News for hackers. Stuff that matters.

A comment on Hardening macOS.

Re:Hardening macOS by oneplane on Friday June 24, 2022 @01:24PM (#31866098)
I'd keep Guest access for desktop usage enabled, mainly for asset recovery. A Guest user can be restricted to internet browsing which makes a poorly informed thief likely to connect the device to the internet, allowing for FMI to ping the (approximate) location and do a remote wipe. You can still leave guest access for other facilities off while keeping this on.

The question would become a matter of "is recovery part of security"?

[ Parent | on HN ]
Re:Hardening macOS by judge2020 on Friday June 24, 2022 @02:35PM (#31867334)
I feel like this isn't much of an issue with newer macbooks where bluetooth via Find My network allows location data to be exfiltrated regardless of wifi connectivity.

Also, I believe (on M1) that entering guest mode requires the computer to reboot into an untrusted state, so even if there's some 0-day to bypass Guest mode access control, the main encrypted filesystem won't be available.

[ Parent | on HN ]
Re:Hardening macOS by Aaron2222 on Friday June 24, 2022 @03:20PM (#31868049)
Looks like it does that for any system with FileVault enabled: https://www.howtogeek.com/297611/how-to-set-up-a-guest-user-...
[ Parent | on HN ]
Re:Hardening macOS by judge2020 on Friday June 24, 2022 @03:42PM (#31868331)
Good to know, I've only owned a HDD imac (so I didn't use filevault) before I got a M1 laptop so I wasn't sure if it applied everywhere.
[ Parent | on HN ]
Re:Hardening macOS by NeedMoreTime4Me on Friday June 24, 2022 @01:51PM (#31866560)
If this works, it’s a legitimately good idea. Otherwise the thief might realize he can’t connect and try to wipe the device directly.
[ Parent | on HN ]
Re:Hardening macOS by JumpCrisscross on Friday June 24, 2022 @01:59PM (#31866682)
> mainly for asset recovery

Aren't backups a far better solution?

[ Parent | on HN ]
Re:Hardening macOS by anamexis on Friday June 24, 2022 @02:04PM (#31866756)
I think asset here means the computer itself.
[ Parent | on HN ]