←back to thread

How Dropbox Hacks Your Mac

(applehelpwriter.com)
1037 points 8bitben | 2 comments | | HN request time: 0.552s | source
Show context
Dylan16807 ◴[] No.12464088[source]
I don't really understand the conclusion here. So the scenario is you trust dropbox with your files, and you trust them with a kernel blob implementing the filesystem, but you don't trust them to silently have accessibility rights?
replies(3): >>12464120 #>>12464611 #>>12464701 #
DINKDINK ◴[] No.12464611[source]
>you trust dropbox with your files, and you trust them with a kernel blob implementing the filesystem, but you don't trust them to silently have accessibility rights?

The problem here isn't that you don't trust them to have accessibility rights, it's that Dropbox has phished your root password, stored it, and will continue to modify your system to meet it's desired operating criteria.

replies(1): >>12465220 #
plttn ◴[] No.12465220[source]
>- We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple).

Direct from the DB engineer at top of thread.

replies(1): >>12465492 #
DINKDINK ◴[] No.12465492[source]
If that's the case, How is it that the accessibility preferences are changed without root authorization?
replies(1): >>12466658 #
1. gumby ◴[] No.12466658[source]
Presumably with one of the suid executables you authorized when you typed your root password to the dialogue.

And one of them is writable by anyone -- great security, guys!

replies(1): >>12469241 #
2. Dylan16807 ◴[] No.12469241[source]
Does OS X not clear suid when a file is written to?