NSA Security Guide for Mac OS X

An anonymous reader writes "The National Security Agency has just released a Security Configuration Guide for Apple Mac OS X (pdf). The guide mostly contains common sense configuration information that applies to many Unix systems. It also includes specific discussion for Apple's unique features such as Keychain and FileVault. It should be useful to most Mac OS X users and will be particularly useful for US Government organisations that use Mac OS X and for commercial IT Departments that are supporting Mac OS X. A range of other NSA Security Configuration guides for other operating systems, applications, and IT kit are also available."

Comments

Jurrasic Park on OS X

[AKAImBatman]

Lex: "It's a UNIX system! I know this!"

New Government-Oriented Commercial?

[American AC in Paris]

(voiceover)

Step 45,328:

There is no step 45,328. There is no step 45,328...*soft weeping sounds*

Re:New Government-Oriented Commercial?

[drinkypoo]

hah this is funny. /. moderators have their heads up their ass.

The problem is that moderators don't actually bother to follow the moderator guidelines. Another problem is that there is no real forum for discussing problems with moderation, so you have to do it in your journal or under a story, where it typically is moderated as offtopic of flamebait. I'm waging my own ineffectual little war against those moderators in metamoderation by marking any negative moderation of comments about failings of editors or moderators unfair, and I urge the rest of the slashdot readership to do the same. The most important thing you can do, of course, is metamoderate.

The other problem is that you can comment on a story, or you can moderate it, but not both; this guarantees that only people who have nothing interesting to say about a story are allowed to moderate it. In other words, the people best qualified to moderate are the people who aren't moderating the story. Proof-positive that something is rotten in slashdotville. The entire moderation system needs a major overhaul and I don't see it happening any time soon :P

Re:New Government-Oriented Commercial?

[johndiii]

Mark "Not willing to moderate" in your user profile. The current system cannot be fixed. The fewer people that moderate, the weirder the moderation will become, and the more work the editors will have to do to keep the site even at its current level of marginal sanity. Incentive to change, which they will not have as long as they are able to patch the current moderation system with band-aid type fixes.

What about...

[Staos]

I tell you one interesting thing. While it was working back in 2003, I updated a 68030 Mac Duo laptop 7.6's modem driver from Apple site. I even had support about how to add more ram. That machine is back from 1994 or something.

OS X updates aren't service packs, they are new OS'es. 10.3.0 is a new OS , 10.3.1 is a service pack.

About antivirus and anti adware? As its a BSD based real OS, its run by rights. As its a pain in the ass to code a spyware on linux, its much more harder on OS X. Guess why? OS X shows a user friendly window which is centralized by OS GUI whenever a program needs administrative access.

Oh there is a program on OS X, comes with it and has a unsolved security problem. Yes, it still exists. Guess what is it? INTERNET EXPLORER macintosh edition.

Re:What about...

[0racle]

I don't see how simply having a centralized 'This app needs Admin access' form makes it any harder to write malware for a system, any app could trigger that function and make the request. Windows also has a single Ask for Admin form, all you have to do to trigger it is name an application setup.exe and it will ask if you want to run it as Administrator or not and I'm sure thats not the only way.

Malware is hard to code on Linux and *BSD not because of some standard or non-standard way of asking for access, but because of years of very intelligent people asking themselves how can we safely do that. OS X's polished GUI functions are over and above that to present the nice base OS in a non-threatening way.

Re:What about...

[Englabenny]

Fortunately internet explorer is discontinued

Re:What about...

[evilviper]

As its a pain in the ass to code a spyware on linux, its much more harder on OS X. Guess why? OS X shows a user friendly window which is centralized by OS GUI whenever a program needs administrative access.

That would make it EASIER to spread worms/viruses than a normal Unix system, NOT harder. In Unix, attempts to access resources you don't have permissions to, just fail. If it pops up a window that says "would you like to give this program access" then you're just as screwed as the rest of the world... That's because people are stupid and click yes without knowing what they're doing. If it's piggybacking on some other installation (browser plug-ins or other 'gee wiz' features) then users wouldn't have the slightest reason to suspect anything.

Note, though, that this is only for viruses/worms, because spyware doesn't need root access to do it's job. It can spy on you in user-land just fine. It can change your browser proxy settings without root access, and pop-up ads from competing sites without root access. Am I missing any annoying features?

Re:What about...

[Anonymous Coward]

Not sure if this would make it more secure for the OS challenged, but when it asks for administrative permission it asks for a password. If an office admin wants to keep the OS X's in the office secure, just don't give the secretaries the password for their computers. If they need to do anything which requires the password, they have to ask the computer guy and he can say, "So why do you need to see nude pictures of Brad Pitt again?"

Re:What about...

[n8_f]

In Unix, attempts to access resources you don't have permissions to, just fail. If it pops up a window that says "would you like to give this program access" then you're just as screwed as the rest of the world...

So your position is that it would be safer if it just ran without a security dialog? You might want to rethink that. Only people with admin rights get the security dialog. In your example, the code would just run on a "normal Unix system" without double-checking with the admin. Sounds less safe to me. You can't protect computers from their owners.

Re:What about...

[r2q2]

I agree, I was running 10.1 and then upgraded to 10.3. There is a whole user interface redo, support for rendevous, a journaling file system much better support for unix, an x windowing system, ipv6 support expose and a host of other reasons why that was a good upgrade. Although I didn't pay full price for it it was one of the best upgrades and I believe I got my moneys worth.

Re:What about...

[Yaztromo]

I don't see how simply having a centralized 'This app needs Admin access' form makes it any harder to write malware for a system, any app could trigger that function and make the request.

It is my understanding that on OS X, the authorization dialog pops up because a request to a protected reqource/API has been made, as opposed to an application being able to just randomly tell the OS to pop up an authorization dialog.

The dialog itself always displays the name (and if available icon) of the application making the request, as well as the name of the right being requested. As this is put together only by the OS, you can't substitute one right name when you really want to do something different. And getting one right doesn't automatically permit a process to use any other right on the system -- each right needs authorization.

It's actually quite a good system, and has been very well thought out. It does, of course, rely on some vigilence by the end user -- if they're entering their password anytime it's being requested without quickly checking to see what is making the request and why, obviously they're going to get into trouble.

Then again, if I e-mail a bunch of Linux admins and ask them for their passwords, and they send them to me, you wind up with the same end result.

Yaz.

Re:What about...

[HeghmoH]

It's not quite as initially described.

The authentication dialog only appears if it's explicitly requested by an application. If an application tries to access a resource that it doesn't have permission for, it fails just like on any other UNIX. The application can then, if it desires, ask the OS to pop up this authentication dialog. It's actually fairly limited; the process doesn't get changed permissions at all, but it is allowed to run a subprocess as root. Of course there is nothing that prevents a spyware author from making this dialog appear, other than the fact that the API is incredibly convoluted and weird, and using that to gain control of the system.

All in all, I think that this mechanism is a useful mechanism that keeps things fairly secure, although I fear that Mac users are getting too used to simply typing their password into the box whenever it appears without thinking about what's making it show up.

Re:What about...

[Durandal64]

What are you thinking? That all other OSes just give you an OKAY button and don't ask for a password to get Admin rights? No, of course not. You always need the password.

Not quite. Administrators on Mac OS X and Windows are different things. On Mac OS X, an administrator is a user who is allowed to temporarily acquire root privileges through a sudo action. To get these privileges, the user must enter his password. So, if I want to install a program that needs to write files to /Library or anywhere that isn't /Applications (the admin group has full access to the /Applications directory) or my home directory, I need to enter my password. If I choose, I can require authentication for "secure" system preferences, like the login preferences.

On Windows, if you are logged in as an administrator (not the Administrator account), your account will automatically authenticate during program installations and such, hence why you can make changes to the system settings and install programs without ever being challenged for a password. That is what makes the Windows way of doing things inherently more risky. You don't need to enter your password for administrator actions.

Re:What about...

