Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'Be very leery of anything that asks for your password' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Be very leery of anything that asks for your password
Authored by: hayne on May 12, '04 11:26:44PM

As others have pointed out, there is nothing very new here.
When you run an application (any application whether it be implemented in AppleScript, or Java, or C++, and note that installers are merely a specialized form of application), you are implicitly trusting the developer of that application.

You should never run applications that come from people or places that you don't have trust in. It doesn't matter whether the application is something that arrived in an email message or if you downloaded it from a web site, or you got it on a CD from a friend. An application can do whatever it wants - subject only to the restrictions of the permissions system.

A lot of the comments here have focussed on the 'rm' command. That is a red herring - an application can remove files in other, lower-level ways. And removing files is not necessarily the worst thing that a malicious program could do - e.g. it could gradually corrupt the files instead - that way your backups might become useless before you noticed the problem.

You should be especially leery of anything that asks you for your (administrator) password. Such applications can do damage beyond the confines of your home folder. If an installer asks for your password, you should take it as a sign that the installer is about to fiddle with your operating system. The issue of trust is obviously much more present in this case.

Many poorly programmed installers ask you for your password even though they don't really need it. You should complain to the vendors of such applications. It ought to be a relatively rare occasion when you need to supply your password - it should only be when you are installing something that upgrades the system-wide functionality of your Mac.



[ Reply to This | # ]
Be very leery of anything that asks for your password
Authored by: roncross@cox.net on May 13, '04 12:28:22AM

Everytime I install something, the computer will ask for my password for authentication. I have this turned on so that I am the only one who can install the applications on my computers. If you authenticate, can the application get the password even though it isn't asking for it?

thx
RLC

---
rlc



[ Reply to This | # ]