Hacker News Reader

Comment by Reason077 | Hacker News Reader

This is pretty neat.

But one annoyance is that on macOS Monterey, the authentication pop-up dialog doesn't have focus when it appears. You first need to click on it before you can use Touch ID. That slows the whole process down to the point where it's probably just quicker and easier to use your password.

Is there any way to make the pop-up automatically get focus, or is that itself a security risk somehow?

(Side note: the same module enables authentication by Apple Watch too! But again, having to take your hands off the keyboard to tap the Apple Watch to approve the request slows down the process so much that it's hardly worth it)

View on HN

on macOS Monterey, the authentication pop-up dialog doesn't have focus when it appears

Good.

Focus has really become a problem on Macs.

When I switched from Windows to Macs, programs were not allowed to steal focus from what you were doing. To me, it was an amazing thing to not be interrupted for every little piddly thing that some background process deemed to be the most important thing in the world. I was so much more productive when I wasn't being constantly interrupted, as I was in Windows.

Then, not too long after Snow Leopard, that changed. Programs here and there started asserting themselves. Now it's like Windows days, and it's awful.

Even Apple is guilty of this. A few days a week, I plug in four encrypted drives. It takes about five minutes for them to mount, so I go work on other things. I'll be happily typing away at something, and then suddenly find what I'm writing is being typed into the password field to unlock one of the drives.

Finder — perpetually awful — can't even keep focus on itself in the middle of some tasks. Even on a brand new M1 machine, 90% of the time, when I Shift-Command-N to create a new folder, focus will land in some random window or pane. The new folder was created, but it's just "untitled folder" all by itself, because Finder decided to go scratch its butt. Or sometimes the name of the folder is the first few characters I wanted it to be, because in the middle of typing the name, Finder switched focus to something else. Or when I switch to some other program, and then switch back to Finder a good percentage of the time, I find out that none of the windows are in focus, and none of them are focusable with Command-~ at all. So, I have to go back to the trackpad to select the right window. The window I was using twelve seconds ago, the last time I was using Finder.

I think allowing any pop-up to demand focus is a serious security flaw. I've sometimes found myself typing a password into a browser, or a word processor, because they've decided that they are the most important thing in my life at that moment.

Fair points, but this is not some random app popping up a dialog. It’s a child window of Terminal itself, so I can’t think of a good reason why it shouldn’t get focus.

Must depend on the terminal, then. The terminal I use (Warp[1]) does focus the authentication popup after I run sudo.

[1]: There's so many things named warp these days, so here's a link to ease searching lol https://www.warp.dev/

I discovered the focus issue is caused by having "Secure keyboard entry" enabled in Terminal. Turning that off means you can use Touch ID without having to click to focus.

If anything, the reverse is a security risk: applications that steal focus while I am typing down a password.

Software stealing focus is an awful antipattern and I wish macOS would fix this crap. Even on iOS, which is otherwise good with this, will gladly interrupt whatever you’re doing to show you a fullscreen captive portal. Obnoxious, especially if you’re just walking by an open wifi you joined at some point in your life.

It completely baffles me why captive portals do not obey the normal windowing mechanisms on iOS.

Because then the average user would say "I know I'm on Wi-Fi because Control Center says so, but nothing loads in {app that isn't a browser}". Or worse, "I joined a Wi-Fi network but my iPhone decided that it can't connect to the internet through that so now it's using my data plan instead without telling me[0]".

Windows and macOS pop up the default browser (or on macOS, a webview) with the captive portal when they detect one. iOS doesn't have windows, so if it wants to get the user to do the captive portal without them sitting there in confusion it has to pop it up. It could pop a notification, but if the user misses it (as one could, with all the notifications that come in these days), then they are stuck.

0: https://support.apple.com/en-us/HT205296 (which has kicked in for me sometimes when my LAN doesn't have internet for whatever reason)

iOS made the mistake of conflating wifi with “internet”, it will even attempt to kick you off a wifi if it doesn’t have internet, but it will gladly show you the icon even before logging you into the captive portal.

The current situation is incredibly badly-engineered on so many levels. It’s maddening, really. One of the worst parts is that the modal disappears as soon as you attempt to switch apps (or god forbid you try to respond to a message you received)

Notification + real internet connectivity indicator + a regular Captive Portal/Internet App would go a long way.

> iOS doesn't have windows, so if it wants to get the user to do the captive portal without them sitting there in confusion it has to pop it up.

It does, they're just normally fullscreen ones.

The point is that that captive portal windows persist in the app switcher, and they can't be splitscreened on an iPad. So if you need to look at your email or text messsages to find your user credentials or the login page is badly coded and doesn't pick up your password manager you're screwed. It's really, really annoying.

Apple Watch auth is slower than Touch ID, but faster if you’re using an external keyboard that doesn’t have build in Touch ID.

I wonder if there’s a way to make it skip the confirmation step. Apple Watch auth when logging in requires no confirmation, so is there a good reason for sudo to require it?

That would make it faster than Touch ID and having to first click on the authentication pop-up.

It would also allow to authenticate sudo without you knowing for as long as you sit next to your machine

Well, you know about it, because the watch makes an “unlocking” sound and taps your wrist each time it authenticates you.

Right, but there’s no way to undo a sudo authentication.

how do you enable this? Would like to do it for my desktop. Also for application installers if possible.

System Preferences -> Security & Privacy -> General -> "Use your Apple Watch to unlock apps and your Mac"

Theoretically automatically popping up that dialog could result in you authenticating without being aware you did so. It would require you resting your finger on the right spot but it might be the reason for this behaviour.

I find that the dialog pops up without focussed when I launch Bitwarden, but does have focus when I launch 1Password. It is confusing

It has focus for me, using iterm2.

Oh, thanks! Your comment made me look again and now I've figured it out!

I had "Secure Keyboard Entry" turned on in Terminal.app. Apparently this prevents the authentication pop-up (or anything else, presumably) from taking focus away from Terminal.

Turning it off solves the focus issue!

Reply on news.ycombinator.com