Its a pretty serious issue if any random app can read your browsing history. Even more so that Apple hasnt fixed it more than one year after the author reported it.
Its a pretty serious issue if any random app can read your browsing history. Even more so that Apple hasnt fixed it more than one year after the author reported it.
There are just so many reasons why software needs to access your hard drive. My app, for example, needs to write files in ~/Library/Application Support/Chrome in order to add native messaging permissions for my extension. Can you imagine the number of "Karens" that are going to email me because they "caught" me trying to "steal their data" if they add restrictions to this folder?
Apple did the right thing by only adding warnings for more sensitive areas like your Downloads or Documents folder, but any more than that and I think it'll cause more harm than good.
I agree with the blog post. Apple seems to be more focused with "security theatre" right now (or at least half-assed security for the sake of marketing). They do things like add easy-to-implement (via their FileManager class) file access warnings to appease most non-technical users. But at the same time ignore bigger looming threats like apps accessing the Internet. I think the issue isn't the warnings, it's what the warnings are about.
Anyway, my guess is that Apple will be adding network access warnings in the future (since it seems they re-wrote a large chunk of the networking code recently) but let's not deny the two-faced marketing speak going on right now and fact that they do stuff like making it impossible to inspect network traffic from Apple apps. The hand-wavy "trust us" argument shouldn't work for Apple either. Why do I have to trust Apple more than a third party developer?
Browsing history is not sensitive‽
The main point I was trying to make was that apps having network access without warning is more of a security/privacy issue than apps being able to read local files without warning. It's probably why Little Snitch became so popular and why I think Apple is in the process of shoving them out of the market by building it into the OS (I'm guessing!).
>it’s up to chrome
https://news.ycombinator.com/item?id=25267165:
> ~/Library/Safari/LocalStorage because Safari names the files in this directory according to the web sites that you visit! [emphasis added]
This is a serious issue for data leakage.
However, if we are going to go down the path of compromising functionality and adding lots of annoying prompts, then that strategy had better actually work!
If despite all of these annoyances apps can still read my browsing history, that means I also still need to trust every application I install, so I'd definitely prefer we just went back to where we started.
Ransomware (enabled by bitcoin payments to anonymous recipients) really changed the game on desktop in the last few years. Apple stepped up, but there's crickets on the matter in Windows- and Linux-land, aside from the people who have been containerizing their desktop apps[1].
[1]: https://github.com/jessfraz/dockerfiles/blob/master/chrome/s...
Users absolutely blindly grant it because it's such a common permission and give it no second thought. The Android sandbox is a terrible example here.
I believe you can access those directories by either enabling Full Disk Access for the process of interest or by disabling System Integrity Protection.