5 ms·

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs

by xp84 1y ago

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something. Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to try dragging it out of the browser viewport or switching tabs to see if it is fake or real. The only protection against this kind of stuff is to NOT teach users that legitimate software pops up random "enter your password" dialogs in front of your work without any prompting. That's what these dialogs are doing. Display a colorful flashing icon in the menu bar. Use an interstitial secure screen like Windows does. Whatever. But the modern macOS 'security' UI is wildly bad.

ssd646 1y ago
When logging into iCloud, they show a pop-up asking for the local password to the computer. And then they upload that password to the iCloud servers.
- DowsingSpoon 1y ago
  Please provide evidence for a claim that logging into iCloud necessarily sends your plaintext local password to the server.
  - ssd646 1y ago
    I never said it sends your plaintext password. It says it 'encrypts' your password, because it needs to access your Keychain. The dialog says this, but there is no way to opt out. You are 100% wrong. EDIT: https://apple.stackexchange.com/questions/467137/are-keychain-passwords-stored-in-icloud-by-default https://apple.stackexchange.com/questions/467137/are-keychai...
    - nmgycombinator 1y ago
      As someone who dove deep into keychain items for a previous write-up, I believe you are misunderstanding this situation. As far as I understand it, many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain that's different than the iCloud keychain, with items that are not sent to iCloud. And besides all that, to my knowledge your local machine password (the password you use to login) isn't stored in a keychain item, so there's no way it could make itself into the iCloud keychain, or your local keychain. You may be mistaking some explanations. Your computer password is used to unlock your local keychain, but it itself is not stored in your keychain. Your local keychain is also not your iCloud keychain, it's not stored in iCloud. Again, I'm not an Apple developer, so there may be stuff I don't know, but I am a developer in general and I have researched this. The above is my current understanding.
      - traceroute66 1y ago
        > many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain Yes. That's pretty obvious to anyone who opens Keychain Access. On the left you will see the following under "default keychains" : - login - iCloud > Your computer password is used to unlock your local keychain, but it itself is not stored in your keychain. Yes. That's a fundamental, and again obvious requirement. Your keychain has to be encrypted somehow, and this is (IIRC) derived from your user password. Software developers can further secure keychain by using enclave tied keychain entries[1]. [1] https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave https://developer.apple.com/documentation/security/protectin...
whartung 1y ago
The thing I hate about these things is I have no idea why they’re asking this, and no idea what happens if I say No, even how to “manage” these settings should I wish to change it. The UX is different from the apps saying “Hey, open the preferences panel and give us XXX” and there you can see the app, the capability toggle, decide to turn it on, or even go back to turn it back off. These experiences have been why I’ve not a big fan of “capabilities” as a concept. The UX around them is awful, and almost has to be. “Enable <root my computer> to enjoy your new app fully. “ This is what you get if the vendors have any say in what the messages should be. Not really helpful.
- josephg 1y ago
  > These experiences have been why I’ve not a big fan of “capabilities” as a concept. The UX around them is awful, and almost has to be. I don't think the UX has to be awful. The problem is just that they're kinda half baked on macos, and bolted on, and not really a first class citizen. There's no reason you couldn't have: - A preferences dialog showing which long-lived capabilities you've granted to which application. (Which is almost exactly what the accessibility preferences pane already is.) Ideally this UI could have a log of ways in which the application has used that capability recently and the ability to revoke it. Maybe even the ability to review the app's use of the capability. Show the review score to other users when the app asks for the permission. - A little blob of text saying why the application is asking for the specified permission. iOS requires this from all 3rd party apps. So its kinda weird that MacOS is missing explanatory text entirely on these popups. - Clear indication of what would happen if you said no. - Interdiction. In a good capability systems (eg SeL4), a capability object doesn't tell you what you can do with it. Eg, you can't ask a file handle which file its actually associated with. This means you can craft your own "virtual" capability which fakes the expected behaviour and pass that to an app instead. Any calls made using the capability come to you. Whenever phone apps ask for access to my contact address book, I'd love to be able to say yes, but give them access to like 100mb of fake entries instead. - And on top of interdiction: logging, call whitelisting, "Little snitch", etc. - More fine grained capabilities. I don't want to give any app a "root my computer" capability. I don't want that to be a thing applications ever need or get access to. I think macos's problem is that its trying to bolt on capabilities after the fact. POSIX isn't built around capabilities. As a result, app developers don't think in terms of capabilities, and they expect their apps (new and old) to work without them. In a real capability based OS, fopen() should probably take a capability as a parameter. But making that change would require changing just about every program ever written for the platform. And modifying the standard library of all programming languages.
matthewfcarlson 1y ago
What is the threat model of clicking on a fake popup? Isn't it a no-op because it isn't actually coming from the system?
- matthewfcarlson 1y ago