[Carnildo]

That part was not mentioned. However, it is not a good practice to do much of anything as an administrator, so I have to wonder if this is of any use, anyhow.

On MacOSX, running as an administrator is not the same as running as "root". On MacOSX, running as an "administrator" is more-or-less equivalent to having "sudo" privileges on a Unix box: entering your password in a security box permits you to do certain administrator-type operations for a limited period.

Re:What about...

[evilviper]

On MacOSX, running as an "administrator" is more-or-less equivalent to having "sudo" privileges on a Unix box

So I have learned, quite recently.

That just makes the argument for OS X weaker. It's no more secure, it just happens to have assigned the name "Administrator" to a non-administrator account, the equivalent of "Power Users" on Windows.

Re:What about...

[n8_f]

Umm, no. First, you didn't even have a grasp of the subject you were arguing about. It hardly makes the argument for OS X security weaker because you didn't know how it works.

Second, it is different from Windows. I have never had to enter a password in Windows after logging in. I have admin rights, as does all of the code I run. Period. OS X at least tries for least privilege, only giving you admin rights when you verify you need them.

It is not a good practice to do much of anything as an administrator.

So what is your solution? Have a separate administrator account? So, instead of entering their password, users have to quick-user switch to the only admin account, run whatever they were trying to run, and then enter their password. Great. They still did exactly what they were going to do, but now they are justifiably pissed off at you for your crappy design.

It's no more secure, it just happens to have assigned the name "Administrator" to a non-administrator account.

WTF? How is it not an administrator account? It is part of the admin group. It just isn't root.

Re:What about...

[jx100]

what about the possibility of an app making its own box that looks exactly like the OS box?

I guess more attention on the part of the user is needed, but then the user must also know that an app shouldn't need higher-level access even when it says it does.

Re:What about...

[artMonster]

What to install, best advice in there... "Internet Explorer - No. Internet Explorer (IE) for the Mac OS is no longer being developed, and while support is available now, future security updates are not guaranteed and may not be timely. If IE is operationally required, caution should be used. It is recommended that IE not be used."

Re:What about...

[evilviper]

I have never had to enter a password in Windows after logging in. I have admin rights, as does all of the code I run.

Clearly, you don't even have a grasp of the subject you are arguing about. It hardly makes the argument for Windows security weaker because you don't know how it works.

You clearly aren't paying attention. What Mac OS X calls the "Administrator" is the equivalent of a "Power User" on Windows 2000/XP. It will prompt you if you wish to install a program with Administrator privlidges.

The fact that what OS X calls "Administrator" is really "Power User" does not make OS X any more secure.

So what is your solution?

The solution is to run as a "Power User", not Administrator.

They still did exactly what they were going to do, but now they are justifiably pissed off at you for your crappy design.

That's blatantly untrue. If you have to log-in as a different user, you aren't susceptable to viruses/worms installed via your web browser. If you download a program, and want to install it, that's a completely different matter. But you still can't say it's every bit as secure. You can say it's more convient, but convenience often comes at the expense of security.

How is it not an administrator account? It is part of the admin group.

I could create an "Admin" group on my Unix system if you want. It'll have no privlidges, so no possiblity of compromising my system... Does that make my system more secure than OS X? No, of course not, because the name "Admin" is arbitrarily chosen, and means nothing. If the account does not have root-level permissions, it's not an admin account.

As I said, it's almost the exact equivalent of "Power Users" on Windows. That is NOT an admin account. It's more of an operators group, where you can GET Admin privlidges when you need it. I'm not saying it's a bad idea to do, but it is not an admin account, and comparing it with the Windows Administrator account is disingenuous.

Re:What about...

[evilviper]

It stroke me as very unusual that unlike most anti-Mac trolls[...]

Fact of the matter is, I wasn't an anti-Mac troll until this thread... Go through my comment history before now, and you won't see anything against Apple/Mac.

So basically a Power User can do over 90% of what an Administrator can do. But not everything.

That's absolutely not true. This list is obviously grossly over-simplified.

I've used Windows 2000 extensively, and I can guarantee you, when you try to install something like a Service Pack, it will prompt you for the Administrator password.

Here, let's have Microsoft explain it to you, since you're convinced I know nothing of Windows: http://www.microsoft.com/windows2000/techinfo/plan ning/management/seclogon.asp

That article is a bit long-winded, because it talks about all the different ways you can use it. It doesn't really make it clear you that you don't have to do any of this to use the feature... Just try to install something, and the dialog box will pop-up, asking if you want to run as admin, and prompting for a password.

Re:What about...

[Durandal64]

In other words, an OS X admin is not an admin at all. Just a "power user". So, having an Admin account on OS X is NO MORE (or less) SECURE than a Power User accont on Windows.

No, retard. A power user cannot modify anything he pleases. An admin in Mac OS X can, provided he authenticates. A power user cannot temporarily assume administrator rights the way a Mac OS X administrator can. In other words, if a power user wants to do something he's not normally allowed to do, he needs to switch to an administrator account. That account has a different username, different password, and the power user will not be logged as performing the action. Mac OS X administrators can do anything they want, provided they authenticate.

Saying that OS X is more secure because what is CALLED an administrator, is really an OPERATOR or POWER USER, is absolutely crap.

It's more secure because, even as the highest-ranked user on the system, you must authenticate to perform installs. I explained this in my previous post, which you obviously ignored.

Re:What about...

[evilviper]

A power user cannot temporarily assume administrator rights the way a Mac OS X administrator can.

This is just flatly and totally WRONG. A power user can do exactly that.

It's more secure because, even as the highest-ranked user on the system, you must authenticate to perform installs.

It's bullshit security. If I delete the Root account on my Unix box, it doesn't make Unix suddenly more secure. It's just bullshit. The fact that Windows ALLOWS you to log-in as a true administrator, doesn't make it any less secure, though it does allow someone stupid to use the OS in a less secure way.

I explained this in my previous post, which you obviously ignored.

No, I addressed it. The fact is that YOU are the one ignoring what I explained in my post.

Re:What about...

[Durandal64]

This is just flatly and totally WRONG. A power user can do exactly that.

No, they cannot. According to this, power users can:

• Create local user accounts
• Modify user accounts which they have created
• Change user permissions on users, power users, and guests
• Install and run applications that do not affect the operating system
• Customize settings and resources on the Control Panel, such as Printers, Date/Time, and Power Options
• Do anything a User can

Power users cannot:

• Access other users' data without permission
• Delete or modify user accounts they did not create

In other words, power users cannot do everything an administrator in Mac OS X can. Mac OS X administrators can modify other users' data by entering their password. If a power user, for example, wants to install software which modifies the operating system, he must enter an administrator's username and password. That means that the administrator whose username and password he entered is the one who was logged as performing the action, not the power user himself.

Any user can enter an administrator's username and password to do things they normally could not do in Windows. That does not mean that all Windows users are Power Users. Do you see the distinction yet?

It's bullshit security. If I delete the Root account on my Unix box, it doesn't make Unix suddenly more secure. It's just bullshit.

Yes, everything you don't understand is bullshit. We know. But the fact that there is no root account on a Mac OS X box means that there is one less account with a password to crack. That's why administrators don't create any more accounts on a system than necessary, because the less active accounts you have on a box, the more secure that box is. And if you're seriously going to argue that not having a super-user account on a machine that doesn't need one makes no difference in security, you're simply delusional.

The use of the sudoer system on Mac OS X also makes accountability far easier. When an administrator in Mac OS X performs an action, as opposed to logging in as root to perform an action, that administrator's name is attached to the action, much like Windows administrators. However, Windows also activates a super-user-esque account by default, when the box doesn't really need such an account. That makes it less secure.

The fact that Windows ALLOWS you to log-in as a true administrator, doesn't make it any less secure, though it does allow someone stupid to use the OS in a less secure way.

