5 ms·

Frankly, if all you do is create a separate administrator user, leaving your day to day account as standard, and enable disk encryption, you’re going to be so m

by ttul 5y ago

Frankly, if all you do is create a separate administrator user, leaving your day to day account as standard, and enable disk encryption, you’re going to be so much more secure than the default target. Encryption is super important because it secures your data in case your machine is stolen. There is an active market for identity data from stolen hard disks; don’t be that victim. It sucks.

kccqzy 5y ago
I've done this for several years now. I also value this approach for psychological reasons: whenever you do need to perform some sysadmin action, you invariably need to type the password for the admin account rather than your usual login or unlock password. This different password is enough to make me pause and think whether this administrative action is really worth doing.
dmix 5y ago
> Encryption is super important because it secures your data in case your machine is stolen. If your machine is stolen and off* I always turn my computer(s) and phone off before entering airports and other similar areas. They can ask me before Cellebriting them. Not that I've ever done anything wrong, it's just for the ethics of it all. Privacy is critically important.
- burlesona 5y ago
  Also, I've witnessed first hand someone come into a cafe I where I was working, walk up to another person who was on their laptop, snatch the open laptop as the person was typing on it, and bolt out into a waiting getaway car. That laptop was fully open and logged into everything. This is obviously a rare case but it just goes to show that you can have pretty darn good security and there are still attack vectors that you won't be hardened against.
  - codetrotter 5y ago
    I’ve been thinking it’d be neat to have a program running that watches the web camera continuously and if you look away from the screen then it locks the computer after 1 minute. And if you disappear from the image it locks it immediately. This would also immediately lock the computer in the case of someone snatching it from you, even though the main use case I had in mind is just for falling asleep and for leaving the room. Dunno if it’d drain too much battery. Also having the camera active indicator led glow all the time would be annoying. And it would also mean that you unfortunately no longer know if other software on your computer is recording your face while you are sitting there.
    - ccheney 5y ago
      Perhaps tie into bluetooth instead. If your Watch or iPhone goes out of range, lock the machine.
      - poorman 5y ago
        Perhaps an accelerometer for when it's snatched quickly.
      - toxik 5y ago
        Should actually be pretty easy to implement
      - finnh 5y ago
        Unlox app does this - its primary feature is to use FaceID on an iPhone to unlock a mac, but it also has an AutoLock feature if said phone goes out of bluetooth range. The signal level threshold is configurable so you can keep it on a pretty short leash. (no relation, just a happy customer)
        cdubzzz 5y ago
        That is intriguing -- but I don't love the "enter your computer password in the app" part. Can it be configured to _not_ do that -- i.e. only do the "AutoLock" part?
  - xvector 5y ago
    When I was in college, someone did this with my phone. Luckily, they gave it back a minute later - perhaps because I made a ruckus, and perhaps because they felt bad about robbing a student, who knows. Still, it made me pretty uncomfortable using devices in public after that. For all the effort we put into cybersecurity, our measures are trivially defeated by a common thug. Even YubiKeys securing all your accounts wouldn’t do much to protect you from this.
    - alexhutcheson 5y ago
      Relevant XKCD: https://xkcd.com/538/ https://xkcd.com/538/
      - dmix 5y ago
        how is that relevant here and not other comments here?
  - miles 5y ago
    See BLEUnlock[1] for a simple Bluetooth proximity lock solution for macOS or BusKill[2] for a cross-platform wired solution. [1] https://github.com/ts1/BLEUnlock https://github.com/ts1/BLEUnlock [2] https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-kill-cord-dead-man-switch/ https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-k...
- outime 5y ago
  >Not that I've ever done anything wrong, ... When you see that people need to write this disclaimer even on this website it feels like the privacy ship has long sailed.
- ilikepi 5y ago
  >> Encryption is super important because it secures your data in case your machine is stolen. > If your machine is stolen and off* It's possible to configure macOS to wipe FileVault keys from memory when transitioning to a hibernation state. Assuming this works as designed, it might help in a snatch-and-grab situation if the thief closed the lid of the laptop. I would assume competent LEAs would take measures to keep their target's machine awake however.
- acdha 5y ago
  > If your machine is stolen and off* Locked. macOS has used the IOMMU to block access to RAM from external devices for many years and on the newer Macs you’d need to compromise the T2 as well.
  - dmix 5y ago
    Five-eyes nation states probably had that long ago https://www.zdnet.com/article/hackers-claim-they-can-now-jailbreak-apples-t2-security-chip/ https://www.zdnet.com/article/hackers-claim-they-can-now-jai...
    - acdha 5y ago
      Five Eyes is a signals intelligence cooperative — they’re not grabbing your laptop at Starbucks. That brings me to the second part of why this fear mongering is pointless: if the black-bag types are interested in you, they’re going to use the password they recorded you entering when you last turned it on or just hold you until you unlock it. If your threat model includes state-level force, you’re way outside of what consumer electronics can help you with. For most people, the risk is more along the lines of whether someone who steals your backpack can cash out relatively quickly. Needing a complex exploit chain is not a high risk there - and, again, if you’re carrying something that valuable I’d be thinking more about the odds of them forcing you to unlock it. Finally, the article you linked is talking about a jail break exploit: notably neither checkm8 or checkra1n will help you if you don’t already know the device password.
someonehere 5y ago
A well known macOS It developer created an app that can give you admin rights and take them away with an app. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges Essentially you can still be the admin on your account but this app can make you a general user. When you need to install anything, run the app and grant yourself temporary admin rights. If you deploy this to employees with a management system, you can define default reversion to general user. It addresses the need to not allow users to be admins all the time, grants only when the need it for installation.
- nulld3v 5y ago
  Interesting, sounds like graphical sudo.

