News for hackers. Stuff that matters.

A comment on Can You Really Trust That Permission Pop-Up on macOS? (CVE-2025-31250). Parent comment

Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @05:04PM (#43967438)
I mean, at that point and app could just put up a fake prompt using the UI framework. And I think users would be more hesitant to type a full password than just click a button. But if you're talking about a bug similar to mine where an attacker could use the OS's own code against it and make it show a prompt with misleading content, you might be able to report it to Apple Product Security and maybe get a bounty.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by sureglymop on Monday May 12, 2025 @06:35PM (#43968088)
I wonder why they don't add a little led to their laptops that would indicate that it really is the system asking for your password. Kind of like the camera led.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @07:03PM (#43968276)
That's an interesting idea. I do think it would be nice to have some way of knowing "is this prompt coming from the operating system or some third-party app?". However, I don't think it would have helped in the case of my vulnerability, because it abused a legitimate OS prompt.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by kalleboo on Monday May 12, 2025 @09:20PM (#43968914)
When they had the touchbar on the MacBook Pros, they would put the authentication in there since that was something only the OS could take full control over.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @10:50PM (#43969287)
That's honestly a pretty smart move.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by kalleboo on Monday May 12, 2025 @11:04PM (#43969350)
Yeah it's a shame it's just such an overengineered/expensive thing.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by saagarjha on Tuesday May 13, 2025 @05:48AM (#43971239)
You can draw arbitrary content into it though?
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by trollbridge on Monday May 12, 2025 @06:27PM (#43968035)
I mean, a website could display a crafty popup-appearing box and try to get you to type in your username and password. Not really sure how you can prevent that.

Vista used the “the background dims quite a bit” to try to deal with that.

[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by nmgycombinator on Monday May 12, 2025 @06:34PM (#43968086)
Yeah. I think the key thing in my vulnerability is that it abused a legitimate OS prompt and had the consequences of that prompt be applied to something separate from what the prompt text itself said it would.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by EGreg on Monday May 12, 2025 @06:37PM (#43968113)
I just told you how… it would show your special icon or phrase inside so you’d confirm it before you typed anything.

The phrase would be managed through a system screen, like a login screen

[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by cyral on Monday May 12, 2025 @08:00PM (#43968569)
Problem is most users will not care or understand it. Someone will spoof the dialog without the special icon or phrase and users would still enter the password.
[ Parent | on HN ]
Re:Can You Really Trust That Permission Pop-Up on macOS? (CV... by trollbridge on Tuesday May 13, 2025 @09:29AM (#43972751)
Banks did this years ago, but a few surveys showed nobody actually checked for their key phrase or image.
[ Parent | on HN ]