  Just realized that it asked for your system password if you don't have Touch ID.
  - xp84 1y ago
    The ones I get on my work MacBook Pro (which has Touch ID, which I use many times a day to do 1Password) ask me for my account password. No idea why. Also they never explain why.
  - jeroenhd 1y ago
    Having Touch ID does not immediately make all password popups disappear. I think it may be because of MDM/security settings my company puts on my work macbook, but now I get the joy of password prompts that sometimes work with Touch ID and other times demand a password. I prefer UAC over whatever the hell Apple is doing. I've had days where I close my applications after a day of work and find two or three password prompts just hovering in the background. Were they important? Should I still permit them? Who knows!
    - ziml77 1y ago
      Nothing with MDM, it's just what happens with those. I have no idea why it happens but I suspect in some cases it's badly coded apps directly asking for creds rather letting the OS do it. Whatever the reason for it is though, it's very annoying and pretty sketchy.
aranchelk 1y ago
I really appreciate the integrated fingerprint reader in these cases. I usually run with my laptop screen closed (with external monitor) but open it specifically to authenticate in system dialogs.
- aequitas 1y ago
  Apple also sells a wireless keyboard with touchid integrated. Works great. Especially if you also set pam to use touchid for sudo. They’re not cheap though.
phendrenad2 1y ago
Plot twist: That dialog never existed! You already fell for it!
musicale 1y ago
The passkey pop-ups which are indistinguishable from javascript pop-ups are a particularly egregious security mistake.
- sureIy 1y ago
  What's the problem here? Javascript popups can't read your fingerprint so what would be the endgame of a fake passkey popup?
  - BetaMechazawa 1y ago
    timeout after 10 seconds "fingerprint can't be read, please enter password"
    - deleted 1y ago
      [deleted]
  - Klonoar 1y ago
    They’re saying they shouldn’t look similar because it conveys authority otherwise.
nmgycombinator 1y ago
Hijacking this current top comment to let everyone know there is an important update to this article: https://news.ycombinator.com/item?id=43969087 https://news.ycombinator.com/item?id=43969087
pornel 1y ago
My non-techie relatives can't tell the difference between the local device password/passphrase and the iCloud/Apple ID password, so they'll enter them all until something works (I don't blame them, the UIs for these are unclear and inconsistent). Apple used to make fun of Vista's UAC, but they've ended up with the same patchwork of sudden prompts, and even weaker UI.
- nmgycombinator 1y ago
  Yeah, to be perfectly honest, I understand. I think TCC is meant to be the primary consent system, but there are others (such as the Authorization system, and the Service Management framework).
yencabulator 1y ago
Seems like it's time to re-post this golden oldie: The Line of Death https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/
- WA 1y ago
  Thanks for posting. I’ve had this vividly in my mind for years, but didn’t remember the source. Makes so much sense.
dpacmittal 1y ago
This. Moved from Linux to Mac recently and I was so confused about the random root password pop-ups. It gives no explanation on which app or command is asking for root access or why it needs root access. So I started denying the request after granting access a few times. Now I don't get that pop-up anymore. I still have no idea what was causing those pop-ups and why they stopped
ronnieboy493 1y ago
If macOS still attached modals to windows I think this might be less of an issue [0]. Not fixed, but less bad. In the previous screenshot, the modal lays over the toolbar which really reads as "part of the application". Steve Jobs, when demoing Aqua, made a point of the pain that is detached modals[1]. But here we are, detached modals, because of Apple's weird fetish for mobile UI on everything. --- [0] https://kagi.com/proxy/latest?c=LsHiRSPxhD29sXqLhdI0j1EsQ98nx-H1fY71FBuiA4miSbqbhvmj2PiH9AbroeVQ18ujpglHAZpS64_i4j5o_2lL4W_Hg4H9YJ4S3o6FotozzvKiLjA2BWuE8tOGONVH0lYdpvmpaXGLkhSo0Bs6k8ge6Crwywy8RFaMFm-yGg4%3D https://kagi.com/proxy/latest?c=LsHiRSPxhD29sXqLhdI0j1EsQ98n... [1] https://youtu.be/6-fkYFV7rOY?t=242 https://youtu.be/6-fkYFV7rOY?t=242
- nmgycombinator 1y ago
  Damn, that really puts things into perspective. Granted, attached modals presuppose there's a window to attach to. But I think that would probably be true 9 times out of 10.
  - bobbylarrybobby 1y ago
    Even if not, attaching to the menu bar (with some “chrome” that goes above the menu bar itself, which normal windows don't (can't?) do) would be superior to attaching to nothing.
- saagarjha 1y ago
  This is pretty straightforward for a malicious application to simulate.
  - nothrabannosir 1y ago
    I think parent commenter was solving the attack vector of a website showing a password modal to look like it just happens to float over the browser. By conditioning users that a password modal is always attached to the gui of the application requesting it, the hope is that a password modal on a browser window would raise suspicion with the user. I think that was the idea, at least.
jclardy 1y ago
They should really make it open as a dialog attached to the system preferences window, and within that include what app/service is requesting permissions. Having the free floating window isn’t good for anyone, and duplicating the settings app would at least make it slightly more difficult to fake.
walrus01 1y ago
To give an example of how little thought the non technical user pays to scary pop ups and warnings, people running MacOS and Chrome will regularly fall for full blue screen "your computer has been locked by windows, call Microsoft support at this phone number to unlock". It doesn't even enter into their minds that they're not running a windows computer before they even contemplate that it's just scam content presented in a full screen browser window.
deafpolygon 1y ago
This is why I've trained myself to ignore these dialogs if I did not perform any action that would then prompt it. It doesn't eliminate the risk but it rules out 80% of the low hanging fruit.

