The problem is in the design: by not providing a hardware switch, all we have is trust. As we can see from the past, unfortunatly it's not enough.
Apple claims that the LED comes on when the camera is active, which it claims helps protect your privacy. That seems to be true, and certainly no-one seems to have any contradictory examples that are not 12+ years old.
I can argue that when one uses a sliding cover, one can easily forget to reset it after a video chat. The design is bad. The right solution is simply not to have a camera. It's just a different design compromise.
Bonus points for using a Sawzall to get started.
I was the security architect for this feature on recent Macs. The LED is wired to the camera PMIC and is powered by the voltage rail that powers the camera. The PMIC will always remain on if the system has power. Macs newer than 4 or so years also have a feature that forces the LED to stay lit for at least 3 seconds after it has been turned on to prevent the single-frame-grab attack.
The point is that the hardware has been designed properly. Combined with the OS-level permissions, it should be assurance enough for the majority of use cases.
If you need further assurances, then by all means, use a physical cover.
prevent? by the time the LED turns on, the attack has already happened.
Do the doors at Apple HQ have locks? Or is there just a little LED next to them that lights up when they open?
I think Apple's building security architect should have a conversation with their camera security architect.
A door without a latch does not prevent an unauthorized person from trespassing. A camera without a cover does not prevent an unauthorized person from trespassing.
Apples webcams are broken by design.
Other companies fixed theirs years ago: https://www.youtube.com/watch?v=37NFVGLX3vw
At the end of the day, unless you have a really nice microscope, solid understanding of electrical engineering, and a few tens of thousands of hours ahead of you, you have to trust whoever you're buying the hardware from that it will do what they say it will. No amount of hardware efforts can solve the fundamental human trust problem.
Remember the amount of effort VW was willing to expand to cheat emissions testing.
Edit: the gnarly thing might be ensuring it doesn't harvest power through data wires or store power in covert capacitors or batteries.
/s
So, there's definitely value to a built-in cover; in my case it would stay shut permanently.
Source: write firmware for a living, and write drivers for physical switches.
I.e., a traditional switch inline on the circuit(s) connecting the camera / microphone to the rest of the system.
As an analogy, you wouldn't implement a car brake by running it through some firmware. Instead, you'd preferably make a direct physical connection between the pedal and the actual brake.