Forbidding window movement doesn't add any security at all.
Anyways, all I want a simple prompt explaining what the Accessibility API does and yes/no buttons.
http://apple.stackexchange.com/questions/212622/keychain-won...
I'm not saying that accessibility enabled apps can't do any harm, of course they can. My point is that they can't do more damage then regular applications you run on your mac.
The only way to run third party apps in a kind of secure environment is sandboxing.
All this accessibility api lockdown stuff from Apple is just pseudo-security.
Well, they can autoconfirm Keychain prompts with simulated keyboard events (and access all the keychain data in general), for one. This is something non-accessibility apps can't do after some update.
Keylogger can't steal your password, if it's in keychain, even though it knows your root password. But I guess now it'll add itself into accessibility, so… waiting for Sierra :)
Simulating keyboard (and mouse) events is easily possible for non-accessibility apps (CoreGraphics CGEvent api). In fact, AXUIElementPostKeyboardEvent is just a simple wrapper around CGPostKeyboardEvent.
https://support.apple.com/en-us/HT205375
SecurityAgent
Available for: OS X El Capitan 10.11
Impact: A malicious application can programmatically control keychain access prompts
Description: A method existed for applications to create synthetic clicks on keychain prompts. This was addressed by disabling synthetic clicks for keychain access windows.
CVE-ID
CVE-2015-5943
Because granting accessibility access is far more dangerous than granting access to contacts / calendar. The latter just exposes some of your user data. The former gives the app a huge amount of control over your computer.