by xp84 1y ago

ssd646 1y ago

When logging into iCloud, they show a pop-up asking for the local password to the computer. And then they upload that password to the iCloud servers.

DowsingSpoon 1y ago
Please provide evidence for a claim that logging into iCloud necessarily sends your plaintext local password to the server.
- ssd646 1y ago
  I never said it sends your plaintext password. It says it 'encrypts' your password, because it needs to access your Keychain. The dialog says this, but there is no way to opt out. You are 100% wrong. EDIT: https://apple.stackexchange.com/questions/467137/are-keychain-passwords-stored-in-icloud-by-default https://apple.stackexchange.com/questions/467137/are-keychai...
  - nmgycombinator 1y ago
    As someone who dove deep into keychain items for a previous write-up, I believe you are misunderstanding this situation. As far as I understand it, many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain that's different than the iCloud keychain, with items that are not sent to iCloud. And besides all that, to my knowledge your local machine password (the password you use to login) isn't stored in a keychain item, so there's no way it could make itself into the iCloud keychain, or your local keychain. You may be mistaking some explanations. Your computer password is used to unlock your local keychain, but it itself is not stored in your keychain. Your local keychain is also not your iCloud keychain, it's not stored in iCloud. Again, I'm not an Apple developer, so there may be stuff I don't know, but I am a developer in general and I have researched this. The above is my current understanding.
    - traceroute66 1y ago
      > many keychain items can be stored in your iCloud keychain. However, your local machine can have its own keychain Yes. That's pretty obvious to anyone who opens Keychain Access. On the left you will see the following under "default keychains" : - login - iCloud > Your computer password is used to unlock your local keychain, but it itself is not stored in your keychain. Yes. That's a fundamental, and again obvious requirement. Your keychain has to be encrypted somehow, and this is (IIRC) derived from your user password. Software developers can further secure keychain by using enclave tied keychain entries[1]. [1] https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave https://developer.apple.com/documentation/security/protectin...

