-messages issue: How precisely does the listed step "Disable Crash Reporter" harden macOS against being attacked, when nation-states are excluded from consideration?

149 points by nomoreplease 5y ago

This is a nice starting point. It seems like it was written from someone who's fairly paranoid (not trying to judge the value or correctness of paranoia, here), which means that it's not too hard to customize it--if you are less paranoid, skip some of these steps.

ttul 5y ago

Frankly, if all you do is create a separate administrator user, leaving your day to day account as standard, and enable disk encryption, you’re going to be so much more secure than the default target. Encryption is super important because it secures your data in case your machine is stolen. There is an active market for identity data from stolen hard disks; don’t be that victim. It sucks.

kccqzy 5y ago
I've done this for several years now. I also value this approach for psychological reasons: whenever you do need to perform some sysadmin action, you invariably need to type the password for the admin account rather than your usual login or unlock password. This different password is enough to make me pause and think whether this administrative action is really worth doing.
dmix 5y ago
> Encryption is super important because it secures your data in case your machine is stolen. If your machine is stolen and off* I always turn my computer(s) and phone off before entering airports and other similar areas. They can ask me before Cellebriting them. Not that I've ever done anything wrong, it's just for the ethics of it all. Privacy is critically important.
- burlesona 5y ago
  Also, I've witnessed first hand someone come into a cafe I where I was working, walk up to another person who was on their laptop, snatch the open laptop as the person was typing on it, and bolt out into a waiting getaway car. That laptop was fully open and logged into everything. This is obviously a rare case but it just goes to show that you can have pretty darn good security and there are still attack vectors that you won't be hardened against.
  - codetrotter 5y ago
    I’ve been thinking it’d be neat to have a program running that watches the web camera continuously and if you look away from the screen then it locks the computer after 1 minute. And if you disappear from the image it locks it immediately. This would also immediately lock the computer in the case of someone snatching it from you, even though the main use case I had in mind is just for falling asleep and for leaving the room. Dunno if it’d drain too much battery. Also having the camera active indicator led glow all the time would be annoying. And it would also mean that you unfortunately no longer know if other software on your computer is recording your face while you are sitting there.
    - ccheney 5y ago
      Perhaps tie into bluetooth instead. If your Watch or iPhone goes out of range, lock the machine.
      - poorman 5y ago
        Perhaps an accelerometer for when it's snatched quickly.
      - toxik 5y ago
        Should actually be pretty easy to implement
      - finnh 5y ago
        Unlox app does this - its primary feature is to use FaceID on an iPhone to unlock a mac, but it also has an AutoLock feature if said phone goes out of bluetooth range. The signal level threshold is configurable so you can keep it on a pretty short leash. (no relation, just a happy customer)
- outime 5y ago
  >Not that I've ever done anything wrong, ... When you see that people need to write this disclaimer even on this website it feels like the privacy ship has long sailed.
- ilikepi 5y ago
  >> Encryption is super important because it secures your data in case your machine is stolen. > If your machine is stolen and off* It's possible to configure macOS to wipe FileVault keys from memory when transitioning to a hibernation state. Assuming this works as designed, it might help in a snatch-and-grab situation if the thief closed the lid of the laptop. I would assume competent LEAs would take measures to keep their target's machine awake however.
- acdha 5y ago
  > If your machine is stolen and off* Locked. macOS has used the IOMMU to block access to RAM from external devices for many years and on the newer Macs you’d need to compromise the T2 as well.
  - dmix 5y ago
    Five-eyes nation states probably had that long ago https://www.zdnet.com/article/hackers-claim-they-can-now-jailbreak-apples-t2-security-chip/ https://www.zdnet.com/article/hackers-claim-they-can-now-jai...
    - acdha 5y ago
      Five Eyes is a signals intelligence cooperative — they’re not grabbing your laptop at Starbucks. That brings me to the second part of why this fear mongering is pointless: if the black-bag types are interested in you, they’re going to use the password they recorded you entering when you last turned it on or just hold you until you unlock it. If your threat model includes state-level force, you’re way outside of what consumer electronics can help you with. For most people, the risk is more along the lines of whether someone who steals your backpack can cash out relatively quickly. Needing a complex exploit chain is not a high risk there - and, again, if you’re carrying something that valuable I’d be thinking more about the odds of them forcing you to unlock it. Finally, the article you linked is talking about a jail break exploit: notably neither checkm8 or checkra1n will help you if you don’t already know the device password.
someonehere 5y ago
A well known macOS It developer created an app that can give you admin rights and take them away with an app. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges Essentially you can still be the admin on your account but this app can make you a general user. When you need to install anything, run the app and grant yourself temporary admin rights. If you deploy this to employees with a management system, you can define default reversion to general user. It addresses the need to not allow users to be admins all the time, grants only when the need it for installation.
- nulld3v 5y ago
  Interesting, sounds like graphical sudo.

KLVTZ 5y ago

Somewhat related: I always find myself clearing the drive in order to install the latest macOS. Perhaps psychological, but it always gives me a fresh starting point that is benefited by an implicit boost in performance. While it does require some time for setup, and much of what I do is manual, I never regret it --almost like spring cleaning.

mtmail 5y ago
I keep a file listing software I installed and my usual settings I need to set. Some 30 packages, including UI tools. The homebrew package installer supports a 'Brewfile' which will install everything in one step. https://thoughtbot.com/blog/brewfile-a-gemfile-but-for-homebrew https://thoughtbot.com/blog/brewfile-a-gemfile-but-for-homeb...
- deleted 5y ago
  [deleted]
mulmen 5y ago
Maybe I am getting old but I find “starting fresh” to be extremely expensive. I recently had to do this with my work MacBook which cannot restore from Time Machine for... reasons. I don’t know what settings I changed six months or a year or four years ago. I just know that my mouse should scroll that way, not this way. Time Machine makes sure these settings persist between disasters so I don’t generally try to track them. Historically upgrades maintained the settings where they make sense. Over time my environment adapted to my preference. But with the recent more drastic changes in Big Sur (and my fresh start) I find myself constantly having to re-learn really basic things like how to manage notifications. What used to be one click is three, or gestures that used to do one thing (drag right to dismiss) now do something unexpected (dismiss all notifications for an app). I don’t know how much of this is a setting and how much is just new behavior. It has been an infuriating experience. I don’t even know how to use my computer and I feel powerless. I also have very little motivation to learn the “new” way because I know it will just change again in a year. So the time I invest now will be wasted. It’s extremely demoralizing. One of the hardest things I do during the day is try to navigate my desktop environment. I have an adversarial relationship with my MacBook. There’s very little cognitive energy left to do my actual job. I don’t feel like it is improving, my computer is just in my way.

satysin 5y ago

Discussion from the last time this was posted in 2018 - https://news.ycombinator.com/item?id=18099835 https://news.ycombinator.com/item?id=18099835 Also the macOS Security and Privacy Guide may be of interest https://github.com/drduh/macOS-Security-and-Privacy-Guide https://github.com/drduh/macOS-Security-and-Privacy-Guide as discussed on HN last year https://news.ycombinator.com/item?id=24242890 https://news.ycombinator.com/item?id=24242890

Pokepokalypse 5y ago
Also there's this: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_11_V1R2_STIG.zip https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Appl...
- codetrotter 5y ago
  Expired certificate
  - cassianoleal 5y ago
    Also, seriously? A link to a zip file with no context whatsoever in a thread about security?

dmix 5y ago

NSA released a now older OSX hardening PDF, still lots of relevant stuff: https://cirka.net/wiki/_media/macosx_hardening_tips.pdf https://cirka.net/wiki/_media/macosx_hardening_tips.pdf And NIST did a long form one as well for macOS Sierra (10.2) https://csrc.nist.gov/CSRC/media/Publications/sp/800-179/rev-1/draft/documents/sp800-179r1-draft.pdf https://csrc.nist.gov/CSRC/media/Publications/sp/800-179/rev... Hardening operating systems is extremely difficult, I put a ton of research into it, but making it harder for APTs is always valuable. Linux with GRSecurity used to be the gold standard. Not sure what is now. I noticed a lot of "zero days" or vulnerbilities target specific versions of popular software so there may be plenty of security in obscurity just based on the nature of the hacking business. And there's a huge shadowy hacking business if you weren't aware. And as a side note one thing I learned from grugq is that managing your identity online is worth 10 fold than any of this hardening business. Creating fake identities with real back stories and linkedin pages etc. That sort of thing. But that getting a little deep into the "shadowy arts" of the infosec world.