Any feature in an operating system that could be used to facilitate the compromising of a system can be said to lessen that system's security. The trick is knowing which of these features are necessary to include and striking a balance between usability and security. Having a super-powerful administrator account on your system when regular administrators can already do everything they need to is needless and reduces security.

Lack of safety in numbers

[YetAnotherName]

Given how entrenched Micro$oft's clutches are into the US Government, a security guide for Windows based systems would be even more useful.

(I work for NASA; almost everyone in our group has Mac OS X on our desktops and Linux in the server room. Our supervisor is the only Windows user. Yes, he's developing pointy hair.)

Re:Lack of safety in numbers

[Scutter]

How about this? There are several linked off that NSA page besides this one.

Re:Lack of safety in numbers

[lachlan76]

Had you not brought down the NSA website, you would find them here.

Re:Lack of safety in numbers

[hbackert]

Did you click on the second link in the story? There's a lot for Windows See under "Operating Systems".

Given the fact that I don't use MacOSX, I checked out the Cisco one some time ago and it's quite impressive. Lots of common sense things of course, but some good ideas I would have otherwise not thought about. Definitely recommended.

It's nice to see government agencies not waste our (sorry: your) tax dollars and instead produce something useful and not hiding it in one of their many shelfs.

Re:Lack of safety in numbers

[Andr0s]

A security guide for Windows-based systems ?

Talk about an exercise in futility. I'd put that book right next to Understanding Republican Mindset, Philosophical Debates of Military Intelligence and Filanthropy of Modern Man

Re:Lack of safety in numbers

[general_re]

Filanthropy of Modern Man

I'll put it alongside my copy of Speling Fer Slahsdooters.

Re:Lack of safety in numbers

[Andr0s]

Eh... not all of us in the world are native english speakers. Still, I trust my english spelling & grammar beats your croatian, eh?

Re:Lack of safety in numbers

[CrackedButter]

Yuu cant' nock him four spelling such a werd like phat, knot when their arr werse ofendeers on teh internet. Its' the simmple werds phat anoy me moore, eveybody shold no comon engrish.

Re:Lack of safety in numbers

[general_re]

Just thinking of further exercises in futility ;)

Re:Lack of safety in numbers

[buzban]

It's nice to see government agencies not waste our (sorry: your) tax dollars and instead produce something useful and not hiding it in one of their many shelfs.

I agree that useful government work in this area is great, and i don't mean to assail this poster....but getting things even further out there (i.e., not on a somewhat-obscure sehlf, but somewhere where my clueless, windows-using family would find it.). Wonder if there's a better way that NSA could promote this stuff so that everyday (non-power-) users would find it?

Re:Lack of safety in numbers

[Bequita]

"Given how entrenched Micro$oft's clutches are into the US Government, a security guide for Windows based systems would be even more useful. "

But virtually impossible.

Re:Lack of safety in numbers

[skiman1979]

Did you read the summary of this article? There is a link at the bottom that shows there are NSA security guides for other operating systems as well.

Re:Lack of safety in numbers

[quarkscat]

Isn't that peculiar. I worked for NASA (as a
contractor) for nearly five years, and the only
Mac OS X that I saw was a manager's G.I. laptop
(as a personal preference). Everything else
was NT4 workstations migrating to 2K (and
staying well away from XP). The back-end
servers were all 2K or 2K3, not *nix, let
alone linux. The raw telemetry and spacecraft
(HST) data were all processed on a mix of *nix
platforms -- HP-UX, SGI, and SUN. The contractor
was scrambling to migrate these to SUN, and scrap
the (VME-bus) HP-UX and the SGI's. One of the
reasons I left (besides end of contract) was
the prospect of working nearly exclusively on
Micro$oft boxes.

I guess it really depends upon which NASA project
you're on as to what the IT "pointy heads" select
for their platform of choice.

These things make a nice checklist, but....

[general_re]

....actually implementing everything the NSA recommends in its guides will get you a system that is both highly secure and exceptionally inconvenient for its users. It's a useful reference, to see if you've forgotten anything that you particularly want, or anything obvious, but as always, individual admins will have to decide for themselves where they want their systems to lie on the security-usability axis...

Re:These things make a nice checklist, but....

[siriuskase]

If your sig is to be believed, you are not qualified to advise on the usefulness of this guide.

Re:These things make a nice checklist, but....

[general_re]

Fair enough - I haven't read the OSX version, but I have read the Windows and Solaris guides, so maybe you can settle for extrapolation instead of investigation ;)

You Bastards!

[Anonymous Coward]

Hmm the pdf is downloading at .6 k/s and dropping. Slashdotting the NSA - this qualifies for some sort of Darwin award, doesn't it? :)

Re:You Bastards!

[Tibor the Hun]

yeah very funny.
those punks probably now think that it was a coordinated cyber-attempt to disrupt the election, and now they've got all of our IPs.

Re:You Bastards!

[JamesTRexx]

Always ready to help with foreign support. *clicks furiously on the links from his place in The Netherlands*

Re:You Bastards!

[Goalie_Ca]

I think it qualifies as terrorism.

File Vault

[dumitrius]

This is simply the encryption of the entire user's home directory. I had this enabled on my powerbook stuffed it with a few gigs of data and it ran fine for a while... maybe like 3 months. Then one day on a reboot the thing silently lost all my personal settings and dropped me into a stock desktop configuration. Was nursing this for a week or two when I started getting garbage in some source files. Was thinking maybe the hardrive was defective but have a hunch the enctyption just went haywire and was getting worse. Turning File Vault off failed with an error. Have reinstalled the os keeping a plain text home dir and things seem dandy.

Has anyone seen this before?

Re:File Vault

[MagneticMountain]

I have never seen it personally but I have heard stories on the Mac forums and other places of things like this happening.

I would really love to use Filevault, but I guess you could say I'm just a little scared to turn it on after I have heard stories like yours about how people have had Filevault go haywire and lose their data.

Re:File Vault

[eyegor]

It happened to me too.... I managed to get everything back though. There was a sparse diskimage file that contained my home directory. Once I mounted it, everything returned to normal.

Your milage may vary.

Re:File Vault

[Numeric]

I used FileVault and I was impressed that I was getting such a huge performance hit on my 600mhz ibook, however, one day I rec'd an odd error regarding FileVault. I cautiously decided to play it safe and turn off FileVault.

Re:File Vault

[dema]

Happened to my boss less than a month ago. Spent a long time trying to recover of lot of his shit (some very important files) and had no luck. Long sotry short, no one at work uses filt vault now (: Maybe this is something that will improve in Tiger?

Re:File Vault

[Anonymous Coward]

I had a File Vault eaten when I first installed 10.3 but since some of their updates to it I have been able to use File Vault pretty well when I have tried it. I don't trust it with anything important though so I don't use it on my adminstartor account or on my work account, which is kind of sad. I prefer to use Encrypted DMG files to store stuff I want private but that I only need occasional access to.

Re:File Vault

[Anonymous Coward]

Many people had problems with it first came out. It was caused by the "recovering space" thing not completing before the user logged in again. I still don't trust Apple's default configuration since there are warnings in their own documentation against using a sparse image, which File Vault does.

I've used this hint for over six months now without problem.

On the other hand, it's trivial to get the user's password from swap, unless Apple fixed this hole already, so there's not much point to File Vault right now.

Re:File Vault

[twalls]

That's really sad, man. I had that happen and it scared the crap out of me (I've got a 15GB home directory). One day I logged in and it just sort of stared blankly at me with all the defaults. I blinked, told myself I was having a very bad dream, and logged off. When I logged back in, everything was fine and I breathed a huge sigh of relief! I guess I was one of the "lucky" ones. I keep using it and I haven't had any more issues... yet.

Re:File Vault

[a3217055]

what you can get the passwd from swap ?? Can you please explain ?

Re:File Vault

[Matey-O]

think they coulda named it something better than 'sparse diskimage'? I blew away all my settings (yeah, boo hoo, won't do THAT again) cause the diskimage was roughly the size of the two huge AVI's I just threw away and I wasn't getting my diskspace back after emptying the trashcan.