whartung 1y ago

The thing I hate about these things is I have no idea why they’re asking this, and no idea what happens if I say No, even how to “manage” these settings should I wish to change it. The UX is different from the apps saying “Hey, open the preferences panel and give us XXX” and there you can see the app, the capability toggle, decide to turn it on, or even go back to turn it back off. These experiences have been why I’ve not a big fan of “capabilities” as a concept. The UX around them is awful, and almost has to be. “Enable <root my computer> to enjoy your new app fully. “ This is what you get if the vendors have any say in what the messages should be. Not really helpful.

josephg 1y ago
> These experiences have been why I’ve not a big fan of “capabilities” as a concept. The UX around them is awful, and almost has to be. I don't think the UX has to be awful. The problem is just that they're kinda half baked on macos, and bolted on, and not really a first class citizen. There's no reason you couldn't have: - A preferences dialog showing which long-lived capabilities you've granted to which application. (Which is almost exactly what the accessibility preferences pane already is.) Ideally this UI could have a log of ways in which the application has used that capability recently and the ability to revoke it. Maybe even the ability to review the app's use of the capability. Show the review score to other users when the app asks for the permission. - A little blob of text saying why the application is asking for the specified permission. iOS requires this from all 3rd party apps. So its kinda weird that MacOS is missing explanatory text entirely on these popups. - Clear indication of what would happen if you said no. - Interdiction. In a good capability systems (eg SeL4), a capability object doesn't tell you what you can do with it. Eg, you can't ask a file handle which file its actually associated with. This means you can craft your own "virtual" capability which fakes the expected behaviour and pass that to an app instead. Any calls made using the capability come to you. Whenever phone apps ask for access to my contact address book, I'd love to be able to say yes, but give them access to like 100mb of fake entries instead. - And on top of interdiction: logging, call whitelisting, "Little snitch", etc. - More fine grained capabilities. I don't want to give any app a "root my computer" capability. I don't want that to be a thing applications ever need or get access to. I think macos's problem is that its trying to bolt on capabilities after the fact. POSIX isn't built around capabilities. As a result, app developers don't think in terms of capabilities, and they expect their apps (new and old) to work without them. In a real capability based OS, fopen() should probably take a capability as a parameter. But making that change would require changing just about every program ever written for the platform. And modifying the standard library of all programming languages.

matthewfcarlson 1y ago

What is the threat model of clicking on a fake popup? Isn't it a no-op because it isn't actually coming from the system?

matthewfcarlson 1y ago
Just realized that it asked for your system password if you don't have Touch ID.
- xp84 1y ago
  The ones I get on my work MacBook Pro (which has Touch ID, which I use many times a day to do 1Password) ask me for my account password. No idea why. Also they never explain why.
- jeroenhd 1y ago
  Having Touch ID does not immediately make all password popups disappear. I think it may be because of MDM/security settings my company puts on my work macbook, but now I get the joy of password prompts that sometimes work with Touch ID and other times demand a password. I prefer UAC over whatever the hell Apple is doing. I've had days where I close my applications after a day of work and find two or three password prompts just hovering in the background. Were they important? Should I still permit them? Who knows!
  - ziml77 1y ago
    Nothing with MDM, it's just what happens with those. I have no idea why it happens but I suspect in some cases it's badly coded apps directly asking for creds rather letting the OS do it. Whatever the reason for it is though, it's very annoying and pretty sketchy.

aranchelk 1y ago

I really appreciate the integrated fingerprint reader in these cases. I usually run with my laptop screen closed (with external monitor) but open it specifically to authenticate in system dialogs.

aequitas 1y ago
Apple also sells a wireless keyboard with touchid integrated. Works great. Especially if you also set pam to use touchid for sudo. They’re not cheap though.

phendrenad2 1y ago

Plot twist: That dialog never existed! You already fell for it!

musicale 1y ago

The passkey pop-ups which are indistinguishable from javascript pop-ups are a particularly egregious security mistake.