Wowfunhappy 5y ago
> NSA released a now older OSX hardening PDF, still lots of relevant stuff: > Disable Unnecessary Services: The following services can be found in /System/Library/ LaunchDaemons. Unless needed for the purpose shown in the second column, disable each service using the command below, which needs the full path specified: sudo launchctl unload -w PathToPlistFile Today, you can't do that unless you disable, well, a different security setting.
- dmix 5y ago
  Well youre suppose to reenable the security feature blocking you afterwards
  - Wowfunhappy 5y ago
    Oh, I guess you can do that, but then you have to redo the whole rigamarole (three reboots) every time you install an update...

tingletech 5y ago

2018

sarsway 5y ago

Is there any good solution to choosing the admin password? I always hear a strong password is recommended, but this becomes very annoying very fast since you have to type it in quite often, and password managers can't help you here.

bayindirh 5y ago
mangle a longish sentence in your head and pepper it with typos, punctuation and numbers. e.g.: h0arseSt@br3bg#terYC0rt5d!t
- calmaro34 5y ago
  funnily enough now h0arseSt@br3bg#terYC0rt5d!t is a terrible password to use ;)
  - bayindirh 5y ago
    Doesn’t matter. It’s already a variation of a well known password anyway. :)
    - betterq 5y ago
      horse staple battery correct? Now I have to change my password!
      - bayindirh 5y ago
        Yep! :) Go, change it. Run!
- Toutouxc 5y ago
  That's the worst way to create passwords. It's too chaotic, which makes it hard to remember, which forces the user to save it in a password manager (or worse, write it down). And since it's going into the password manager, you can just go full random.

fnord77 5y ago

that's a lot of work. How about some sort of script to do all this?

memco 5y ago
Here's a somewhat dated example of such a setup: https://github.com/memco/dotfiles https://github.com/memco/dotfiles. Basically, you just need the install.sh if all you care about is macOS preferences, but you can also add in something like the brewfile so that you can also install your apps. My brewfile leverages MAS so that I can install stuff from the app store in addition to what's available via brew. I haven't automated app preferences, but macOS and apps are just a clone, `./install.sh && brew bundle --file Brewfile` away.
sinxccc 5y ago
Use a one-click script to secure your computer is worse than do nothing.
- fnord77 5y ago
  an IT dept is not going to do all this manually on hundreds of laptops.

deleted 5y ago

[deleted]

comboy 5y ago

And then you just brew install this-will-solve-my problem with 782 dependencies.

mixmastamyk 5y ago

Got a newer Mac from work and upgraded it to Big Sur—Big mistake. If I hadn't installed Little Snitch from a recommendation here I'd have not known it runs dozens of chatty network services by default with no way to disable them. Many communicating and uploading metrics to services like icloud and local bonjour, whether you use them or not. Not only that, but with the system volume is read only, so there is no obvious way to disable them from running without defeating other security. Any tips to disable these easily on the latest OS? All in all for company that touts privacy, I found it all a bit shocking really.

aaomidi 5y ago
This is how the OCSP standard works. It needs to be chatty.
- sneak 5y ago
  The OS is extremely chatty even without OCSP.
- mixmastamyk 5y ago
  Dozens was highlighted.
smoldesu 5y ago
That's always been one of my biggest gripes with Apple. Their security theater was particularly convincing for a while, but in recent years it's been going downhill, hard. The T2 chip was dedicated hardware for a prng generator, the "secure enclave" is based on technology that has been cracked for years, and their team actively ignores security researchers who report vulnerabilities to them. It's definitely one of the deciding factors keeping me on Linux.
Klonoar 5y ago
Much of what you're attributing to Big Sur existed in Catalina.
sneak 5y ago
Here's documentation of all of the stuff it talks to, if anyone's curious: https://sneak.berlin/20210202/macos-11.2-network-privacy/ https://sneak.berlin/20210202/macos-11.2-network-privacy/ (pcaps linked in the post, too.)

floatingatoll 5y ago

Some of these are good advice if you prioritize security over usability, as some legitimately need to do. Some of these have nothing at all to do with "Hardening macOS" and will have no measurable effect on security whatsoever, especially when state attackers are excluded from consideration (as the page itself states). Why are these things mixed together into a single guide? Or, to present one specific example of this mixed-messages issue: How precisely does the listed step "Disable Crash Reporter" harden macOS against being attacked, when nation-states are excluded from consideration?