3 ms·

Do what mobile OS do and make the app ask for permissions just before it needs to do something special. Make it impossible to ask for root. Sandbox apps. Linux

Do what mobile OS do and make the app ask for permissions just before it needs to do something special. Make it impossible to ask for root. Sandbox apps. Linux distributions package applications (including binary ones) for their users, why can't macOS or Windows do this? Run automatic safety checks on them before deploying updates to users. The Windows Store and Apple's App Store (on macOS) are kind of like that, but they only have applications that developers chose to put there. I don't see Linux distributions asking developers for permission to package their application (there are proprietary packages on Arch and NixOS), so I don't see why Apple couldn't do the same. Certificates are a bureaucratic half-solution.

dvzk 4y ago
macOS already does all of that for all programs. I think the main problem here is that macOS only protects certain directories and not others. Programs can request access to Documents or Downloads, or they can request full-disk access (e.g. to read Library/Messages). For unprotected directories like Library/Keychains, programs can just copy the encrypted database. Since the malware obtains the keychain password with a fake password prompt, it can decrypt the database.
smcin 4y ago
That's an aspiration. It's not what Android does these days. Mobile OS permissions (at least Android) have become pretty weaselly. Protecting you from malware blatantly asking for root is obviously very important. Sandboxing is important. But the sneakier use of permissions for privacy exploits and data harvesting is different and more subtle. GasBuddy ("GasBuddy Is a Privacy Nightmare")[0] is a case in point. Geolocating users and selling that to everyone. Harvesting users' driving habits then selling those to Allstate subsidiary Arity ("turning mobility and driver data into meaningful behavioral insights, leveraging telematics to make transportation smarter, safer, and more useful for everyone!"). (But there's an opt-out!) So are fitness apps and trackers. Private equity loves acquiring them. Permissions can be abused in ways that aren't made obvious to users. Obvious example: just because you disable "location access", doesn't mean the app can't (indirectly) geolocate you in a variety of sneaky ways. Even if the app doesn't intentionally crash if you disable its location access: indirectly geolocating users indirectly from IP addresses or metadata on photos they upload. Device fingerprinting from motion sensors, so that you can track a unique user across networks and devices, and develop "behavioral insights". And on and on. [0]: https://news.ycombinator.com/item?id=30636730 https://news.ycombinator.com/item?id=30636730

dvzk 4y ago

macOS already does all of that for all programs. I think the main problem here is that macOS only protects certain directories and not others. Programs can request access to Documents or Downloads, or they can request full-disk access (e.g. to read Library/Messages). For unprotected directories like Library/Keychains, programs can just copy the encrypted database. Since the malware obtains the keychain password with a fake password prompt, it can decrypt the database.

smcin 4y ago

That's an aspiration. It's not what Android does these days. Mobile OS permissions (at least Android) have become pretty weaselly. Protecting you from malware blatantly asking for root is obviously very important. Sandboxing is important. But the sneakier use of permissions for privacy exploits and data harvesting is different and more subtle. GasBuddy ("GasBuddy Is a Privacy Nightmare")[0] is a case in point. Geolocating users and selling that to everyone. Harvesting users' driving habits then selling those to Allstate subsidiary Arity ("turning mobility and driver data into meaningful behavioral insights, leveraging telematics to make transportation smarter, safer, and more useful for everyone!"). (But there's an opt-out!) So are fitness apps and trackers. Private equity loves acquiring them. Permissions can be abused in ways that aren't made obvious to users. Obvious example: just because you disable "location access", doesn't mean the app can't (indirectly) geolocate you in a variety of sneaky ways. Even if the app doesn't intentionally crash if you disable its location access: indirectly geolocating users indirectly from IP addresses or metadata on photos they upload. Device fingerprinting from motion sensors, so that you can track a unique user across networks and devices, and develop "behavioral insights". And on and on. [0]: https://news.ycombinator.com/item?id=30636730 https://news.ycombinator.com/item?id=30636730