Mac OS/X Security Tips
zsmith.co
zsmith.co
If you're picking browsers based on security, what you probably want is Chrom(e|ium).
Some of what's in this document makes some sense (especially if you're really trying to be careful; for instance, if anything important in your life depends on full disk encryption, you probably do want to be careful about when your machine is powered on). But a lot of it is batshit.
Also: it links to the Norse attack map.
I'd love to get your opinion on the trade-offs between the current un-sandboxed version of Firefox, and Chrome/Chromium.
Edit: Also, thegrugq[0] recommends against using Safari, but makes no mention of Firefox. While Safari is not atop my list of privacy or security focussed browsers, I'm somewhat surprised to see if specifically mentioned as one to be avoided. If you agree with him, why is that? In my view, it's not terrible because it doesn't support WebRTC, a user can disable plugins, and because WebGL can also be disabled. While it can't run HTTPS everywhere nor a random user agent spoofer, JSB5 seems pretty good for a javascript blocker and uBlock (while no longer under development) still works rather well.
Do you have reason to believe that they're mistaken?
Do you happen to know about a reputable way to disable WebGL?
Any reason the author insists on spelling it "OS/X" or is this just their personal preference? It shouldn't, but this bugged me when reading the article.
Edit: in fact, most of this is tinfoil hat. I'm all for safety and security but some of this is pretty extreme. "Don't trust third-party Mail providers like Gmail?" Not sure the author realizes a good number of people they're emailing use these services, so should people not converse with Gmail users?
This entire list of suggestions and "explanations" is straight-up FUD.
Author also seems to think reinstalling the OS somehow makes you less vulnerable. And that compiling source code magically makes the resulting binary safer.
And just a giant LOL at the suggestion to upload files to virustotal at the end of that wall of paranoia-driven privacy tips. Contrast, man.
Depends on the context you're working in. I wouldn't recommend anyone actually do that, but it sounds like a poor-man's readonly-system solution. If you want to ensure that your system doesn't (for example) preserve rootkits across system restarts, you've got a few good and bad choices: r/o system r/w (or no) data, restarting from golden image, wiping machine clean, file integrity checkers.
Ha! Great advice, unless your broken computer is broken.
When you take your machine in for service they're going to want an admin account name and password to a working system, so here's my advice:
- Use FileVault encryption on your main system partition.
- Create a small-ish unencrypted partition and install a bootable version of OS X. This is a great way to play around with pre-release versions of the OS.
- Create a dummy admin account and give it a password that you don't use for anything else. Write the account name and password down somewhere.
- If/when you need to take your machine in for service, tell them to boot into that unencrypted partition and use your dummy admin account.
A little while ago my 2011 iMac's video card failed; apparently a common problem with that model year. The machine wouldn't boot, but thanks to Thunderbolt Target Disk Mode I was able to make a copy of my home folder with my laptop.
When I took my machine in they asked for an admin account. I already had that unencrypted small partition for them to use, but I hadn't set up a separate admin account and had to give them my primary username and password, which is something I really didn't want to do.
They would have potentially had access to my encrypted partition along with my Keychain. I ended up having to change a whole bunch of account passwords, just to be safe.
So I think it's very good advice to create a separate admin account with a password that you're comfortable giving out, along with an unencrypted system partition that you're comfortable losing.
(By the way, Apple fixed that iMac for free even though it was over 4 years old, way out of warranty, and was supposedly not included in a video card replacement plan they issued for other iMac models of that year. Target disk mode saved the day, and Apple fixed my old computer for free, so I'm a very happy camper and am still using that machine.)
(disclaimer: never owned a mac) Don't they have some equivalent of live CDs, or can't you quickly replace the harddrive for service? Asking access to someone's software while trying to repair their hardware sounds very silly.
In any case, if they did ask, I would refuse. Let them boot off a DVD if they need to.
Seems like you might spend all month installing software...only to erase it and start all over again.
> "When sending a private email, consider encrypting it e.g. with GPG. The recepient [sic] will have to use GPG as well."
I bet his contacts love him.
