Hacker News Reader

Comment by eridius | Hacker News Reader

Headline says "sighed with Apple ID" as if that's a bad thing, but it's actually a good thing, as it means Apple has already revoked the Apple ID (and presumably the associated certificate), so as soon as your computer updates its certificate revocation list, it will refuse to run the application (even if you try to bypass gatekeeper).

View on HN

Good and bad. Actually, bad right up until Apple revokes the cert.

Gatekeeper really can't do much against a spear phishing attack. If someone's running a scam specifically to target a single person or a small group of people, and has spent the time and energy figuring out how to get them to open a malicious file, having an Apple ID is a $100 speed bump.

Gatekeeper is meant to prevent a wide-ranging attack. If you've got someone custom crafting an attack vector for you specifically, you've got some serious problems. I don't think Gatekeeper adds any more false security than an antivirus app would, and I don't know of any software that'd prevent an attack like this.

At best, it adds a small amount of information for authorities to try to track the attack. I doubt it'll be fruitful, but it's better than nothing.

What I don't like about Gatekeeper is that there is no way to revoke Apple's cert and replace it with another. Not that that would protect the activist in question, but it would certainly make a company machine secure against this kind of attack.

If I understand you correctly, it would also prevent you from launching any codesigned application, including the OS-provided ones, since they would all be considered to have an invalid code signature.

So yeah, I guess in a certain light, a machine that can't launch apps is definitely secure.

Good point. I think you half misunderstood; their certificate should be replaceable so that you disallow third-party software from developers in their developer program and allow it from your company only or vendor A only. Obviously one would need to implicitly allow certain OS processes and Finder for the system to work, but my point is basically that we should not be beholden to Apple beyond that, the CA should be something we can choose.

I'd go as far as to say, if someone is spending the money to hire a competent foe to attack a specific person who isn't a paranoid security expert, there isn't much chance they'll escape uncompromised.

Exactly. We're all lazy because we only expect general attacks, we expect that we won't be the first person attacked.

This doesn't make sense. The effectiveness of the spear-fishing attack had nothing to do with Gatekeeper. Signing the app with an Apple ID provided for a straight-forward way to disable the attack, which made Gatekeeper a pure win.

>it will refuse to run the application (even if you try to bypass gatekeeper).

That sounds kind of shitty to me... Is there any simple way around that?

You can bypass Gatekeeper for unsigned apps. And you can run signed apps. However, Gatekeeper refuses to let you bypass it for an app whose code signature is damaged or otherwise invalid. This is a feature. If you really truly want to run the app anyway, you can always strip off the code signature.

I don't know if there's a way around it but my first thought is that if you're hardcore enough to be needing to run code that's signed with a blacklisted ID, you're way more than hardcore enough to be able to easily make an unsigned (so can't be blacklisted) version of the binary. So if I were Apple I wouldn't waste much time or UI space on it.

That's a very valid point. I'm just worried about Apple's blacklisting mechanism being subverted, but I suppose stripping signatures isn't hard.

You can hardly call that good. It's like saying that Diginotar being compromised was good because then we could untrust their CA.

It's true that we could do that, but their original purpose was to protect us in the first place. The same is true for code signing certificates, to a certain extent.

The purpose of requiring code signing certificates for default trusted execution on OS X was to make Apple able to blacklist IDs used for malicious purpose (and perhaps to create at least some financial/identification trail). What more would you have wanted code signing to do here?

Reply on news.ycombinator.com