Comment by ashishb

19 days ago

It also has persistent permissions.

Think about it from a real world perspective.

I knock on your door. You invite me to sit with you in your living room. I can't easily sneak into your bed room. Further, your temporary access ends as soon as you exit my house.

The same should happen with apps.

When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. Further, as soon as I exit the process, the permission to access dir1 should end as well.

12 comments

ashishb

Reply
lifeisgood99  19 days ago

A better example would be requiring the mailman to obtain written permission to step on your property every day. Convenience trumps maximal security for most people.

  • BobbyTables2  19 days ago

    The early version of UAC in Windows did that…

    Asking continuously is worse than not asking at all…

    • expedition32  19 days ago

      Some of the stuff that I install is actually meant to behave like malware.

      But fine lock windows down for normal users as long as I can still disable all the security. We don't need another Apple.

  • ashishb  19 days ago

    I would configure mailman with permanent write access to the mailbox area

    That's what I with my sandbox right now

araes  17 days ago

Attempt at real life version (starts with idea they are actually not trustworthy)

  - You invite someone to sit in your living room
    - There must have been a reason to begin with (or why invite them at all)
    - Implied (at least limited) trust of whoever was invited
  - Access enabled and information gained heavily depends on house design
    - May have to walk past many rooms to finally reach the living room
    - Significant chances to look at everything in your house
    - Already allows skilled appraiser to evaluate your theft worthiness
  - Many techniques may allow further access to your house
    - Similar to digital version (leave something behind)
      - Small digital object accessing home network
      - "Sorry, I left something, mind if I search around?"
    - Longer con (advance to next stage of "friendship" / "relationship", implied trust)
      - "We should hang out again / have a cards night / go drinking together / ect..."
      - Flattery "Such a beautiful house, I like / am a fan of <madlibs>, could you show it to me?"
  - Already provides a survey of your home security
    - Do you lock your doors / windows?
    - What kind / brand / style do you have?
    - Do you tend to just leave stuff open?
    - Do you have onsite cameras or other features?
    - Do you easily just let anybody into your house who asks?
    - General cleanliness and attention to security issues

  - In the case of Notepad++, they would also be offering you a free product
    - Significant utility vs alternatives
    - Free
    - Highly recommended by many other "neighbors"
  - In the case of Notepad++, they themselves are not actively malicious (or at least not known to be)
    - Single developer
    - Apparently frazzled and overworked by the experience
    - Makes updates they can, yet also support a free product for millions.
    - It doesn't really work with the friend you invite in scenario (more like they sneezed in your living room or something)

uzerfcwn  19 days ago

> When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2.

What happens if the user presses ^O, expecting a file open dialog that could navigate to other directories? Would the dialog be somehow integrated to the OS and run with higher permissions, and then notepad is given permissions to the other directory that the user selects?

  • what  19 days ago

    Pretty sure that’s how it works on iOS. The app can only access its own sandboxed directory. If it wants anything else, it has to use a system provided file picker that provides a security scoped url for the selected file.

    • int_19h  19 days ago

      It's also how it works on macOS and even on modern Windows if you are running sandboxed apps.

    • signal11  19 days ago

      Yes, UIDocumentPickerViewController is 10+ years old at this point.

      There’s also a similar photos picker (PHPicker) which is especially good from 2023 on. Signal uses this for instance.