HN Reader

On the off-chance someone at Apple reads this, I'll repeat my perennial beg that Apple stops popping up 'Give me your (local admin) password right now' dialogs randomly throughout the day because the computer has a hankering to install updates or something.

Anyone with basic skills can whip up a convincing replica of that popup on the Web, and the "bottom 80%" (at least) of users in technical savvy would not think to try dragging it out of the browser viewport or switching tabs to see if it is fake or real.

The only protection against this kind of stuff is to NOT teach users that legitimate software pops up random "enter your password" dialogs in front of your work without any prompting. That's what these dialogs are doing.

Display a colorful flashing icon in the menu bar. Use an interstitial secure screen like Windows does. Whatever. But the modern macOS 'security' UI is wildly bad.

Just recently learned I should be installing mac apps into my home directory Applications, not the system Applications (as every single app installer suggests). Of course, only makes sense for a single-user machine.

If I downgrade myself to a non-admin user, and install apps into my home Applications, then I'm not bothered by permissions requests from apps to update themselves. Almost all of them can just do it, on their own, with non-admin permissions. The only exceptions I've found are Tailscale and other stuff that needs higher level OS integration.

Edit since upvotes: Non-admin user operation was recommended by the Pareto Security app, see info on this specific item: https://paretosecurity.com/mac/checks/not-using-admin

All Pareto security checks: https://paretosecurity.com/mac/checks

App: https://paretosecurity.com/mac and https://github.com/paretoSecurity/pareto-mac

An important correction, so hopefully this bubbles to the top (this will be appearing on the post as well):

A previous version of this article mentioned below that this CVE was patched in macOS Sequoia 15.5 et al., but I was a bit mistaken in that. Despite being released today as well, it appears that macOS Ventura 13.7.6 and macOS Sonoma 14.7.6 are not patched against this vulnerability.

I wrote that sentence assuming that Apple would have included a patch in all of the releases. It was only later, when I checked the security release notes, that I saw I was not credited under the other two releases. I reached out to Apple to clarify if these releases were patched. As of writing, I have not heard back.

I chose to do my own testing and spun up a virtual machine. After some difficulties I got it updated to macOS Sonoma 14.7.6 and was able to compile and run my proof of concept. It still worked. I would assume the same is true for macOS Ventura 13.7.6. I'm not sure why Apple didn't include the patch in these two releases.

I will update the post when I have more information and/or context.

I remember the I'm a Mac and I'm a PC ads that mocked this on Vista. And now my Mac is worse than Vista. It's so annoying.

From the beginning, TCC has been a house of cards. It only impedes legitimate developers and tortures users with permission prompts that Apple ridiculed back in the day, while malicious apps can easily bypass the "security" (theater) in countless ways that researchers continue to uncover and report. I'm not a professional security researcher, just a Mac developer, but I've discovered a number of bypasses myself. It's almost as if Apple engineers don't even understand the technology they're using. And maybe they don't! How many remain from the pre-iPhone era?

My work Mac regularly pops up an alert box claiming that Slack is “trying to install a new helper tool”. I have no idea why or what it means. I asked IT how I could verify it was legit and they didn’t know.

I often wonder if this could also be exploited because it asks for a password and it keeps popping back up every time I click cancel.

It took Apple a full year to release the fix. That is a very long time.

2024-05-04 I leave several additional update messages as I continue testing my PoC

2025-05-12 The patch is released

I once sent an email to Steve Jobs back in 2009 or so

I told him that the MacOS permissions dialog could easily be spoofed, and that Macs should have a secret phrase or icon that you choose that they’d display inside these dialogs, and prevent their screen capture like what they had been doing with their recent DRM features.

Never heard back from him

And it never got implemented. Any program can still continue to spoof it and grab your system password.

Well, today Mac OS told me Chrome wants to access bluetooth, which of course I denied.

So I guess sometimes the permission system works.

Adobe Creative Cloud will keep multiple processes running in the background even when you explicitly configure it to not do that in the OS settings.

Love this guy's research, such good presentation!

This is one of those places where having a selected “security image” makes sense. That popup should not just be easily spoofed text.

> Apple confirms that I will be credited

congratulations on the credit

and they also paid you $1,000,000 or whatever their top bug bounty payout is right?

man, i think this really is the last time im buying Apple products, the string of CVEs, the many issues with hardware, iPhone as well....im over the hype and switching to Android and Windows

I miss being able to play games. I miss having a phone without lock-ins and security vulnerabilities that do not get patched.

> The patch is released

I assume that is with 15.5...

Almost a year to release a patch. If Apple takes that long, there is no hope for other vendors.

Author didn't disclose if got a reward for his work. Hope he did!

Trust nothing.

Honestly, I don't really trust any permissions popups on anything anymore. They are often porous enough to count as "security theater".

At this point, “permission fatigue” is real. You almost get trained to click ‘Allow’ just to get work done—which defeats the whole point. Would love a tiered trust model, not binary prompts.

tbh i just don't trust any of these permission dialogs at this point - makes me wonder if good security even starts with the ui or it's all just kinda broken underneath?