News for hackers. Stuff that matters.

A comment on How Dropbox Hacks Your Mac. Parent comment

Re:How Dropbox Hacks Your Mac by DINKDINK on Friday September 09, 2016 @02:01PM (#12464611)
>you trust dropbox with your files, and you trust them with a kernel blob implementing the filesystem, but you don't trust them to silently have accessibility rights?

The problem here isn't that you don't trust them to have accessibility rights, it's that Dropbox has phished your root password, stored it, and will continue to modify your system to meet it's desired operating criteria.

[ Parent | on HN ]
Re:How Dropbox Hacks Your Mac by plttn on Friday September 09, 2016 @03:11PM (#12465220)
>- We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple).

Direct from the DB engineer at top of thread.

[ Parent | on HN ]
Re:How Dropbox Hacks Your Mac by DINKDINK on Friday September 09, 2016 @03:46PM (#12465492)
If that's the case, How is it that the accessibility preferences are changed without root authorization?
[ Parent | on HN ]
Re:How Dropbox Hacks Your Mac by gumby on Friday September 09, 2016 @07:05PM (#12466658)
Presumably with one of the suid executables you authorized when you typed your root password to the dialogue.

And one of them is writable by anyone -- great security, guys!

[ Parent | on HN ]
Re:How Dropbox Hacks Your Mac by Dylan16807 on Saturday September 10, 2016 @10:02AM (#12469241)
Does OS X not clear suid when a file is written to?
[ Parent | on HN ]