5 ms·

There used to be a line of thinking in the capability-based security world which said "combine designation with authority". In other words, instead of a 2-step

There used to be a line of thinking in the capability-based security world which said "combine designation with authority". In other words, instead of a 2-step UX like this: (run as admin) + (let app do any admin type thing) Your system should have multiple explicit 1-step UXs: (let app do admin thing X) The later will presumably present a more clear explanation to the user of what they are doing. Of course, no Real(tm) capability-based GUIs have ever been built to my knowledge, not even in academia, so this is an entirely theoretical argument and not a criticism of Apple.

Someone 4y ago
For things that, historically, didn’t require any additional authentication, both macOS and iOS are moving in that direction, I think. On MacOS, applications by default don’t have the right to read your disk and show a list of files, they have the right to ask the OS to show a dialog that reads your disk shows a list of files, lets you pick one, and then grants that application the right to read that one file. Similarly, for saving files, the save dialog runs under OS control, and grants an application to write a single ‘file’ (which, on macOS, could be a directory containing multiple files) Similarly, on iOS, apps can’t read photos, but can ask the OS to show a photo picker. MacOS (¿still?) has system preferences that allow users to disable such checks, though, granting full file access to certain apps, for example, and also will ask users to grant apps the right to read entire file systems when they try to do so.
- xoa 4y ago
  >MacOS (¿still?) has system preferences that allow users to disable such checks, though, granting full file access to certain apps, for example, and also will ask users to grant apps the right to read entire file systems when they try to do so. Yes you can still disable a lot of this stuff. But I wonder if this is a case where a hardware aspect could let Apple make that less necessary without degrading UI. In principle, with cryptographic signing for input peripherals keyboard/trackpad/mouse/etc, secure processing element routing through it, and the right low level protected kernel support and signed stack, it would be possible to have the OS be able to distinguish between "operator initiated" and "automated" access at a fairly granular level. It'd even be possible to pass that on from one Apple system (or others if it was a standard) to remote ones via SSH or the like. That in turn could enable the system to have different UX between the two classes. For example like a some other HNers I assume I currently grant Terminal full disk access right out of the box as one of my first setup steps just because it's a real irritation to not be able to navigate around and use it from the CLI as I expect without GUI stuff popping up. But instead a system could transparently make it so that when I typed in commands into the shell they'd actually be treated with different permissions than if an automated shell script did the exact same commands, and this could be the case everywhere with a high degree of security. Much more intelligent granting of capabilities would make the UX a lot less irksome and could help push a request for human attention and decision making from the default to the unusual, and that in turn would encourage leaving it on. I think Apple does already do this to some extent actually? Like, in a native widget GUI app, if the user initiates the GUI open/save file finder they're able to navigate to places outside the sandbox? I might be misremembering. But at any rate extending that as a low level hardware backed feature could be an important step in capabilities usability. Security has to have its costs in line with perceived benefits, or users will just end up degrading it (classic "just write the password on a sticky note leave it on the monitor" issue). The human element isn't a bug it's a core requirement, so would really like to see more effort on that side of things as well.
emodendroket 4y ago
iOS does pester me all the time about whether I want to allow this or that app to use my location.
- letitbeirie 4y ago
  Whenever an app that has no business knowing my location asks for it, I always wish that iOS "Always Share/Share While Using/Share Once" modal had the additional option "Share Fake Location." I get why it doesn't (the problems it would cause for Uber and DraftKings immediately come to mind) but the more sketchy advertisers there are who want to track my location data, the more I want that data to be garbage.
  - jeromegv 4y ago
    There’s “less precise” which isn’t quite the same but also helps to not target all the way on top of your home and is more city wide accurate.
    - callalex 4y ago
      But that still informs the app of your choice, and many will disable themselves until you grant the precise location permission.
narrator 4y ago
Newer android prompts before apps are allowed to do things like access location and files.
provenance 4y ago
> "combine designation with authority" This is a fantastic comment for someone (like me) hungry to learn about security concepts. Do you have any more pointers to useful info about security topics?
- ryanjshaw 4y ago
  Security is a pretty broad topic and it's not really my speciality I'm afraid. That being said, I used to be very interested in capability-based security because it promised solutions to so many security problems but nobody seemed to know about the ideas, and the people who had heard the term often had significant misunderstandings of what was possible with capabilities. It's been about 20 years but I mostly had it right ;) "No designation without authority" This is a great place to start: https://srl.cs.jhu.edu/pubs/SRL2003-02.pdf https://srl.cs.jhu.edu/pubs/SRL2003-02.pdf

