New answers tagged

0

There's never a way to make it entirely secure, especially with physical access. However, you can significantly increase the difficulty. I would recommend following this guide by hardentheworld.org to harden OS X. It's pretty long, but I'll list the steps quickly here: bold is more important. Allow only signed apps Check Privacy permissions Destroy ...


3

You can't make it truly secure; there is a saying that says given enough time, physical access is root access. That being said, there are some steps you can take to get as close as possible. FileVault Enable filevalult. This will keep people from accessing your data if they boot from an external drive. To do this, go to System Preferences -> Security & ...


0

Sorted: type in the terminal xattr -d com.apple.quarantine leave a space after "quarantine" and then drag & drop the .app file. Then press Return...et voila'! The -cr flag is for operating systems before (and including) Mavericks. For newer operating systems (Yosemite & El Capitan) you must specify the flag -d along with the attribute ...


2

If the hard drive is not encrypted, then it's not at all secure! Basically anybody can take the hard disk, put it into an external enclosure and connect it to another Mac to read all files on the disk.


-1

running xattr -cr will do the job this will remove the extended file attributes (for each file from .app) and allow it to run apple doc set for xattr: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/xattr.1.html


0

You will probably have to contend with Gatekeeper, XProtect and SIP to get around the protection with which OS X is confronting you. Right click and open in finder just white lists an app in Gatekeeper - in this case, you tried that and we can rule that out. Xprotect is the name of the file Apple updates to black list known bad software and insecure ...


-3

run xattr -cr <your.app>


0

If you get signed and or encrypted email from folks who use SMIME, Mail.app will helpfully add their public x509 certificates to your login keychain. A pretty good explanation of the process can be found at Secure emails with Apple Mail


0

Apple may occasionally approve additions to new Root CAs e.g. Verisign, who can then sign certificates for individual sites you visit. The root certificates for OS X El Capitan are here https://support.apple.com/en-us/HT205204 I assume these are done in software updates via the App Store, but I don't know for sure. Also your company may add additional ...


2

System Integrity Protection (SIP.) It locks up a variety of files to prevent malicious software from modifying it including /System. You can temporarily disable SIP, modify your files, then turn it back on if you want to have the maximum protection.


2

The root CAs are stored in: /System/Library/Keychains/SystemCACertificates.keychain /System/Library/Keychains/SystemRootCertificates.keychain Yes, these are OS X keychain files which are opaque, though not necessarily proprietary. You could theoretically use OS X's Keychain Services APIs to get at the certificate data inside the keychain file, but that ...


33

There's an OS X feature called authenticated restart that stores the FileVault key in the SMC for the duration of the reboot. Apple acknowledges in the manpage that it does reduce FileVault security for the duration of the restart: On supported hardware, fdesetup allows restart of a FileVault-enabled system without requiring unlock during the subsequent ...


1

The only way to keep your Mac safe while you are away is to power it down. Period. Even then, leaving your Mac unattended may not be a good idea, but at least your data is safe, just in case the Mac got stolen. FV2 does a great job protecting your data, but unless your Mac is powered down, there are potential ways for an attacker to compromise it and get ...


0

Having done further research, I see the following appears to answer my questions: OpenSSL is just one of many SSL/TLS implementations OS X does not rely solely on OpenSSL (though the deprecated version of same is still installed with the OS), but rather its own implementation called "Secure Transport" Depending on the application in use (Firefox, iTunes, ...


0

I created a script and launch agent that will automatically connect to a VPN connection when it cannot ping a specific address. It could probably be modified in a way that looks at wifi network whitelist and connects to the VPN if the current wifi is not in that list. As it is right now the vpn will always try to connect if it cannot hit an address that is ...


0

Adding this here just in case. I did not have any kind of mouse-preferences software. But after carefully closing and opening many applications after a reboot, I found the culprit: I was running Mumble (voip software) After closing Mumble and reopening Xcode, everything went back to normal.


1

This is a tough one to answer. I have seen discussions on MacInTouch.com about just this subject. And if you keep up with news online about such tings you will find that opinions vary from "Chicken Little" to, "nah, don't worry about it on a Mac." The truth likely lives somewhere between the two. Generally viruses of all types have a bit of a harder time ...


3

You can create a low-numbered user via dscl, as per this Apple support page and it will be hidden from most views. Also, I believe that if you set the user home directory to something like /var/empty then ssh will log in but the gui will not.


3

Set up your new User as a Sharing Only account, this gives them no actual account on the computer itself that they can log into… System Prefs > Users & Groups Click the lock Click the + sign to add a new User Set the new account to sharing only from the drop menu [stepped out on the pic for clarity] Ref : Apple KB - OS X Yosemite: Create a ...


2

Slack is a well-known chatting tool and I am yet to hear it does any surveillance. Also, every single Mac app which is submitted into App Store after June 1 of 2012 must have sandboxing implemented or it won't be approved. Additionally, no app is able to access your computer outside of its limits unless you give it your root password (Slack does not ask for ...


1

Yes it is possible, you can create a blocking rule using pf, that only allows traffic on the the port your torrent software is using, to/from the virtual interface created by the VPN. Take a look at a cheat sheet for pf for ideas. Or if you prefer a GUI you might check out icefloor.


0

MDM (Mobile Device Management) profiles can change many settings within the system. As you suspected, in this case the software update mechanism was redirected to a company server. There were likely other settings as well. If the profile forced all network traffic through a VPN, then the company could view it in transit. You can check by looking in the ...


0

Since the subordinate CA's certificate is already "trusted" due to the root CA's cert being in the System Roots, you just need to use the add-certificates command, specifying the System keychain. sudo security add-certificates -k /Library/Keychains/System.keychain your_cert_file


0

servermgrd looks up the certificate it uses for port 311 via an identity preference named "com.apple.servermgrd". By default, the preference points to the self-signed "com.apple.servermgrd" identity cert. After you change the preference you can remove the old self-signed cert without causing any harm. But you must make sure that the access control list (ACL) ...


0

In addition to the previous two excellent answers, also consider whether you are safe on the public network. If you aren't using "https" on all your websites and your mail program isn't set to use only secure authentication (TLS,SSL), then you are still at risk of your password being silently grabbed by one of the other machines. Don't use the same ...


5

It's important to realize that students already have other avenues of access to the bash (and other) shells. Students can download alternate terminal programs—such as iTerm—to their home directories to gain shell/CLI access. Additionally, shell scripts can be run via Automator.app. So, especially for enterprising students, blocking the default Terminal.app ...



Top 50 recent answers are included