2

Sometimes a piece of software will automatically update itself, and I'll abruptly get the "type your password to allow this" dialog. Is there any verification going on behind the scenes before the OS gives me this dialog? It seems like any random trojan could tell the OS that it's called "Update Adobe Flash Player" or something else official-sounding. For that matter, is there anything stopping a malicious program from popping up a dialog that looks just like the OS X one?

I'm aware that programs shouldn't be able to do this unless I've knowingly put them on my computer, so the burden is on me to be careful about what software I download in the first place (barring discovery of new OS exploits, which is likely to happen at some point). I'd like to know whether there's any additional verification I could do so that even if malware does get onto my system, I can at least avoid giving it an admin password.

Improve this question

1 Answer 1

Reset to default
1

In System Preferences you go to Security and Privacy.

Code signing is a component of this. Choosing Mac App Store and Identified developers requires the use of Code Signing certificate. If you want to be able to install anything unsigned, you will have to select "Anywhere." This allows you to install anything, but it allows you to install anything :) See this pic: enter image description here

Improve this answer
4
  • Are you suggesting that if I do this, then I can be confident that any password dialog that pops up, at any time, can only be from a benign piece of software? In other words, that I don't have to worry about knowing which application is generating a password request, because there is no untrusted software anywhere on my computer?
    – octern
    Dec 11, 2012 at 18:58
  • 1
    What this does is prevent an installer from functioning without being signed. That is what I am suggesting. So an unsigned installer will NOT be able to pop up a message asking for your password. If someone generates malicious software, and signs it (meaning that Apple has provided them a signature), the software will install because it's signed. The first time this happens and is discovered, Apple will revoke the certificate. Waste of money to get a cert. So, can you trust the code? As much as you trust Apple to make your OS...
    – Everett
    Dec 11, 2012 at 19:04
  • This'll just make sure that you can't install anything which is not apple certified. If apple made a mistake, you can't do anything.
    – noob
    Dec 11, 2012 at 23:39
  • 3
    Windows asking for an authentification aren't limited to installers (Some actions with the finder may rise such windows, some software may need to rise their privileges during normal run…). The original question is fundamental in security: any user should have the technical mean to verify where a password request comes from, and this at the time of the request. The secret question is: How may I "check" that a question is issued by a legitimate source? I'm in charge to decide if this is legitimate for me.
    – dan
    Dec 15, 2012 at 13:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .