top | item 46026896

(no title)

monocularvision | 3 months ago

The malware would have to prompt for biometric authentication before exporting.

discuss

order

Nextgrid|3 months ago

So it just has to wait until you’re about to do a legitimate operation requiring authentication, intercept that to export the key, and cancel the real one with a bogus error (and you’ll just try again without any second thoughts).

MacOS has also no concept of secure desktop/etc where the OS can use some privileged UI to explicitly tell you what you are signing and prompt for PIN/biometrics. It’s in fact a well-known problem where legitimate dialogs for system/Apple ID password have no distinguishing features from fake ones.

grosswait|3 months ago

Couldn’t any type of dialogue be faked? What are you suggesting is possible but not implemented?