Yes, it's one of the first things that befuddled/frustrated me on macOS after coming from Windows (not that that was much better).

Dropbox apparently also used to show you a fake system password dialog which saved your administrator password, and more:

https://hn.algolia.com/?q=dropbox

It looks like Dropbox still tries [1] to abuse [2] Accessibility services in order to gain increased access to things on your computer that applications typically shouldn't need access to. Accessibility services are for helping blind people use your software, not for your software to run roughshod all over my system. Jeez!

1: https://help.dropbox.com/installs-integrations/desktop/mac-p...

2: https://applehelpwriter.com/2016/07/28/revealing-dropboxs-di...

This isn't entirely accurate. The hack that they used (writing creds directly into the TCC db instead of using the official dialog) was closed by Apple in High Sierra I believe (might've been Mojave? I can't remember atm). Regardless, now they use the official prompt. Of course, while Apple went to the trouble of SIP protecting the TCC db, they didn't actually fix the API for getting Ax permissions, and it's still a massive pain to get it even remotely right.

As for what they're using accessibility for, I believe the official primary use case is tighter integration with the Office suite (e.g. showing users if anyone else has the doc open). So nothing exactly malicious.

This isn't anything new. Keep in mind that Dropbox was offering sync status icons for years before Apple finally created an official API for doing so. IIRC that was using an even dirtier hack, involving monkey patching Finder at runtime. I'd definitely count that as a useful feature as well, and one that Apple had no interest in supporting until it became a user expectation.

I've got no affiliation with Dropbox, and I can definitely see the concern over the TCC hack. But once you try to do any meaningful integration with macOS, you do begin to sympathize. The official APIs are limited, flaky, and prone to deprecation at a moment's notice (see Quicklook plugins in Catalina for a fresh example). And Apple, despite making it impossible for third parties to innovate in their ecosystem, gets to paint themselves as saints.

Security is paramount, of course, but needlessly restricting how users and developers can use the OS will either lead to even dirtier hacks, or only Apple apps being allowed to do new, interesting things. And I don't particularly like either option.

A number of respectable apps uses Accessibilty features, for instance Alfred.

> not that that was much better

At least on Windows, I could with confidence say that Sysinternals Autoruns + Process Hacker would get you 99.9% of the way. I too went from Windows to macOS, and I tried countless tools (Lingon X, CleanMyMac, App Cleaner, App Cleaner & Uninstaller Pro, etc.) to no avail in my quest to kill Dropbox.

Agreed! The Macs are still a crazy mess. Not that much different from the old days with chains of Inits.

At least with Dropbox, they needed that access to modify menus and make changes to benefit the user. And they also made it clear that this is what they needed it for.

When Google does it, they are just elbowing their way into your computer.

I really wish there was a way I could revoke an App's ability to request access.

Which I don’t want or need. They gave no respect for your system.

Back then it turned out the password dialog wasn't fake but was the standard OS dialog apps can request sudo access with. The text in the dialog is app-customizable.

A lot of these things are hacks to streamline user experience.

I remember a few months ago when Google Cloud was offline and people made a room on Zoom to discuss it. Just clicking on a link opened the Zoom app, because it had installed a daemon behind my back. Considering it's an app with microphone access, I was VERY concerned when it happened.

I might be saying that to the wrong audience, but I think Apple is being overly cautious not to bother developers and power users at the expense of security on the desktop. Not as if other OSs are better – just this week my flash drive came back with a Windows virus after I sent it to a print shop –, but still.

In this specific case it shouldn't be possible to run without SIP outside of safe mode IMO, but it's still possible because some people need to run unsigned kexts and other hacks.

It's the same thing with the sandbox. I've seen a lot of developers making excuses not to publish on the App Store because they need things like unlimited access to home directory for whatever reason and the sandbox restricts them. Last excuse I saw was "we need to scan for subtitles". Yeah, right.

> Last excuse I saw was "we need to scan for subtitles". Yeah, right.

Yeah, that's not even a valid excuse! Once a user manually selects a file, the macOS sandbox also gives an app access to any "associated" files like subtitles, automatically:

https://developer.apple.com/library/archive/documentation/Se...

(search for "subtitle" on that page)

Note that the file name has to match exactly for this to kick in.

Was that this one? https://www.theverge.com/2019/7/8/20687014/zoom-security-fla...

https://www.macworld.com/article/3407764/zoom-mac-app-flaw-c...

That was discovered a short time after I noticed the rogue daemon myself!

Let me try to explain better: There was a thread here in HN about a Google Cloud outage and someone posted a link to a Zoom conference. I noticed that their app was still installed after clicking the given link. This happened to other people too:

https://news.ycombinator.com/item?id=20077805

I wonder if it's a coincidence!

In a limited way, Windows is better about this sort of thing. System integrity checks (checksums of critical files) can't be disabled, only defeated. All drivers must be signed or you have to enable test signing mode, which requires a reboot and puts annoying text permanently in the corner of the screen.

...but you can still delete whatever you want out of System32 (though it may grow back), and you can add your own things, and dll hijacking is an issue etc. Just when it comes to kernel code are the protections better.

I vaguely remember Microsoft pissing off a lot of device makers and users with Vista because it started requiring signed drivers.

I might be remembering it wrong, but I thought it was definitely a good thing and definitely a step forward.

I wish that would happen more often. With so many things moving to the web there's not that many excuses left to sacrifice security and stability for backwards compatibility.

Are you referring to the same Apple that pushed a silent update to REMOVE the hidden Zoom server?

https://news.ycombinator.com/item?id=20407233

Well, I'd expect the "Malware Removal Tool" to remove malware/backdoors in the first place.

But my point is that Zoom shouldn't even have been able to install that server on my system in the first place. It's my computer, so I should have been asked before. Same for Google Keystone Updater.

Dropbox is my next war on this front. The difference with Dropbox is it pretty much has to be running all the time to be useful, which means it has much more power than Chrome to be an unkillable auto-updater.

Considering that Dropbox appears to be a CIA tool to enable snooping on people’s computers masquerading as a file sharing service, I would be surprised if there is anyway to completely safely remove it at all.

Citation? Please/thanks