sureIy 1y ago
What's the problem here? Javascript popups can't read your fingerprint so what would be the endgame of a fake passkey popup?
- BetaMechazawa 1y ago
  timeout after 10 seconds "fingerprint can't be read, please enter password"
  - deleted 1y ago
    [deleted]
- Klonoar 1y ago
  They’re saying they shouldn’t look similar because it conveys authority otherwise.

nmgycombinator 1y ago

Hijacking this current top comment to let everyone know there is an important update to this article: https://news.ycombinator.com/item?id=43969087 https://news.ycombinator.com/item?id=43969087

pornel 1y ago

My non-techie relatives can't tell the difference between the local device password/passphrase and the iCloud/Apple ID password, so they'll enter them all until something works (I don't blame them, the UIs for these are unclear and inconsistent). Apple used to make fun of Vista's UAC, but they've ended up with the same patchwork of sudden prompts, and even weaker UI.

nmgycombinator 1y ago
Yeah, to be perfectly honest, I understand. I think TCC is meant to be the primary consent system, but there are others (such as the Authorization system, and the Service Management framework).

yencabulator 1y ago

Seems like it's time to re-post this golden oldie: The Line of Death https://textslashplain.com/2017/01/14/the-line-of-death/ https://textslashplain.com/2017/01/14/the-line-of-death/

WA 1y ago
Thanks for posting. I’ve had this vividly in my mind for years, but didn’t remember the source. Makes so much sense.

dpacmittal 1y ago

This. Moved from Linux to Mac recently and I was so confused about the random root password pop-ups. It gives no explanation on which app or command is asking for root access or why it needs root access. So I started denying the request after granting access a few times. Now I don't get that pop-up anymore. I still have no idea what was causing those pop-ups and why they stopped

ronnieboy493 1y ago

If macOS still attached modals to windows I think this might be less of an issue [0]. Not fixed, but less bad. In the previous screenshot, the modal lays over the toolbar which really reads as "part of the application". Steve Jobs, when demoing Aqua, made a point of the pain that is detached modals[1]. But here we are, detached modals, because of Apple's weird fetish for mobile UI on everything. --- [0] https://kagi.com/proxy/latest?c=LsHiRSPxhD29sXqLhdI0j1EsQ98nx-H1fY71FBuiA4miSbqbhvmj2PiH9AbroeVQ18ujpglHAZpS64_i4j5o_2lL4W_Hg4H9YJ4S3o6FotozzvKiLjA2BWuE8tOGONVH0lYdpvmpaXGLkhSo0Bs6k8ge6Crwywy8RFaMFm-yGg4%3D https://kagi.com/proxy/latest?c=LsHiRSPxhD29sXqLhdI0j1EsQ98n... [1] https://youtu.be/6-fkYFV7rOY?t=242 https://youtu.be/6-fkYFV7rOY?t=242

nmgycombinator 1y ago
Damn, that really puts things into perspective. Granted, attached modals presuppose there's a window to attach to. But I think that would probably be true 9 times out of 10.
- bobbylarrybobby 1y ago
  Even if not, attaching to the menu bar (with some “chrome” that goes above the menu bar itself, which normal windows don't (can't?) do) would be superior to attaching to nothing.
saagarjha 1y ago
This is pretty straightforward for a malicious application to simulate.
- nothrabannosir 1y ago
  I think parent commenter was solving the attack vector of a website showing a password modal to look like it just happens to float over the browser. By conditioning users that a password modal is always attached to the gui of the application requesting it, the hope is that a password modal on a browser window would raise suspicion with the user. I think that was the idea, at least.

jclardy 1y ago

They should really make it open as a dialog attached to the system preferences window, and within that include what app/service is requesting permissions. Having the free floating window isn’t good for anyone, and duplicating the settings app would at least make it slightly more difficult to fake.

walrus01 1y ago

To give an example of how little thought the non technical user pays to scary pop ups and warnings, people running MacOS and Chrome will regularly fall for full blue screen "your computer has been locked by windows, call Microsoft support at this phone number to unlock". It doesn't even enter into their minds that they're not running a windows computer before they even contemplate that it's just scam content presented in a full screen browser window.

deafpolygon 1y ago

This is why I've trained myself to ignore these dialogs if I did not perform any action that would then prompt it. It doesn't eliminate the risk but it rules out 80% of the low hanging fruit.