by ttul 5y ago

kccqzy 5y ago

I've done this for several years now. I also value this approach for psychological reasons: whenever you do need to perform some sysadmin action, you invariably need to type the password for the admin account rather than your usual login or unlock password. This different password is enough to make me pause and think whether this administrative action is really worth doing.

dmix 5y ago

> Encryption is super important because it secures your data in case your machine is stolen. If your machine is stolen and off* I always turn my computer(s) and phone off before entering airports and other similar areas. They can ask me before Cellebriting them. Not that I've ever done anything wrong, it's just for the ethics of it all. Privacy is critically important.

burlesona 5y ago
Also, I've witnessed first hand someone come into a cafe I where I was working, walk up to another person who was on their laptop, snatch the open laptop as the person was typing on it, and bolt out into a waiting getaway car. That laptop was fully open and logged into everything. This is obviously a rare case but it just goes to show that you can have pretty darn good security and there are still attack vectors that you won't be hardened against.
- codetrotter 5y ago
  I’ve been thinking it’d be neat to have a program running that watches the web camera continuously and if you look away from the screen then it locks the computer after 1 minute. And if you disappear from the image it locks it immediately. This would also immediately lock the computer in the case of someone snatching it from you, even though the main use case I had in mind is just for falling asleep and for leaving the room. Dunno if it’d drain too much battery. Also having the camera active indicator led glow all the time would be annoying. And it would also mean that you unfortunately no longer know if other software on your computer is recording your face while you are sitting there.
  - ccheney 5y ago
    Perhaps tie into bluetooth instead. If your Watch or iPhone goes out of range, lock the machine.
    - poorman 5y ago
      Perhaps an accelerometer for when it's snatched quickly.
    - toxik 5y ago
      Should actually be pretty easy to implement
    - finnh 5y ago
      Unlox app does this - its primary feature is to use FaceID on an iPhone to unlock a mac, but it also has an AutoLock feature if said phone goes out of bluetooth range. The signal level threshold is configurable so you can keep it on a pretty short leash. (no relation, just a happy customer)
      - cdubzzz 5y ago
        That is intriguing -- but I don't love the "enter your computer password in the app" part. Can it be configured to _not_ do that -- i.e. only do the "AutoLock" part?
- xvector 5y ago
  When I was in college, someone did this with my phone. Luckily, they gave it back a minute later - perhaps because I made a ruckus, and perhaps because they felt bad about robbing a student, who knows. Still, it made me pretty uncomfortable using devices in public after that. For all the effort we put into cybersecurity, our measures are trivially defeated by a common thug. Even YubiKeys securing all your accounts wouldn’t do much to protect you from this.
  - alexhutcheson 5y ago
    Relevant XKCD: https://xkcd.com/538/ https://xkcd.com/538/
    - dmix 5y ago
      how is that relevant here and not other comments here?
- miles 5y ago
  See BLEUnlock[1] for a simple Bluetooth proximity lock solution for macOS or BusKill[2] for a cross-platform wired solution. [1] https://github.com/ts1/BLEUnlock https://github.com/ts1/BLEUnlock [2] https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-kill-cord-dead-man-switch/ https://tech.michaelaltfield.net/2020/01/02/buskill-laptop-k...
outime 5y ago
>Not that I've ever done anything wrong, ... When you see that people need to write this disclaimer even on this website it feels like the privacy ship has long sailed.
ilikepi 5y ago
>> Encryption is super important because it secures your data in case your machine is stolen. > If your machine is stolen and off* It's possible to configure macOS to wipe FileVault keys from memory when transitioning to a hibernation state. Assuming this works as designed, it might help in a snatch-and-grab situation if the thief closed the lid of the laptop. I would assume competent LEAs would take measures to keep their target's machine awake however.
acdha 5y ago
> If your machine is stolen and off* Locked. macOS has used the IOMMU to block access to RAM from external devices for many years and on the newer Macs you’d need to compromise the T2 as well.
- dmix 5y ago
  Five-eyes nation states probably had that long ago https://www.zdnet.com/article/hackers-claim-they-can-now-jailbreak-apples-t2-security-chip/ https://www.zdnet.com/article/hackers-claim-they-can-now-jai...
  - acdha 5y ago
    Five Eyes is a signals intelligence cooperative — they’re not grabbing your laptop at Starbucks. That brings me to the second part of why this fear mongering is pointless: if the black-bag types are interested in you, they’re going to use the password they recorded you entering when you last turned it on or just hold you until you unlock it. If your threat model includes state-level force, you’re way outside of what consumer electronics can help you with. For most people, the risk is more along the lines of whether someone who steals your backpack can cash out relatively quickly. Needing a complex exploit chain is not a high risk there - and, again, if you’re carrying something that valuable I’d be thinking more about the odds of them forcing you to unlock it. Finally, the article you linked is talking about a jail break exploit: notably neither checkm8 or checkra1n will help you if you don’t already know the device password.

someonehere 5y ago

A well known macOS It developer created an app that can give you admin rights and take them away with an app. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges Essentially you can still be the admin on your account but this app can make you a general user. When you need to install anything, run the app and grant yourself temporary admin rights. If you deploy this to employees with a management system, you can define default reversion to general user. It addresses the need to not allow users to be admins all the time, grants only when the need it for installation.

nulld3v 5y ago
Interesting, sounds like graphical sudo.