Name it something like 'Secret Encrypted File' or something...

Re:File Vault

[Daengbo]

I don't trust it with anything important though

Kind of defeats the purpose, doesn't it?

Re:File Vault

[suprax]

Ditto here. Just last week I turned on FireVault and let it runs its course for like 15 minutes. Finally it said reboot but the screen was frozen. Upon rebooting the user could log in but nothing would load at all. It pretty much straight up broke. Luckily I was able to go into single user mode, and could ftp all my data off the machine before reinstalling.

No more FileVault for me. And this was Tiger (yes I know, its not even beta software but I like to test).

Re:File Vault

[ViolentGreen]

Definitely. It's not immediately obvious what it is. I have had several problems with the encryption (though it's been about 9 months since I last used it.) I figure it's not worth my trouble. My powerbook stays at home most of the time and there's nothing especially sensitive on it.

Re:File Vault

[keg]

Same thing happened on my G5.

Found this on macfixit, http://www.macfixit.com/staticpages/index.php?page =20031110093417286

Re:File Vault

[cosmic_0x526179]

Lets just rename it Vile Fault...

(with appol to the Mouseketeer, who in 1984 coined the name VileFision... what happened to him anyway ?)

Re:File Vault

[allgood2]

I've never been a fan of encrypting my entire home directory. I just use Disk Utility to create encrypted disk images for data I want secure. I don't keep a lot of them, but I have about four or five, one for financial data, a couple for projects that have government or HIPAA related data, and some really personal stuff.

This works well, plus the files get backed up, so if the home directory got corrupted or wiped, I can retrieve everything.

Re:File Vault

[hkb]

Was a notorious bug that really pissed me off as I lost all my files and of course, didn't have a backup. It was fixed several OS revisions ago and I've been using it for at least 8 months or so. Seems to work flawlessly, haven't had any corruption yet. I do A TON of writes with this File Vaulted account. No problems at all since the fix.

Re:File Vault

[dumitrius]

I doubt it's been fixed properly. Keep in mind this happened between July and September 2004 and the OS was patched to the latest version the entire time.

Re:File Vault

[tji]

I didn't use the default File Vault, which encrypts your whole home dir.. I thought the performance hit could be problematic on things like huge iMovie/iDVD projects.

Instead, I used the Disk Utility to create an encrypted sparse diskimage. It's basically the same thing as File Vault, but you selectively put what you want into this other mounted volume. It has worked well for me. I've had no problems after using it for about a year.

The only hassle I have had is that I need to manually mount my "Secured" volume whenever I log in. Since I have some files soft linked into the secured volume, it can cause problems if I forget. There is probably some way to automatically mount it when I log in, but I have not found it yet.

Re:File Vault

[ConsumedByTV]

Loop-aes isn't vulnerable to this because it can be used to encrypt swap in a way that's not *as* vulnerable to encryption implementation attacks.

Unless you can encrypt your swap, mlock() and other attempts to secure it, cannot work 100% of the time.

It's also worth noting that this is basically a must have part of any disk crypto stuff. loop-aes does this and it talks about this quite extensively. It hasn't been implemented by apple yet but I heard that tiger may have a fix for it.

What makes me worried is that it seems since it's passphrased based (and the passphrase is whats in the swap file) it's not hashing the password with any sort of salt. That worries me.

Loop-aes isn't vulnerable to this, where as other linux implementations are very vulnerable to this.

Re:File Vault

[mj_1903]

Tiger allows you to encrypt the swap files. Kind of overkill, but it should fix this problem.

Re:File Vault

[Large Green Mallard]

Details at http://matt.ucc.asn.au/ramble/archives/monthly/200 4-06.html :)

Re:File Vault

[Razzak]

I did in the first 2 weeks FV came out. Something about sleeping the CPU while FV was recovering disk space. The update 3 days later fixed the problem for me, but it did take me a month to trust FV again. :(

In other news...

[eventDriven]

The U.S. Governement's ultra-secret monitoring system 'echelon' was briefly unavailable after the NSA's web servers were Slashdotted.

NSA Security Guide

[Anonymous Coward]

Always leave an NSA auto-secure port (9999) open on your machine.

Disregard any unexplained background executables.

Always use IE when surfing.

Confine all discussing of terrorist/anti-government actions to public networks (or private ones, we don't really care)

Security, Usability, Reliability

[stratjakt]

Pick any two.

Re:Security, Usability, Reliability

[rxmd]

Pick any two.

Or less (read: Windows 95)

Re:Security, Usability, Reliability

[GoofyBoy]

I was just about to say that Windows 95 is a good example of this point.

Loads of games still being produced which still run on 95, alot more than Macs. Usability.

And as more people move on to XP or other systems, blackhats are slowly turning their attention away from 95. Just don't use IE. Who makes new viruses for DOS?

Re:Security, Usability, Reliability

[rxmd]

I was just about to say that Windows 95 is a good example of this point.

Loads of games still being produced which still run on 95, alot more than Macs. Usability.

Lacking a bit in the security and reliability departments, though.

Re:Security, Usability, Reliability

[stratjakt]

A lot of people still run it nearly a decade later. That's the real litmus test for reliability, in my books.

People know, if all else fails, it takes about a half hour to format and reinstall and they're playing games again.

Reliability on a desktop or gaming machine doesn't necessarily have to measured the same way a server is.

Re:Security, Usability, Reliability

[Foresto]

I remember when people said the same thing regarding telnet and rsh. Now we have ssh with private key authentication. It's secure, reliable, and at least as usable as its predecessors. I know the combination is uncommon, but we can have all three if we apply enough thought and creativity.

Re:Security, Usability, Reliability

[harikiri]

You could also say the same of CIA:

Pick any two:

Confidentiality
Integrity
Availability

Slashdotted already?

[BandwidthHog]

Alright, we've slashdotted the NSA!!!!!

Now we can safely do, umm, whatever it is that we thought we couldn't do safely while the NSA had an active internet connection. Psst, any terrorists out there need a browser with 128-bit SSL enabled?

Re:Slashdotted already?

[drinkypoo]

Be careful; a teenager in grass valley, CA was recently picked up by the FBI because, when asked on the web if he would like to meet bush, he said yes because he'd like to punch him in the nose.

Welcome to amerika, folks. It's too bad Bushism already means a horrible verbal flub in which you mutilate the American version of English on national TV, or in a press article, because this is awfully similar to McCarthyism.

Re:Slashdotted already?

[networkBoy]

Got a media reference? I live in the area and have heard nothing about it.
-nB

Re:Slashdotted already?

[stanmann]

Yes, indeed be careful since it doesn't matter who you threaten publicly, if the police determine it to be credible you can be incarcerated.

Re:Slashdotted already?

[zrail]

Thats because it was a SECRET warrant issued by a SECRET court. The only reason he knows is because his tinfoil hat somehow intercepted the FBI's radio communications.

Re:Slashdotted already?

[dswensen]

Threatening the President has been illegal since long before 9/11 or George W. Bush.

True story. Back in 1990, one of my co-workers, whom I think was mildly ill in the head, called up the state capital when George Bush Sr. was coming to town, and told them he was going to shoot the President. The Secret Service came and took his ass away. He came back about a year later, and never really explained to anyone exactly where he'd been. Of course, he came back crazier than ever...

So yeah, don't threaten the President. It doesn't have anything to do with "Amerika;" you just can't expect the government to brush off any statement about killing or harming world leaders as a joke.

Re:Slashdotted already?

[Mark of THE CITY]

Slashdot effect == non-automated DDOS

Re:Slashdotted already?

[drinkypoo]

He said he'd like to punch him in the nose. He didn't say he would punch him in the nose. In the dictionary and in court, there is a difference.

Re:Slashdotted already?

[UserGoogol]

Oh, but don't you think for a minute your Dad wasn't put on Nixon's enemy's list. Yup, right after Checkers.

Re:Slashdotted already?

[Knetzar]

That's not good...I took a picture of myself punching a cardboard cutout of W...

Hmmm, I wonder who's at the door

Re:Slashdotted already?

[john82]

He said he'd like to punch him in the nose. He didn't say he would punch him in the nose. In the dictionary and in court, there is a difference.

To the Secret Service there is not. And in the case of the Secret Service's mandate for protective services, you WILL lose in court. Take your dictionary and stupid behavior to jail with you.

From the USSS:

Today, the Secret Service is authorized by law to protect:

* the President, the Vice President, (or other individuals next in order of succession to the Office of the President), the President-elect and Vice President-elect;
* the immediate families of the above individuals;
* former Presidents, their spouses for their lifetimes, except when the spouse re-marries. In 1997, Congressional legislation became effective limiting Secret Service protection to former Presidents for a period of not more than 10 years from the date the former President leaves office.
* children of former presidents until age 16;
* visiting heads of foreign states or governments and their spouses traveling with them, other distinguished foreign visitors to the United States, and official representatives of the United States performing special missions abroad;
* major Presidential and Vice Presidential candidates, and their spouses within 120 days of a general Presidential election

Re:Slashdotted already?

[drinkypoo]

Stupid behavior? There is no free speech when you cannot say that you would like to punch someone in the nose. Our constitutional rights are nonexistent.

Screwed up

[AKAImBatman]

Yikes! The replies to this story are completely screwed up. I'm starting to feel sorry I ever tried to make a joke. I figured others would have something more insightful to say. Well, since no one else will, I'll try to say something insightful.

It seems to me that most OS X users are pretty quiet on the topic because they can't find anything to say. Not because they're ashamed, but more because OS X Just Works(TM). Since the OS Just Works(TM), security guidelines like this are nothing more than hints on how to prevent users from accidentally opening security holes.

Contrast this with Windows, where everyone is always looking for the "magic solution" that will allow them to completely close of the machine from attack. Yet Windows insists on requiring various services (e.g. RPC) to be running and publicly available before it will run properly.

Some might argue that OS X is so secure because the developers had an opportunity to view OSes which came before them. This may seem like a reasonable argument, but quickly falls apart once OS X's heritage is investigated. You see, OS X is really the next major release of NeXTSTEPl an OS that pre-dates Microsoft's creation of Windows NT & 95. NeXT got it right back then. Why can't other OS makers get it right today?

Re:Screwed up

[rdc_uk]

We cannot comment on the report, because we cannot read the report; because we have /.'ed the server.

Oh bitter, bitter irony!

Re:Screwed up

[baywulf]

Lex: "It's a UNIX system! I know how to tokening this!"
Yacc: "It's a UNIX system! I know how to parse this!"

Re:Screwed up

[AKAImBatman]

You're telling me there are no Mac users (besides myself) that can see The Mysterious Future(TM)? Very well then. Here's a preview of the next article. SuSE 9.2 is out. There, I said it. Now prepare something insightful to say. :-)

Re:Screwed up

[athanis]

A lot of users that I come into contact with seem to have a false sense of security. They seem to think that if they have an antivirus software, then their computer would become immune...
But I think more needs to be done to educate the public that security isn't any single software/component, but rather, a process.. From passwords, to firewalls, to antivirus, to spyware, there are many parts to it.

I think it's unfair to blame the OS solely. Application developers need to be aware of bugs and potential problems. No matter how hard you idiot proof a system, they will build a better idiot, as the saying goes.

Re:Screwed up

[mobby_6kl]

>Some might argue that OS X is so secure because the developers had an opportunity to view OSes which came before them. This may seem like a reasonable argument, but quickly falls apart once OS X's heritage is investigated.

I don't know whou would argue like that but yeah, you are probably right, it's not in the heritage, at least not on Apple's side. Still, it's very simple: OSX is so secure becasuse it's based on BSD!

Re:Screwed up

[Otter]

You're telling me there are no Mac users (besides myself) that can see The Mysterious Future(TM)?

How I am supposed to afford a Mac and a Slashdot subscription?

(Just kidding...please don't start posting Dell comparisons..I know already.)

Re:Screwed up

[legirons]

"Yet Windows insists on requiring various services (e.g. RPC) to be running and publicly available before it will run properly."

Hmm...

# nmap localhost

25/tcp open smtp
1024/tcp open kdm
6000/tcp open X11


And that's Debian. Mandrake had about 10 ports open by default, including SUN-RPC and I think it opens NFS and CUPS by default if you choose certain configuration options. Debian also had a whole host of finger, time, echo, etc. ports open by default.

What's worse? That I can't install a firewall without recompiling the kernel.

Re:Screwed up

[RzUpAnmsCwrds]

As of SP2, RPC no longer allows external access. UPNP and file sharing now only accept connections on the local subnet. The firewall is on by default and it blocks almost all incoming connections.

XP SP2 is a different OS from the one released in 2001. It's time to start recognizing that.

Oh, and a preemptive attack on the "Apache is more popular and it's more secure than IIS":

IIS6 has 2 announced security veulnarabilities since its release over a year ago. Apache2 has more than 20 in the same period, not counting OpenSSL veulnerabilities.

Re:Screwed up

[jerw134]

What is this? Facts? On Slashdot????? Who do you think you are, anyway? Facts are not welcome here. Please do not post these again.

Re:Screwed up

[Erik Hollensbe]

I guess I'm not seeing it.

I don't know what the future is, but I know I traded in 8 years of "Linux as a Desktop" usage for a $2000 Mac because my time is not free, either. $2000 has saved me a lot of frustration so I can make my servers better, where hard-nosed configuration really does matter.

I just want my workstation/desktop to work. I don't care if it has whizbang monkey desktop 2.0 with fancy themes. I just want to install applications, the OS, and forget about it. I want to write shell scripts which help me get work done, not scripts to boot me into my GUI with the options that I want.

I guess the Mac gives me that now, along with a consistent user interface clean enough that really only compares to WindowMaker in the GNU world, and basically puts WM down like the NeXT-wannabe it is (I know the WM guys work hard, but it's just not the same).

Even if I can plop in a CD and SuSE installs for me without ever asking me a question, gets everything right, calculates the ultimate answers of the universe, the fact that the Mac interface is so intuitive that it's spoiled me will take a small act of god to even get my attention on the desktop.

And considering I trashed a SuSE 9.1 install to buy a Mac, I think I know what I'm talking about.

Counterintuitive...

[Anonymous Coward]

Since it's a security site, I'd expect it to display a warning and disable the site if you are clueless enough to accept the cookie!

You gotta start with the fundamentals...

Re:Counterintuitive...

[jerw134]

So, what exactly does accepting a cookie have to do with security? I can't seem to figure that one out.

If you would have said privacy, you could possibly have had a point. But security? No way.

Re:Counterintuitive...

[jerw134]

Sorry, but no. Nice try though.

Guide for Linux?

[brandonp]

This is very cool, is there also a Security Guide for Linux? Sounds really helpful.

--
Brandon Petersen
Get Firefox!

Re:Guide for Linux?

[Zinho]

It doesn't look like they're maintaining a current document on Linux. Their comprehensive list of current configuration guides does not list any, in any case. I did find their list of archived guides, which has a guide for Apache 1.3.3 on Red Hat 5.1 - it had the following explanation for why guides get into the archive:

NSA has developed and maintained configuration guidance for a number of products. Over time these products age, are superceded by newer versions, or are no longer used by it customers. As such, NSA may choose to discontinue maintenance and archive some of these guides.

So it looks to me like they're not supporting Linux with this program, regardless of the fact that someone else in the organisation is builing SELinux. Sounds like a classic case of right-hand not knowing what the left hand is doing...

Re:Guide for Linux?

[Anonymous Coward]

They actually have their own distribution.

Keychain Access Gripe

[finkployd]

I finally found something about OS X that I absolutely hate and is making me question the entire OS. OS X has its own digital certificate/private key cache (which also stores passwords, but that is irrelevant), which is convenient for applications that use certificates and private keys for identity (like safari and mail.app). It also has a nice utility for managing this environment (Keychain Access).

