You can't trust macOS Privacy and Security settings (eclecticlight.co)

Article summary

The article discusses a potential security issue with macOS's Privacy and Security settings, where an app can gain access to a protected folder without the user's consent. This can happen when a user selects a protected folder in an Open and Save Panel, which can grant the app access to the folder even if the user has previously denied access. The issue is demonstrated using a custom app called Insent, which can access a protected folder even after the user has disabled access in the Privacy and Security settings. The article suggests that this is a flaw in the macOS sandboxing system, which can be exploited by malicious apps.

Main themes

• macOS security
• Privacy and Security settings
• Sandboxing system
• App permissions
• User consent
• Security vulnerabilities

What commenters say

• The issue is a security vulnerability that can be exploited by malicious apps to gain unauthorized access to protected folders.
• The problem is not a vulnerability, but rather a UX bug that can be frustrating for users, but does not pose a significant security risk.
• The macOS sandboxing system is flawed and can be bypassed by apps, which can lead to security issues.
• The issue is not specific to macOS, but rather a general problem with app permissions and user consent in modern operating systems.
• The traditional Unix permissions model is not effective for end-user setups and can lead to security issues.
• Containerization is a more effective way to manage app permissions and security, but it can be resource-intensive and may not be suitable for all use cases.
• Apple's handling of app permissions and security is inconsistent and can be confusing for users, with some apps being exempt from certain permissions.
• The issue highlights the need for more transparency and control over app permissions and security settings in macOS.