Sometimes, people wrap the tinfoil around their heads a little too tight.
> 4.2. Do not use unofficial Firefox plugins.
Ok, fine.
> 4.13. Install an ad blocker if available. Firefox does not have an ad-blocker built in. Most people use Ad Block Plus, which is a Firefox extension.
Instructions unclear.
EDIT: This one made me laugh:
> 3.4. Turn off your home Wifi router at night and when you are not at home. At night, or whenever you are not at home, there is no need for your router to be powered up. Having it on means that someone can theoretically hack into the router itself from anywhere on the planet.
Leaving it on while I'm home and awake will keep me safe though.
Better be on the safe side and just disable your entire computer, as there have been several exploits that target those.
Why the slash in the name? Some kind of OS/2 mix-up?
Some of this is crazy advice unless you're DPR or trying to help some oppressed people somewhere. That said, I end up reinstalling every month or so naturally because I like to alpha-test. :P
> Your first choice of web browser should be the TOR browser with Javascript disabled.
> Your second choice of web browser should be the TOR browser with Javascript enabled.
> Consider using the email client Thunderbird with TorBirdy, which sends emails through the TOR network.
Tor guarantees your network traffic will be intercepted. Malicious exit nodes etc etc.
> Reinstall OS/X every month.
What does this get you? If you're owned, all your accounts will be owned. Re-infecting your OS with malware would be trivial, if that is even necessary anymore.
> Avoid free online email. There is no free lunch. They profit by selling you out.
Author is probably trying to make an implicit pass on Gmail. The only issue with that is Google has a hollow mountain full of security engineers and "name your private mail service" probably has 1, maybe 2, similarly skilled individuals. It's a numbers game: you're safer with Gmail unless you have an explicit 702 risk (ie, FBI thinks you're a terrorist and requests your mailspool via a 702 order from Gmail). Btw, Google has the cutest video that shows how they handle those: https://vimeo.com/108275932
> When sending a private email, consider encrypting it e.g. with GPG. The recepient will have to use GPG as well.
Even the creator of PGP does not use PGP (http://motherboard.vice.com/read/even-the-inventor-of-pgp-do...). I can't tell you how many times people have emailed me their private keys. This is not a great solution 99% of the time. Move your conversation somewhere else.
> Your third choice of web browser should be the text-based Links browser.
lol ok
> Your fourth choice of web browser should be Firefox.
Out of 4 major browsers, yes, use the ONLY one without a sandbox.
> If you need to download an app, get its source code and compile it yourself. (Type ./configure; make clean; make).
Why is this better? You're not reading the source code just like you're not reversing the binary. Waste of time.
> Try to avoid downloading risky files (PDFs, MS Word files etc.) and if you must, run a virus scanner on them first. If the file does not contain any personal or sensitive data, you can upload it to VirusTotal to have it tested by many antivirus programs at once.
Note: Uploading your Docs/PDFs to VirusTotal makes them readable by anyone with a VirusTotal account lol. Also, Google gets a copy. Have fun with that. Much easier to turn off a few features (cough macros) or use a trimmer viewer, like the Chrome PDF Viewer or uploading the docx to Google Docs and viewing there.
> Disable website-provided fonts in your browsers as there have been exploits that use infected font files.
There have been exploits in a lot of things. Let's all go outside and not use computers. Once a trend becomes public, that target generally cleans up its act. There's been a huge amount of effort put into font validation and fuzzing over the last few years and I think we've made it out of the font exploit dark ages.
Here's a list from thegrugq that is far better:
This may be a weird way of saying: get your application from the most trusted source. For example for a long time sourceforge was trusted as an opensource distribution platform. Now they're injecting malware into popular installers. The source/binaries signed with gpg is what I would trust over unsigned binaries from the authors site. The third party download sites which cannot be verified (signature/checksum) are just potential malware.
I'm not saying that "compile everything" is realistic or a good idea, but "make sure your sources are trusted" needs much more explanation and qualifiers.
Otherwise agree with all comments.
Some sap has to file an exception to that requirement annually.