If your question pertains to a specific protocol, e.g., ssh or ssl (https), please use that tag instead.

learn more… | top users | synonyms

335
votes
7answers
242k views

How do I recompile Bash to avoid Shellshock (the remote exploit CVE-2014-6271 and CVE-2014-7169)?

Given that Bash 3.2 (the version shipped by OSX) is vulnerable to the remote execution exploit known as "Shell Shock" (CVE-2014-6271 and CVE-2014-7169) how do I rebuild Bash and secure my system ahead ...
110
votes
23answers
18k views

Is there a quick way to lock my Mac?

On Windows you can hit the keys Windows+L to lock your computer if you step away. I don't want to have to remember if sleep currently asks for a password, if there is a time out where my screen isn't ...
46
votes
5answers
27k views

Are Macs vulnerable to the Bash shellshock bug?

Red Hat recently announced a major security-related bug in the Bash shell. Some are calling it the "shellshock" bug. Since OS X is built off of Unix, is it vulnerable to attacks that exploit this bug? ...
35
votes
10answers
2k views

Is it generally advisable to get anti-virus software for Mac OS X?

Is it worth to buy an anti-virus software for Mac OS X? I heard both opinions like "it's not possible to get a virus on Mac OS X" and "Mac OS X is also vulnerable against virus... " Which is true? ...
30
votes
5answers
2k views

Is my Mac infected with the Flashback trojan?

I own a 2011 model of MacBook Pro with a Core i7 processor and Snow Leopard. I have found out there is a trojan horse which now controls 600,000 Macs. How can I find out if my MacBook is being ...
29
votes
6answers
81k views

How can I open a .pkg file manually?

Some applications come in .pkg files, and ask for you administrator password, even if all they do is copy the binary to /Applications. I like to have my applications in ~/Applications, and I do not ...
28
votes
2answers
21k views

How to upgrade OpenSSL in OS X?

Today the heartbleed OpenSSL exploit was announced in the wild, which allows an attacker to surreptitiously detect and steal private server keys (allowing them to MitM and decrypt your encrypted data ...
27
votes
3answers
2k views

How do you prepare or secure your Mac for the possibility of being stolen?

I'm using the great applicaton Prey which hopefully never has to get used, but just in case, I want to be prepared. So basically I have a request for password after sleep/screensaver enabled, but ...
24
votes
3answers
7k views

How to securely erase an SSD drive?

I'm pretty new to SSD technology, so I don't know how it compares to hard drives when it comes to securely erasing the drive. Is it enough to run Disk Utility and erase the drive with the option ...
24
votes
3answers
480k views

Is there any way to view saved wifi passwords on the iPhone?

I've previously connected to a wifi network on my iPhone but I've no way of finding out the password. So is there any way to view saved wifi passwords on the iPhone?
20
votes
2answers
3k views

What potential dangers arise from a mass iOS UDID leak?

Can anyone enlighten us with what a hacker could use one (or a list of) UDID for? The leak reported September 4 of 1 million UDID's by AntiSec makes me worry. But should I? What is the worst case ...
18
votes
7answers
915 views

How to limit my Mac's exposure to malware?

With OS X malware increasingly in the news (see the Flashback Trojan issue), is there anything that I should do to increase the security of my Mac and reduce my exposure to malware? What I'm doing ...
16
votes
5answers
24k views

Is data transmitted over 3G secure?

When data is transferred from my iPhone via 3G, is it encrypted, or is it relatively simple for a hacker to read the data that's transferred to AT&T's cell tower? What about after it reaches the ...
15
votes
6answers
41k views

Is it possible to update any iOS 6 device to iOS 6.1.6?

Apple have just released software updates to fix a rather serious security problem where a valid SSL response wasn't checked properly to ensure it matches the site actually being browsed. I have an ...
14
votes
10answers
32k views

Is there a way to password protect individual apps?

Is it possible to password protect a specific Mac application? For example, I am interested in protecting Mail because even if you cannot retrieve new emails, you still can read all the already ...
14
votes
1answer
888 views

Should I make my primary user an Administrator or not?

For a long time, I have had two accounts on my Mac : an administrator account that I normally don't use, and a "normal user" that I use for day-to-day work. I did this because it should be more secure ...
14
votes
4answers
6k views

HFS+ case-sensitive or case-insensitive — which type to use for the primary drive partition?