HOWEVER, Apple (for reasons I cannot fathom) has decided to not allow keys and certs to be exported from this cache. This is totally unacceptable and horribly wrong. In this email, which confirms my worst fears, Peter Sagerson says it best:

In Jaguar, private keys are never exportable. This seems kind of silly, since my digital identity should be linked to me, not the platform, the machine or that particular (and transient) installation of the OS. In Panther, Keychain Access has an Export command, but it's never enabled. I don't see a Keychain-level API for key export and the CSSM API doesn't seem to work. So it's hard to tell what the intention is.

The intention seems to be the very incorrect idea that the digital identity belongs to the computer, and not the person. I have figured out how to move my cert and key to another Mac, that is simple creating a new keychain, copying certs to it, and moving the new keychain file to another machine. However, I still cannot get them out of Apple's proprietary format to move them to any non-OSX platform. I have posted this question to Apple's usually helpful discussion forum, but have received no answer.

This is most disturbing and calls into question both Apple's competency with regard to security in general, and their intentions with regard to what the user can do with their own data (or in this case, their own identity)

Re:Keychain Access Gripe

[AKAImBatman]

Am I the only one who thinks that computers should start shipping with a pack of smart cards? You simply create your identity on the card, then it acts as a universal "computer key" for computers you have access to. i.e. One could think of it as a car key for their computer.

Such a design would be pretty transparent to users, and could easily fit in with the way they expect day to day things to work. You can even recommend that they make a backup card at card creation time, so that they can stash it in a safe place (say they lose their original card or something). When the backup card is inserted, the user would be prompted to revoke the old keys and create a new key set.

Re:Keychain Access Gripe

[amake]

I don't know about your specific situation, or much about certificates in general, but I have a Thawte free email certificate that came as a .p12 file. Opening that file in Keychain Access added the cert to my Keychain, but the file still remains, and is perfectly portable (I make use of it every time I have to trash my Firefox profile). Did you not get your cert this way? Did you just not keep the original file? Because if that's the case, that seems more like your fault than anything else. I agree, though, that Apple should allow exporting of Keychain certificates.

Re:Keychain Access Gripe

[finkployd]

Everyone has USB, why not use this instead of requiring a card reader?

Excellent idea though, I have been in support of that concept for a while. This could be extended to requiring a password to unlock the private key on the card/usb drive or even have a small thumbprint reader on the card/usb drive itself to unlock the key. This would remove my major complaints about biometrics (ie replay attack)

These technologies all exist and would be simple, but people simply do not see the need for them so there is no demand (outside of of some rare government, education, and corporation groups). Unfortunately the average joe is content with a digital world that relies completly on his mother's maiden name for authentication :(

Finkployd

Re:Keychain Access Gripe

[AKAImBatman]

Everyone has USB, why not use this instead of requiring a card reader?

The only reason is that smart cards are cheap. I can pack all the security info I need on a card that costs $1.00 - $5.00 each. In comparison, a USB key has to have a variety of communications electronics that make its minimum price somewhere arounf $15.00 a key.

So it's really a matter of economics. :-)

Re:Keychain Access Gripe

[MoneyT]

Well, it's not the best solution, but if you want to move your keychain from one computer to another, just open the Keychains folder in your User library (~/Library)

Re:Keychain Access Gripe

[finkployd]

Same issue with the readers through right? When you factor them into the cost.

Re:Keychain Access Gripe

[finkployd]

I know, I mentioned that, but that only helps if you are talking about another OS X computer. What about a Linux box or a Windows box?

Re:Keychain Access Gripe

[AKAImBatman]

Not really. A reader is a $10-$20 part that can easily be added to any system. An external reader could easily market for $20-$50. The end result is that the smart card is going to be cheaper in the long run. (Keep in mind that each person who uses the computer is going to need two cards/keys. Things get particularly dicey in family situations.)

If you look at a diagram for a smart card sometime, you'll notice how simple the things are. Basically, they fab small RAM, ROM, and processor chips right onto the card itself. This makes them cheaper to produce than wiring components together on breadboard, then encasing them in plastic.

Re:Keychain Access Gripe

[AKAImBatman]

Just to add to my previous post, I checked out card readers and such after I posted this idea a few months ago. I've been kind of infatuated with building my suggested system since then. :-)

Re:Keychain Access Gripe

[finkployd]

Right, but what you just told me is that a reader is more expensive than a usb token. Imagine a corporation where every person has their own PC and thus every PC needs a reader (not to mention they need to get them for their homes likely as well).

Ideally manufacturers would make smart card readers standard. IBM and Dell have been promising that to me for four years straight now. I only see a few specility models with them.

Why does each person using the computer need two keys/cards?

Re:Keychain Access Gripe

[eMartin]

You can also just make a new keychain file where you want it, and use that.

Re:Keychain Access Gripe

[AKAImBatman]

Right, but what you just told me is that a reader is more expensive than a usb token.

Actually, I believe I listed the USB token as a MINIMUM of $15, while I gave the reader range as $10-$20. Consumer prices are always much higher. i.e.:

Cheapest Amazon USB key
$25 External SmartCard reader
1K SmartCards
8K SmartCards

So to a consumer buying all the equipment, Smart Cards and USB keys are competitive on a 1 USB Key vs. 1 Smart Card + Reader basis. Now remember the backup. 2 USB Keys are significantly more costly than 1 Smart Card reader + 2 Smart Cards.

And if the card readers are built into the system, the cost will be hidden from the user (although it's MUCH cheaper still). And smart cards are so cheap, the manufacturer can include a 10 Pack.

Re:Keychain Access Gripe

[finkployd]

And if you just want to export the data from the keychain in human readable form, try man security

security dump-keychain -r looks like what I want but it throws it out in a format I have never seen before. It is certainly not PEM or DER encoded.

Re:Keychain Access Gripe

[macshome]

You should check out the security command man page. It has examples for finding certs and dumping them out to a pem file.

Examples
security> find-certificate -a -p > allcerts.pem
Exports all certificates from all keychains into a pem file called allcerts.pem.

security> find-certificate -a -e me@foo.com -p > certs.pem
Exports all certificates from all keychains with the email address mb@foo.com into a pem file called certs.pem.

Re:Keychain Access Gripe

[finkployd]

Cert yes, but keys?

Re:is there a reason why the NSA won't

[jasonbowen]

I guess you haven't heard of SELinux?

NSA Guide to securing Windows computers

[Roadkills-R-Us]

Step 1: Pack Windows system in appropriate shipping container
Step 2:Mark container "Target"
Step 3: Have courier deliver container to nearest FBI shooting range

Re:NSA Guide to securing Windows computers

[patman600]

Sure, just add even more holes to the system...

What about users of other OSes?

[athanis]

How come the NSA only publishes guidelines for the MacOS? Actually, I think that with the recent onslaught of network vulnerabilities, government organizations would do well to educate the public more about security.

In fact, where I live (Hong Kong), the government had a radio show where there would be a quick tip about securing your machine. Obviously, the focus was on Windoze, but anything that elevates the awareness of the general public to computer security is a good thing.

Re:What about users of other OSes?

[skiman1979]

um... they don't just publish guides for MacOS. NSA has security guides for other operating systems as well. Check the last link in the article summary.

Re:What about users of other OSes?

[gobbo]

I remember hearing a radio show a few months back, maybe it was the show about the spying game on CBC's Ideas, about how OS X is becoming a preferred platform for some NSA-affiliated government spy agencies. Ease of configuration for decent security and quick development platform, unfamiliarity with the platform by many means better stealth, and the fact that many bad guys are OS X switchers too. You won't read that on Apple's switch campaign site.

And in other News.....

