5

Is there any way to stop certain data (e.g., a particular string) in unencrypted, clear, plain text from ever leaving my Mac by any network protocol (including my home network) but not affecting regular backups to other drives?

I seem to remember Intego's NetBarrier had this facility, years ago at least, though I'm not sure if any of their products still do this, but I wondered if there was an alternative, simpler way of doing this?

  • 2
    Can you specify what kind of data? Passwords? Text files? Entries in a database? Or literally just ensure that "mySecretWord" is never sent over the network? Can you clarify exactly what your use case is? Conceivably, unrelated network traffic could actually correspond to the same data string, and so you would be interrupting legitimate traffic. – benwiggy May 14 at 10:11
4

Practically, no

Practically speaking, it is not possible to ensure a particular string never leaves your computer via a network connection.

You can however monitor and manage who your Mac communicates with, see Is there a good tool for monitoring network activity on Mac OS X?

Why?

Applications and processes running on your computer could encode or encrypt the string in a manner that can not be easily detected, and that encoded form could then be sent over the network.

Network traffic is encrypted

On a recent installation of macOS, there are vanishingly small amounts of plain network data for you to filter and monitor.

Modern network protocols encrypt the data being sent. Protocols that send data in a plain unprotected form are being actively removed or relegated to exceptions rather than common use.

Even the widely deployed Hyper Text Transfer Protocol (HTTP) is rapidly being superseded by the encrypted replacement HTTPS, as browser makers raise awarness with their users.

Theoretically, yes

In theory, it feels possible. A solution would have to inspect every network connection and be able to decrypt every encrypted connection. This might even be attempted in some secrecy focused organisations.

For a home or professional user, such a task unlikely to be achievable while retaining a functioning useful computer.

Man-in-the-Middle Attack

I am assuming you do not want to Man-in-the-Middle (MITM) attack your own computer's traffic; this itself is complex, error prone, and defeats the benefits of encryption.

I am also aware of an increasing number of services that pin their TLS certificates to thwart such attacks.

  • Sorry, I meant, in plain clear text, unencrypted. – nev May 14 at 9:17
  • I have updated the answer to address plain clear text. – Graham Miln May 15 at 11:59
0

Snort and a transparent proxy could do exactly what you ask for, it’s how I implement sensitive information control of certain department or network. You can log / reject possibly “bad” connection base on file fingerprint. It’s not hard to set up.

Both the encrypted and plain text can be inspected and reacted upon.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .