Hacker News: bahoom

New comment by bahoom in "How Dropbox Hacks Your Mac"

bahoom — Sat, 10 Sep 2016 10:55:12 +0000

> Well, they can autoconfirm Keychain prompts with simulated keyboard events (and access all the keychain data in general), for one. This is something non-accessibility apps can't do after some update.

Simulating keyboard (and mouse) events is easily possible for non-accessibility apps (CoreGraphics CGEvent api). In fact, AXUIElementPostKeyboardEvent is just a simple wrapper around CGPostKeyboardEvent.

New comment by bahoom in "How Dropbox Hacks Your Mac"

bahoom — Sat, 10 Sep 2016 09:30:54 +0000

Well, that's obviously a bug in OSX.

I'm not saying that accessibility enabled apps can't do any harm, of course they can. My point is that they can't do more damage then regular applications you run on your mac.

The only way to run third party apps in a kind of secure environment is sandboxing.

All this accessibility api lockdown stuff from Apple is just pseudo-security.

New comment by bahoom in "How Dropbox Hacks Your Mac"

bahoom — Fri, 09 Sep 2016 17:39:10 +0000

What exactly is so dangerous? Any app can take screenshots , listen to keyboard entries, send keys, move the mouse pointer and upload stuff to a server without any AXApi permission.

Forbidding window movement doesn't add any security at all.

Anyways, all I want a simple prompt explaining what the Accessibility API does and yes/no buttons.

New comment by bahoom in "How Dropbox Hacks Your Mac"

bahoom — Fri, 09 Sep 2016 17:20:41 +0000

I'm using the same techniques for my apps to enable accessibility access (which is needed for window management), although I'm asking users for confirmation before doing so.

It's kind of hacky, but the standard Apple way (click the tiny lock icon on the bottom left, find the app in the list, click the checkbox) is way to cumbersome for users.

Why not displaying a simple yes/no popup similar to the "allow access to contacts / calendar items" dialog?

New comment by bahoom in "Docker for Mac Beta Review"

bahoom — Tue, 26 Apr 2016 05:00:38 +0000

Many thanks! My docker id is "bahoom"