[mbrewthx]

The infamous CowboyNeal was arrested today at his private hovel. The Department of Homelnd Security issued a statement saying that he was the head of a secret conspiracy to disrupt the online functions of the NSA. There was no comment from CowboyNeal or his attorney a Mr. Taco. But he is said to enjoying Steak Tar Tar with his prison mate Martha Stewart. Mr. Neal's activities apparently caused serious lag in the NSA's end of the month CS tournament.

Re:And in other News.....

[Ohreally_factor]

So how did Cowboy Neal wind up in a women's prison?

Wait! Don't answer that!

Re:is there a reason why the NSA won't

[psyconaut]

They did, didn't they? In the form of their own Linux distribution.

http://www.nsa.gov/selinux/

If you read the source and documentation, it's quite clear what they did. Producing a "boiler-plate" security document for all Linux distributions would be futile -- there are too many variables involved.

A commercial product such as OSX is quite a bit more linear, and this easier to release a straightforward guide.

-psy

Re:Slashdotted already? Nope.

[Roadkills-R-Us]

They didn't /. us^H^Hthe NSA.

They /.'d the NSA OS X hacker honeypot. Traffic recording and analysis is proceeding just fine, thank you. As are the webcams. I hope your co-workers don't use that keyboard-- don't you have a handkerchief?

They're... still... up

[twalls]

Several people have already called the slashdotting. They're still alive and kicking! Gotta give em credit for trying. "Mr. President, we're giving her all we can! She just doesn't have enough bandwidth!" "Well, why not just use one of the other Internets?"

Another excellent OS X security guide

[daveschroeder]

Corsaire Ltd has an excellent practical OS X security whitepaper in this same vein.

http://www.openbsd.org

[Triumph The Insult C]

pick all three

Re:http://www.openbsd.org

[poohsuntzu]

It is, unless you didn't read the manual?

Or did you need the fedora interface to help you install Linux?

Re:http://www.openbsd.org

[Erik Hollensbe]

Of course, until you actually DO anything on the machine.

Re:FU SLASHDOT

[berbo]

I agree grandparent is childish, but I also agree the moderators smoke crack.

Not all of us - some of us prefer Guatemalan insanity peppers.

Mirror anyone?

[Swedentom]

Anyone got a mirror of the security guide? I'm downloading the PDF at 0.3 KB/s. :-)

Re:Mirror anyone?

[npongratz]

I'm probably stating the obvious, but here's the mirror:
http://mirrordot.org/stories/111603fdae30 b9727bb43 2e622eff8e3/osx_client_final_v.1.pdf

Re:Mirror anyone?

[scottj]

Why is this post moderated as redundant? As far as I have seen in this thread, there is no mirror out yet. And most are downloading at 500Bps or less. Mirror, please?

Re:Mirror anyone?

[scottj]

Mod parent up please!

Re:Mirror anyone?

[monkeymonster]

(puts on tinfoil hat)

Yes, but how do we know this is the *real* pdf, and not some nefarious, elaborate man-in-the-middle tampered pdf, full of info that will make your computer less secure???

(puts on second tinfoil hat)

For that matter, how can we be sure the original pdf isn't really designed to make your computer more accessable to the NSA???

(really, though, thanks for the link, although there really probably is some statement about security in the fact that I'm downloading a guide from an untrusted source;)

Keychain itself deisgned to be portable

[daveschroeder]

Apple is most certainly not tying digital identity to the computer.

Your Keychain, in ~/Library/Keychains, is perfectly portable, and designed to be moved from computer to computer, or stored on a device for storing such tokens, such as a USB flash drive.

Further, that certificates are even in your keychain at all implies that you should have access to the original source certificate files, which clearly remain portable.

And finally, rumor has it that Tiger will include much more advanced features for managing, importing, and exporting certificates and CAs.

Re:Keychain itself deisgned to be portable

[finkployd]

Your Keychain, in ~/Library/Keychains, is perfectly portable, and designed to be moved from computer to computer, or stored on a device for storing such tokens, such as a USB flash drive.

I mentioned it is possible to copy keychain files. Which is perfectly fine if you are only talking about OS X computers, but that isn't the only OS out there. Calling keychain portable is fine as long as you note that the portability is only extended to other Macs.

Further, that certificates are even in your keychain at all implies that you should have access to the original source certificate files, which clearly remain portable.

False, if you generate a personal identity cert using a service like Thawte or Verisign (which do this over a web interface) then the private key is generated as a request from their webserver on your machine, and ONLY stored in Keychain. Try it yourself, use Safari and go to Thawte's page and create a personal cert. The cert is downloaded in whatever format you desire, but the key is generated locally and there is NO way to get it out of Keychain (despite the permanently grayed out "export" menu option).

This kind of situation does not happen on any other OS. (and arguably wouldn't have happened on OSX had I used Mozilla or Firefox to generate the private key).

Lastly, what happens to the person who maybe generates their private key using, say, openssl and then imports it to keychain? Practicing good security maybe they decide that having multiple private keys is bad and the delete the file assuming that it is possible to export a private key out of Keychain. Is that such an unreasonable assumption? What good reason is there for OSX to not allow you to do that?

The changes to Keychain you referenced are certainly welcome (since that app has hardly changed at all over the years and could do much more), but I wonder if they will fix the exporting problem? I certainly hope so.

Finkployd

Re:Keychain itself deisgned to be portable

[MoneyT]

What about dumping the keychain in plain text and taking the data from there and migrating it to a new system?

Re:Keychain itself deisgned to be portable

[Yaztromo]

False, if you generate a personal identity cert using a service like Thawte or Verisign (which do this over a web interface) then the private key is generated as a request from their webserver on your machine, and ONLY stored in Keychain. Try it yourself, use Safari and go to Thawte's page and create a personal cert. The cert is downloaded in whatever format you desire, but the key is generated locally and there is NO way to get it out of Keychain (despite the permanently grayed out "export" menu option).

I don't know about Verisign, but Thawte at least keeeps your keys on file on their web server. If you need to transfer them to another system, just log into their site and retrieve the keyset again.

Yaz.

Re:Keychain itself deisgned to be portable

[finkployd]

What about dumping the keychain in plain text and taking the data from there and migrating it to a new system?

If you read my original post, that is exactly what you cannot do with keychain, and the basis of my complaint. There is no way to get data out of keychain in any standard format (PEM, DER, etc)

Re:Keychain itself deisgned to be portable

[MoneyT]

But you can dump it in plain text:

security dump-keychain -d

you can also specify -r to dump it in raw format

Pardon Me while I take a NAP while waiting for my

[sir lox elroy]

download to complete, DOH it's now stalled. /me wants to call the NSA and ask if they can mail me a printed version of the document it would be faster

Here's a summary

[DevolvingSpud]

To secure your Macintosh, please download the NSA_KEY file and place it in your system directory.

(For those who missed this way back when, here's a good summary: http://cryptome.org/nsakey-ms-dc.htm

Re:is there a reason why the NSA won't

[skiman1979]

As the grandparent said, a linux guide could be useful. For some reason, I thought NSA had a linux guide. I've never actually used SELinux, but I did see SELinux options in the 2.6.5 kernel configureation under Gentoo. From what I understand, SELinux supports Mandatory Access Controls, in addition to discretionary access controls like other OS's do. Of course the user applications would also need to support this.

It's a little more complex than that

[SethJohnson]

FIle Vault is actually an encrypted file system. It mounts your user dir as a volume and accesses the data on that system via the key you create.

Yes, the nature of this architecture means that there can be zero disk corruption or you won't be able to mount it. So in a normal disk corruption setting, you would lose a few files or somthing. Having your user dir as an encrypted volume forces a sort of checksum on all the data and if even a single byte is incorrect, then the whole thing fails to mount.

It's actually a very secure method of storing your user data. Performance-wise, I've noticed that you can't use iMovie to import video files to your home dir if you're using file vault. The overhead on writing to the encrypted file system is too much for my 1.3gz powerbook. The video import is all kinds of choppy. Importing to the regular hard drive is fine, though.

