eXtensions - Saturday 15 October 2016
System Preferences in macOS, Sierra: Security & Privacy
By Graham K. Rogers
The Security & Privacy Preferences section works with other parts of System Preferences (like Accessibility and Sharing) for a safer environment. The Security Preference pane has four sections as before: General, FileVault, Firewall and Privacy. There are some minor changes here.
General settings in Security & Privacy (screenshot with thanks to "a Reader")
GeneralThe content of the General pane is almost indistinguishable from the same pane in recent versions of OS X, unless a user owns an Apple Watch (see below). At the top of the pane is a button that allows a user to change the login password for the current account. Using this does not need Admin account privileges: users may change this on their own as long as the padlock at bottom left is open (that will require an Admin password).
If the "Change Password" button is pressed, a panel appears that requires the old password, new password (+ verify), with a panel at the bottom for a password hint.
Note: with newer Macs the way to reset the Firmware Password Utility, if the password has been forgotten, has been changed and may require several days work at an Apple authorised agent. It is recommended that if Firmware Password Utility is used, the password is written down and locked away.
[Apart from a certain trepidation about this, I had problems initially with 2-step authentication which I set up months ago, but which needed setting up again. I am holding off taking the final steps as this week the Apple Watch Series 2 is arriving in Thailand and I will wait until I have this in my hands: I will update as and when I am able.]
With App Store only apps, there is a built-in secure process for developers to follow before their apps can be authorised for sale: these apps are supposed to be completely secure for users to install.
Identified Developers have registered with Apple and while their apps are not sold via the Mac App Store, the registration with Apple should give users a relative peace of mind as to the safety of the apps. This may apply also to developers who sell via the Mac App Store but who make available trial or beta versions of their software.
By selecting the (now unavailable) third option, it was possible to install any downloaded app, but this may have unacceptable levels of risk for some. There are certain developers, however, whose products are worthy but who have not registered with Apple for this.
Although the missing "Anywhere" option is no longer shown, it is possible to install apps from other sources, although this will require some command line work to make the option reappear in the General tab. An article by Paul Horowitz on OSXDaily explains how this may be done. As this requires use of the SUDO command, it may only be done in an Admin account. With the clear instructions, this was a task of only a few seconds.
Information on Gatekeeper and other aspects of Security, is available from the Apple macOS pages.
FileVaultThe feature of FileVault was introduced with OS X 10.3 Panther. It is claimed to use military strength encryption and is intended to protect a user's data: the files that are in the Home folder.
The FileVault icon (a house with a safe dial superimposed) signifies the ability to lock the users Home folder by way of encryption. If activated, files are decrypted and encrypted while working. A user enters the account as normal, using the password. Local users who take advantage of this have told me that the process is seamless.
To start this, users press the single button, "Turn On FileVault" at the top of the pane. The text description to its left is unchanged: "FileVault secures the data on your disk by encrypting its contents automatically."
Text beneath indicates if the feature is on or off for the disk.
An extended discussion of FileVault is available online at the O'Reilly Mac Devcenter site: An Unencrypted Look at FileVault, by FJ de Kermadec. This dates from 2003, but the ideas and comments are still valid.
FirewallAnyone who does not use a firewall these days is asking for trouble. Since Yosemite the panel has been application-focussed rather than port-focussed as it was in earlier versions of OS X.
The Firewall pane has basic information for the user and two buttons: Turn On Firewall (or Turn Off Firewall if it is ON) and Firewall Options... The buttons can be used only if the security padlock icon is open. The Options panel now has four checkboxes.
Above the main (applications) list is "Block all incoming connections". If this is selected only essential services (DHCP, Bonjour, IPSec) will be able to use internet access.
Applications in the list panel are allowed the access needed, instead of specifying port numbers as was the case earlier. Above the application list are several OS X features that may have been activated in other preferences, such as DVD or CD Sharing, File Sharing (SMB) or others depending on the User's settings.
Below the panel are three checkboxes:
PrivacyThe final pane in Security & Privacy preferences, Privacy, has been updated in terms of apps that are now listed.
To the left is a panel that shows any apps or services that are permitted to access specific types of data. Highlighting each will show in the main panel any apps affected and the type of access allowed. A user will be asked to permit such access when setting up OS X or after installing some applications.
To the left is a panel that shows any apps or services that are permitted to access specific types of data. Highlighting each will show in the main panel any apps affected and the type of access allowed. A user will be asked to permit such access when setting up OS X or after installing some applications. This list will differ with each user.
Calendars and Reminders have been granted access to specific apps. Facebook and Twitter have no apps listed that have requested access to them so far.
Graham K. Rogers teaches at the Faculty of Engineering, Mahidol University in Thailand. He wrote in the Bangkok Post, Database supplement on IT subjects. For the last seven years of Database he wrote a column on Apple and Macs. He is now continuing that in the Bangkok Post supplement, Life. He can be followed on Twitter (@extensions_th)
For further information, e-mail to