macOS-Security-and-Privacy-Guide

I usually maintain a little git repository `.dotfiles` with all my personal preferences and config files. Although it is designed to be made public, I didn't do it - I was too scared I forgot something :-) In this repo I also created subdirectories for automated setup scripts for different operating systems. It looks something like this: docker ... custom docker files and scripts etc git .gitconfig .gitignore_global ssh hosts.d config vim vimrc zsh ... (multiple config files and dirs, e.g. powerlevel10k) linux artix setup.sh fedora setup.sh ubuntu setup.sh macos setup.sh common_functions.sh All I need to do is install git, check out the repo and run the setup script of the current system - works for linux and macOS, although I don't use ma

- 1Password - Fastmail (block images in email, which are often used for tracking) - Privacy.com 1Password integrates with both of the above, so that any time I sign up for a new service it will get a random, unique email from Fastmail (masked email), a unique credit card from privacy.com, and I use 1Password to generate not only a unique, strong password but also a unique username (hence my current username here, squeegee_scream). - sync.com for online storage. it's e2ee - MFA everywhere it's available - 1Blocker - nextdns - use privacy-respecting alternative frontends: - use invidious instead of youtube - libreddit or teddit instead of reddit - nitter instead of twitter - macos, following https://github.com/drduh/macOS-Security-and-Privacy-Guide for hardening (I haven't compared this to other hardening guides, but doing some

Discussion from the last time this was posted in 2018 - https://news.ycombinator.com/item?id=18099835 Also the macOS Security and Privacy Guide may be of interest https://github.com/drduh/macOS-Security-and-Privacy-Guide as discussed on HN last year https://news.ycombinator.com/item?id=24242890

macOS Mail.app -> Preferences -> Viewing -> Uncheck "Load remote content in messages" Privacy defaults come down to usability vs. privacy; Apple making this so easy to toggle is fine by me as I care about privacy and tracking. Now, it would be great if every macOS application walked you through privacy settings right after installation in the same way that I am offered a tour of the new features. Since there is no such "privacy tour", the community has discussed ways in which macOS can be hardened [1], [2]. 1. https://github.com/drduh/macOS-Security-and-Privacy-Guide 2. https://news.ycombinator.com/item?id=18099835

Not OP but one example is bridged networking. I discovered this while trying Parallels Lite from the App Store. I was used to being prompted for every connection attempt VirtualBox was making but I was not getting any when using Parallels. I contacted Little Snitch's support and they acknowledged the issue but said that there's not much they can do because Little Snitch works on "application level" and Parallels uses bridged mode of networking that Little Snitch is unable to intercept. Note that the Lite version of Parallels doesn't require any kernel extensions (even on older macOS releases). If an application is running as root, you are similarly able to use the lower level APIs and completely "bypass" Little Snitch. I cannot find a good alternative source for this other than the Security and Privacy Guide [0]: It is worth noting that t

tptacek's criticisms are quite valid. However, "it's not good" seems oversimplified to me? I found lots of interesting information in this. For example: information about the activation process for Macs, importance of setting a firmware password, disable some of the Spotlight services, and binary whitelisting through Santa. The repo also has the most comprehensive discussion I've seen about evicting FileVault keys from RAM on sleep: https://github.com/drduh/macOS-Security-and-Privacy-Guide/is... Also, I'm not sure if this has been changed more recently than the comment you linked, but it seems like they actually don't recommend AV software anymore: "Therefore, the best anti-virus is Common Sense 2020. See discussion in issue #44." I grant you that having someone follow this top to bottom might be bad, but to say "it's not good" seems t

i've increasingly been having issues with hands off![0] on my machine (intermittent high cpu usage, regular kernel panics), and was actually looking at this guide a while back to decide whether i should switch to pf instead[1]. but pf seems to require much more configuration and management. anyone have experience/pointers in this regard? [0] i used to use little snitch many years ago, but ran into similar issues with it over time (maybe it's better now). [1] https://github.com/drduh/macOS-Security-and-Privacy-Guide#ke...

I was looking at Yabai [1] as a window manager and it requires SIP[2] to be disabled for advanced features... Is SIP really needed ? I see that it didn't even exist since "since OS X 10.11 "El Capitan".". [1] https://github.com/koekeishiya/yabai/wiki [2] https://github.com/drduh/macOS-Security-and-Privacy-Guide#sy...

I think the turning off FindMy one really depends on where you fall on the security-usability spectrum. For example if you want to truly harden your Mac there is a ton of steps you can take, but they get gradually more intrusive to the experience of actually using the system: https://github.com/drduh/macOS-Security-and-Privacy-Guide

I follow some parts on Bejarano's [0]. It was discussed on HN https://news.ycombinator.com/item?id=18099835 (6 months ago) macOS Security and Privacy guide [1] also a recommendation you can try. [0]: https://blog.bejarano.io/hardening-macos.html [1]: https://github.com/drduh/macOS-Security-and-Privacy-Guide

Very interesting! I’m reading it quite thoroughly so I don’t have any immediate thoughts but this did remind me of another similar guide in the spirit of things if you haven’t seen it: https://github.com/drduh/macOS-Security-and-Privacy-Guide Very good also if you liked this

The sources I recall while writing this: - https://github.com/drduh/macOS-Security-and-Privacy-Guide - https://github.com/CISOfy/lynis - https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.s... - https://help.apple.com/machelp/mac/10.12/index.html#/mh11389 - http://newosxbook.com/files/moxii3/AppendixA.pdf Hope it helps!

> An attacker could trigger the utility and direct a Mac to a site with malware without user interaction, so it's best to disable this feature and log in to captive portals using your regular Web browser, provided you have first disable any custom dns and/or proxy settings. See https://github.com/drduh/macOS-Security-and-Privacy-Guide#ca...