Micro Snitch – Know when someone spies on you

I hear people say that and I always get excited. Then I just went to Lenovo’s site and I configured one and for a small margin on error they are the same. Why do people say this when it doesn’t seem true? Is there a “50% Off all Thinkpads” website I don’t know about?

At the end of the day, I still trust Apple the most, since they have a huge reputation they need to maintain, although I recognize it's not an optimal solution, as they might very well have weaknesses in their supply chain, or become dishonest at the request of some higher authority.

On a related note, it appears we don't live in the era of personal computers anymore, but rather personal interfaces. Most people are comfortable getting a mobile interface they control, while the computation and storage of their data is performed by somebody else.

The hardware is shit. I've had to send it to service 3 times in the nearly 3 years I've been working with it. I just put in a new up arrow key last week because the last one broke. In it's current state only one USB port is functional.

Granted I'm a consultant and do heavily traveling but it has never happened to any of my colleagues Macs. Once it was in service for week because the wifi card was disconnected. Don't even get me started about running linux on it, not a nice experience.

Getting home and using my mac is such an upgrade, OS and hardware wise. Only thing I really miss is the red track button in the middle of the keyboard, that is a phenomenal feature!

I know it's just factory-installed bloatware at this point, but I'm concerned that before long Amazon's going to be paying off OEMs for physically integrated spy hardware, and while I love my ThinkPad systems, Lenovo's willingness to include Alexa makes me nervous.

I installed Unbuntu on a Lenovo and the trackpad felt horrible in comparison, even after tinkering endlessly with the settings.

What I would REALLY like though is a quality Linux operating system for the phone like Ubuntu Touch. I just don't feel comfortable on Android.

Emphasis added, because of course you don't need to, and most people don't. Apple themselves have been working at it and Mojave contains a bunch of new restrictions and brings more visibility to what software wants what. It's much more feasible now for users to simply prevent most (or all) standard software from accessing the camera or mic entirely. Someone could be very cautious about what they install and stick to more heavily controlled and sandboxed major name stuff from the MAS (even though I personally think the MAS is a huge disappointment and waste of potential still). Running software in a VM is another option for power users. And for that matter if you don't actually use the camera much/ever (likely true for many on HN) you could simply physically block it with an opaque black sticker, or even drill it out and stick some black epoxy in there or similar.

Ultimately this is just another possible layer and UX. If anything it is probably of most value to power users who want to run software from anywhere and in turn would like to have additional tools to handle some of the vetting and watching that Apple might do for general users with light needs. That's like Little Snitch too, I find it absolutely invaluable, but I also have the basic systems and networking knowledge for it to mean something to me. For end users I help it's of no direct use because it all might as well be in another language, they don't have the knowledge or metaknowledge, it's only any good in terms of providing an administrator willing to take an active hand in things occasionally another way to help lock systems down.

I do hope for Apple to continue their trend of privacy focus, for example they could make camera access more nuanced (like only if it has user focus). But I have more faith in their ability to make that functional for general end user contexts then in many server secure focused OS. To your point:

>(works flawlessly with Thinkpad's hardware (minus bluetooth and -finger scanner-) and...

But biometrics are incredibly value for general mobile usage security. Shoulder surfing these days should probably be considered the rule not the exception given the growing ubiquity of networked cameras everywhere and the data storage capacity and ML to handle their data. It's much easier to passively mass vacuum PINs or passwords then good biometrics right now where you can't ensure any physical security. OpenBSD does support HSMs which would help, though it's another thing to keep on hand as well. And of course there is the time factor of a good password vs biometric entry which discourages many people from using good passwords.

Browser-level requests for camera/mic permission are obviously nice, and it's even better to see OSX offer the request to catch more cases and prevent workarounds. Requests for control transfers are also an obvious improvement; at a certain point the easiest way to curtail sandbox escapes without restricting normal functionality is to just talk to the user.

Honestly, a same-circuit "camera on" light is my preferred solution to this whole question, and I'd be happy to see the mic get a separate light or be tied into the camera circuit.

Source code isn't really necessary. Nor sufficient for that matter even if it was there, you'd need verifiable builds and an assurance of no self updating capability too, basically for certain minimal products you need some level of trust. As far as extra verifying though you'd probably start the same way you would minimally blackbox anything: stick it on a virgin test box and monitor all I/O in a controlled setting (VM could work too, though if you're super paranoid you might take into account that can be detected and runtime behavior modified). I guess you could start disassembling it and poking around its memory and such too if you wanted.

But seriously, it's a Mac product, so source access everywhere should kind of obviously be off your list already. How do you know when Apple spies on you? You won't find the source code. And the answer is you blackbox it and mostly you trust that it'd get noticed at some point and Apple would get the crap sued out of them and be investigated by governments worldwide etc etc. Objective Development is a very long standing dev and has put out a far more critical long standing security product that has been used by a lot of sec people for a very long time. Sure they could be compromised in the same way any dev could, but on the lowest critical factor level they're unlikely to be the biggest risk in most users' threat model.

It's definitely not something I'd ever trust completely, not only could it be spying on you, but I also don't really trust my hardware. However, I must say, it's still very nice to have. It at least narrows the possible spying vectors, and it's nice to know immediately what apps are listening; the best example being Android Studio emulator: always listening.

At some level in the chain you put your trust in an authority.

Ideally the kind of authority who has more to lose than to gain from spying on their users.

Then all the spy software has to do is receive a signal to begin recording, saves to a buffer, and waits for you to check twitter before uploading.

Actually Mojave introduced some significant new per-application protections and permission requirements for privacy related equipment, including camera and microphone [2], so I'm not sure it's as relevant now as it was at launch. I suppose that even if you grant something permission it could still be useful to have more active monitoring of usage as well, it might get compromised or look legit but then do things you don't expect.

----

1: https://blog.obdev.at/introducing-micro-snitch/

2: This can actually "break" old software in some cases, because it'll try to access something and fail but the OS permission dialog will be hidden by some other window or not show up properly. Sometimes you can work around this manually in the Privacy pane of the Security & Privacy preference panel, where it'll list software that recently tried to access a resource but couldn't and you can check it off to allow it in the future.

I wouldn't grant it either way though.