Re:is there a reason why the NSA won't

[jasonbowen]

As the great grandparent said, "Do they only help out commercial outfits?" I answered that.

MacOSX attacks...

[mveloso]

Attacks on MacOS X will be driven by user interaction.

The biggest problem for malware writers in MacOS X is that it's hard to remotely attack the box.

Mac OS 9 and its ilk were pretty much impossible to compromise remotely, because, well, they were designed as single-user OSs with no network services (no network daemons) installed by default.

Mac OS X isn't quite like that, but it's close. The downside is all those bsd-level things probably have holes of one sort or another. Has anyone actually checked the robustness of Apple's X-11 implementation? .

OTOH, it's must easier to get the user to click and download something. The "prompt for your admin password" thing is great, but everyone does it without thinking these days, giving any installer root access.

Once that happens, you can install anything, anywhere, and given the structure of MacOS X you can hide your stuff in places a normal user won't be able to find. The "Opener" guys (see www.macintouch.com) should have edited the rc scripts, not stuck their stuff in /Library/StartupItems.

Luckily, the web/email based attacks haven't worked so far (unlike on Windows), so you really do need to get someone to run an app. These days that isn't as hard as it used to be.

Apple could protect against that by doing a system restore/diff after every installer run. It would be useful after-the-fact, and most users may not understand any of it, but it would be nice to have. Or (assuming the metadata stuff works in tiger) you could stash metadata info on the installed files somewhere, then search across your filesystem for matching stuff?

Ideally (and this is what MS tried) each publisher would sign all their files, and that sig would be part of the file metadata. So you could list, see, and search across it. Malware would bypass that, though, but you never know.

Re:MacOSX attacks...

[Matthias Wiesmann]

Has anyone actually checked the robustness of Apple's X-11 implementation? .

Well, given the fact that it is XFree86 4.3.0 it is as robust as on Linux or other BSD...

A Tinfoil Moment

[sockonafish]

I got curious while waiting for my 300 byte/second download to complete and decided to see what nmap had to say about nsa.gov.

Shortly after I began, I was unable to access any network resources. Shortly after I stopped, I was able to access things again.

Can anyone else provide a port scan of the nsa without being DOS'd?

Re:A Tinfoil Moment

[dn15]

Interesting, but I just fired up Network Utility and started a scan on their server and nothing happened. Network access remained unaffected.

Re:A Tinfoil Moment

[sockonafish]

It's quite possible that it may have been just the policies of my school's network, though I've never had a problem port scanning before.

I was able to do so from home. It took 692 seconds to determine that only 80 and 443 were open. Those NSA are paranoid.

Re:A Tinfoil Moment

[tormedhammaren]

> I got curious while waiting for my 300 byte/second download to complete and decided to see what nmap had to say about nsa.gov.

Famous last words.

We need a mirror!

[gibbsjoh]

Just to second the parent's request, is there a mirror??? I'll mirror it as soon as I get it.

NSA.gov runs windows 2k

[valkraider]

According to Netcraft

I smell another Visa ad

[Ohreally_factor]

Smartcard =$5
Reader = $11
Abduction and implantation of RFID chip by aliens = priceless

Re:I smell another Visa ad

[AKAImBatman]

Seeing the look on Ohreally_factor's face after he gets modded down for confusing Smart Cards and RFID tags?

Priceless.

For everything else, there's RTFM. :-)

Re:I smell another Visa ad

[Ohreally_factor]

For everything else, there's RTFM. :-)

Heheh.

I was just jumping a step from bio keys (thumbprints, retinal scans, drops of blood) to the Next Big Thing(TM). Sorry for the confusion. Many teachers harassed me for not showing my work, to little avail.

Seriously (or semi-seriously), having your computer(s) recognize your surgically implanted RFID tag isn't that big a leap from what you're talking about. I'm sure it's not a path that either you or I want to tread, but it is a possibility.

It's too bad these won't last

[ubrgeek]

The NSA has decided that they don't have the resources to continue putting out new lockdown docs. They're going to let the vendors do it for them. No joke.

Password length related...

[cft_128]

I blinked, told myself I was having a very bad dream, and logged off. When I logged back in, everything was fine and I breathed a huge sigh of relief! I guess I was one of the "lucky" ones. I keep using it and I haven't had any more issues... yet.

I've had both problems happen (the bad and the recoverable), the bad one has not happened since I updated to 10.3.1. For the recoverable with a re-login one, near as I can tell this comes from some legacy 8 character password weirdness. As this post indicates, if you have upgraded your computer from jaguar to panther you will only need 8 characters of your password to be correct to log in. What I have noticed is that is FileVault does not have the 8 char limit and needs *all* of the characters in your password to be correct. This causes some weirdness if you have a 12 character password and have a typo in the 10th character: you will be logged in but not see any of your data. The really stupid thing is there is no error message displayed*.

Having said that, I haven't had the problem crop up in a while so they might have fixed it.

*Sort of: if you do not have FileVault on, your keychain will choke and ask for your password again.

Opps, forgot to add

[cft_128]

I forgot to add, to get around the inherited 8 characeter flaw, just change your password. That will change it from the old-school 8 character password to the new longer one.

Re:You spelled it wrong

[Warlock7]

Not exactly. Next time you might want to look it up first.

PDF Signed?

[bluepinstripe]

My download of the PDF has not finished yet--and has two more hours to go (Slashdoted?). I was wondering if the document is signed in any way? It seems given the nature of the document and the fact that it is being distributed by the NSA that it should be signed.

Re: You spelled it wrong

[wheatwilliams]

The Americans spell it one way, and the British (and all other English speaking peoples besides the Americans) spell it the other way. Same with "color" and "colour" and many other examples. It's been that way since the American, Noah Webster, wrote his dictionaries the early 1800s. He not only single-handedly "reformed" English spelling, he also wanted to create a distinction between "American English" and that of Great Britain, possibly for political reasons or a sense of nationalism. http://en.wikipedia.org/wiki/Noah_Webster

Windows...

[Ayanami Rei]

You don't use an administrator account.
You log in as yourself, and use Run As...
You could set up multiple Run-As users with varying levels of access if you wanted.
The only thing Windows lacks is the concept of a "wheel" group, users who can't even try using a switch-user command.

Okay, IIS6 isn't insecure.

[Ayanami Rei]

But it still kinda sucks (really).
Anything really powerful is tied up in the expensive IAS product.
Contrast to apache/tomcat and related tools. All free, and you don't need an expensive server license for your machine.

Why anyone would want to use it except to expose a COM object with XML-RPC or something is beyond me.

Also, NSA says don't install it.

[Ayanami Rei]

Probably because securing XDMCP and figuring out xauth is not exactly simple. If OSX's X11 came with XDMCP disabled and a local unix socket only for making connection (otherwise proxied through ssh) it would be cool.
I don't suppose that's the default ... -_-

OT, your sig Re:Slashdotted already?

[zsau]

Regarding your sig 'The American way of life is vastly overrated; vote for Bush.'

Is it just a coincidence that 'American way of life' acronymises to 'AWOL'?

Re:OT, your sig Re:Slashdotted already?

[BandwidthHog]

Holy shit!!11!!!eleven!!!

Yes, that is totally coincidental. Wow.

My last sig was "Backronyms Are Strengthening Terrorists And Reducing Domestic Security."

File Vault needs to be Perfect

[bill_mcgonigle]

I haven't seen the problem myself but I'm not surprised you did either, especially if you got a few bad sectors on your disk. FileVault is doing complex things and it has to work perfectly which no software really does.

So, I do a full backup every few nights to a second disk. Still encypted, but another copy of it. If I started to have trouble I could always use the backup sparseimage.

I also keep a password on my sleep/screensaver. This way if my iBook gets stolen I only have to worry about the monetary loss, not a loss of IP or security. Insurance covers the monetary loss. Unless they can crack my obscure passphrase they're going to have to reformat the computer to use it again.

So, FileVault is an essential feature for me. I use it, understand its risks, and take precautions.