What reasons are there for choosing the case-insensitive version of HFS+ when formatting the primary drive partition? Would case-sensitive not always be the best choice?
14
votes
1answer
202 views

Can I ensure keyboard commands don't get trapped by browser scripts?

Is it possible to tweak Safari to ensure command key combinations like ⌘H or ⌘L go to Safari as opposed to Safari's window contents? This comes up for me most often on this site because the editor ...
13
votes
1answer
27k views

Should I block incoming connections from “netbiosd”?

My (application) firewall settings are configured to block incoming connections from netbiosd. I don't recall setting this myself, and wonder what the consequences are. What are the consequences of ...
13
votes
2answers
4k views

What user behavior is necessary to make Filevault 2 maximally secure?

Situation: Filevault 2 passwords can be stolen Passware has released the Passware Kit Forensic 11.3 which is able to steal the FileVault 2 password from the RAM by performing a DMA Attack via the ...
13
votes
3answers
10k views

Is there a tool I can use to securely wipe data from iPhone, iPad, or iPod Touch?

Is there a tool or application that will securely wipe an iPhone, iPod Touch, or iPad (i.e. any iOS device?) I'm not interested in a complete wipe that would brick the device. Rather, I'd want to ...
13
votes
1answer
5k views

How do I un-trust or remove blacklisted root CAs from mobile Safari on my iPhone or iPad?

The DigiNotar root CA has been compromised and has been blacklisted by Mozilla and Chrome. I've already un-trusted their root CA in Keychain on my OS X devices, but how can I do something similar on ...
12
votes
5answers
3k views

Will it work well to use a .dmg as an encrypted folder?

I have a folder containing files including Wills, Trusts, personal financial statements etc. Most of these files are word docs, excel spreadsheets, PDF's and jpegs. I would like to protect this folder ...
12
votes
4answers
559 views

What's a good way to wipe a hard drive for resale?

I'm selling my MacBook and would like to wipe the hard drive in such a way that the current data can't be easily recovered after I reinstall OS X. Can you recommend a free tool to help me do this? ...
12
votes
3answers
455 views

What are the risks of connecting a MacBook to an insecure wireless network?

What privacy and security risks am I exposing myself to when I connect my MacBook to an open insecure wireless network? Are there any risks that are worse or better when compared to a Windows PC ...
12
votes
2answers
10k views

How can I keep my Mac awake AND locked?

I want to leave my Mac awake overnight so it syncs 4GB of data from Dropbox. I need to prevent the machine from going to sleep because that pauses the Dropbox sync I've been using Caffeine to keep ...
12
votes
3answers
18k views

Is the message “You must change your passcode within 60 minutes” valid / non-malware?

A few minutes ago, after unlocking my phone (iPhone 4, iOS 7.0.1) I got a dialog over the home screen: Passcode Requirement You must change your passcode within 60 minutes and it offered to ...
12
votes
4answers
4k views

How is the System Keychain secured in OS X?

I'm looking for something either like this security white paper for iOS except for OS X or even better, some kind of security audit report from an independent expert. After reading through ...
12
votes
2answers
3k views

Where does Apple's predictive keyboard get it's “contextual” content from?

So I was playing around with the iOS 8, when I notice that upon typing "new" anywhere, the predictive keyboard suggests the term "NewTerm". I recall using this word in a tweet, so I brushed it off. ...
11
votes
4answers
3k views

Does iOS 5 have a SSL security bug that got patched on iOS 6/7?

Apple released iOS 7.0.6 and 6.1.6 to patch a specific SSL/TLS security bug. I can't find anything official about iOS 5. Does iOS 5 have the same bug? Please cite your answer.
11
votes
1answer
3k views

With a firmware password set on a Retina MacBook Pro, what are recovery options?

I am considering setting a firmware password on my Retina MacBook Pro for security reasons. If I do this and later lose the password (or other such extenuating circumstances), how can the data be ...
11
votes
2answers
23k views

How can I get admin access to a Mac without knowing the current password?

My Father died last year and I inherited his Mac Mini. My wife has retired and we are trying to set up the mini for her use but the changes we want to make require admin access and we do not have the ...
11
votes
4answers
2k views

Tools to compress and encrypt files

I want to compress several files and encrypt them with a password if possible. Are there any build-in tools in Mac OS that provide such functionality? If not, can you recommend me a (freeware) ...
11
votes
2answers
1k views

I was physically robbed and now can't manage my Apple ID… how can I extract my purchases?