Someone 4y ago

For things that, historically, didn’t require any additional authentication, both macOS and iOS are moving in that direction, I think. On MacOS, applications by default don’t have the right to read your disk and show a list of files, they have the right to ask the OS to show a dialog that reads your disk shows a list of files, lets you pick one, and then grants that application the right to read that one file. Similarly, for saving files, the save dialog runs under OS control, and grants an application to write a single ‘file’ (which, on macOS, could be a directory containing multiple files) Similarly, on iOS, apps can’t read photos, but can ask the OS to show a photo picker. MacOS (¿still?) has system preferences that allow users to disable such checks, though, granting full file access to certain apps, for example, and also will ask users to grant apps the right to read entire file systems when they try to do so.

xoa 4y ago
>MacOS (¿still?) has system preferences that allow users to disable such checks, though, granting full file access to certain apps, for example, and also will ask users to grant apps the right to read entire file systems when they try to do so. Yes you can still disable a lot of this stuff. But I wonder if this is a case where a hardware aspect could let Apple make that less necessary without degrading UI. In principle, with cryptographic signing for input peripherals keyboard/trackpad/mouse/etc, secure processing element routing through it, and the right low level protected kernel support and signed stack, it would be possible to have the OS be able to distinguish between "operator initiated" and "automated" access at a fairly granular level. It'd even be possible to pass that on from one Apple system (or others if it was a standard) to remote ones via SSH or the like. That in turn could enable the system to have different UX between the two classes. For example like a some other HNers I assume I currently grant Terminal full disk access right out of the box as one of my first setup steps just because it's a real irritation to not be able to navigate around and use it from the CLI as I expect without GUI stuff popping up. But instead a system could transparently make it so that when I typed in commands into the shell they'd actually be treated with different permissions than if an automated shell script did the exact same commands, and this could be the case everywhere with a high degree of security. Much more intelligent granting of capabilities would make the UX a lot less irksome and could help push a request for human attention and decision making from the default to the unusual, and that in turn would encourage leaving it on. I think Apple does already do this to some extent actually? Like, in a native widget GUI app, if the user initiates the GUI open/save file finder they're able to navigate to places outside the sandbox? I might be misremembering. But at any rate extending that as a low level hardware backed feature could be an important step in capabilities usability. Security has to have its costs in line with perceived benefits, or users will just end up degrading it (classic "just write the password on a sticky note leave it on the monitor" issue). The human element isn't a bug it's a core requirement, so would really like to see more effort on that side of things as well.

emodendroket 4y ago

iOS does pester me all the time about whether I want to allow this or that app to use my location.

letitbeirie 4y ago
Whenever an app that has no business knowing my location asks for it, I always wish that iOS "Always Share/Share While Using/Share Once" modal had the additional option "Share Fake Location." I get why it doesn't (the problems it would cause for Uber and DraftKings immediately come to mind) but the more sketchy advertisers there are who want to track my location data, the more I want that data to be garbage.
- jeromegv 4y ago
  There’s “less precise” which isn’t quite the same but also helps to not target all the way on top of your home and is more city wide accurate.
  - callalex 4y ago
    But that still informs the app of your choice, and many will disable themselves until you grant the precise location permission.

narrator 4y ago

Newer android prompts before apps are allowed to do things like access location and files.

provenance 4y ago

> "combine designation with authority" This is a fantastic comment for someone (like me) hungry to learn about security concepts. Do you have any more pointers to useful info about security topics?

ryanjshaw 4y ago
Security is a pretty broad topic and it's not really my speciality I'm afraid. That being said, I used to be very interested in capability-based security because it promised solutions to so many security problems but nobody seemed to know about the ideas, and the people who had heard the term often had significant misunderstandings of what was possible with capabilities. It's been about 20 years but I mostly had it right ;) "No designation without authority" This is a great place to start: https://srl.cs.jhu.edu/pubs/SRL2003-02.pdf https://srl.cs.jhu.edu/pubs/SRL2003-02.pdf