TL;DR Since it seems obvious that at present Apple can do nothing to help me: I need some way of getting as much of my content (music/apps/contacts/etc) out of this account... what can I do? All of ...
10
votes
10answers
17k views

Can I trust Apple Store's employees with my laptop?

This might be a bizarre but crucial question, can I fully trust leaving my laptop in repairs (Genius Bar) while they have full access to it ? I recently went to the genius bar to get my display ...
10
votes
2answers
8k views

My MacBook was stolen: can the thief access my files without my account password?

My computer is set up to require a login after its been put to sleep and it has a fairly complex password, so I'm not worried about anyone guessing it. The MacBook was stolen, and I'm wondering if ...
10
votes
3answers
4k views

Can Gatekeeper be disabled via terminal in OS X 10.8 Mountain Lion?

How can you disable Gatekeeper via Terminal Commands in OS X 10.8 Mountain Lion? I am looking to replicate the Security & Privacy preference pane selection to allow applications downloaded from ...
10
votes
2answers
2k views

Will FileVault 2 wear out my SSD faster?

I'm considering using FileVault 2 when I upgrade to Lion. Though my understanding of it is weak, it seems as though it shouldn't really increase the number of reads or writes per disk operation ...
10
votes
1answer
275 views

Clipboard survives a reboot. Is it secure?

I noticed that things in my clipboard survive a reboot - love it, very convenient. But I'd guess that's written to disk, and if I had physical access to your machine, I could reboot it and access the ...
10
votes
3answers
578 views

Can the built-in OS X “Location” feature auto select locations based on wireless networks?

My home network is very secure, but my school's wireless network is open, which makes it vulnerable to wireless sniffing (e.g. with Firesheep). I just discovered the Location feature and I think it's ...
10
votes
1answer
510 views

For maximum FileVault2 security, why is hibernation recommended?

Many discussions of FileVault 2 security suggest using: sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25 Some of those discussion state that FileVault keys are stored in RAM during normal ...
9
votes
5answers
10k views

How can I tell if I'm viewing a secure page in Safari (6.0.2)?

Safari hides the http: or https:, so how can I tell if I'm viewing a page over SSL? Some pages show issuer information in the URL bar, but not all of them. So the ones that show issuer info are ...
9
votes
3answers
5k views

How secure are iCloud backups?

Are iCloud backups encrypted, both when transmitted and stored? Is it possible for someone at Apple to access any backup made to the data enter? I have heard that when apps have been pulled from the ...
9
votes
2answers
5k views

How long does Apple provide support for Mac OS X?

I am currently using Apple 10.6 (Snow Leopard). How long will Snow Leopard be supported for? Does Apple provide an end-of-life policy in writing? I have read that Apple tends to only provide security ...
9
votes
2answers
15k views

If my stolen iPod touch gets reset, will I receive a notification from iCloud?

My iPod touch was stolen. If the person type the wrong password 10 times, it will erase all my data. And, if that happens, will I receive the notification ("find my iPod") I requested in iCloud when ...
9
votes
3answers
1k views

Hard wired link between webcam and led indicator?

In light of stories about stories about secret monitoring over laptop webcams (such as this one or this one), I wonder about the reliability of the green LED next to the camera that indicates that ...
8
votes
5answers
12k views

Issue with deleting user account

I want to delete a user account before selling my machine, so I chose the secure delete account option in System Preferences > Users & Groups. I think I saw a progress bar at first as it was ...
8
votes
1answer
3k views

Is the lock screen PIN secure enough when sending in for repair?

The button on my wife's iPhone 4 has become unresponsive and I would like to get it repaired. Like most people, the phone contains important emails, documents and photos which she would not like to ...
8
votes
2answers
3k views

How to disable single-user boot (command S)

By default, Macs are extremely insecure if somebody can get physical access, as they can simply shut it down, press the power button, hold command-S, and there, they get root access in 5 seconds. Is ...
8
votes
2answers
350 views

How does Apple's Power Nap interact with File Vault?

If a machine is periodically waking up to check for updates with Power Nap, does this also mean the disk encryption keys are always in RAM? If so, this makes a DMA attack against a "sleeping" Mac ...