How to Launch Mac Apps in Private
If you’re unfortunate enough to have to use your Mac in a part of the world where surveillance is performed, even knowing when you use certain apps could prove to your great disadvantage. This article looks at two potential solutions: blocking all outgoing traffic to Apple’s OCSP service, which checks certificates against its list of revocations, and removing code signatures on selected apps.
[…]
By blocking outgoing connections to ocsp.apple.com and ocsp2.apple.com app launch should still proceed, usually more quickly too, without the check taking place. The great disadvantage is that blocking is all-or-none, and can’t be selective according to the app being launched. This forces the user into choosing between normal revocation checks, or none at all.
[…]
Checks on certificate revocation can only be made on apps which are signed. If the app is unsigned, there’s no signing certificate to check. Use this to your advantage by removing the signature from those apps whose use you want to make private[…]
However, I think some Apple services will not work with apps that are unsigned or ad-hoc signed.
Previously:
- Still No Preference to Opt Out of OCSP
- Apple Server Outage Makes Mac Apps Hang on Launch
- Apple Silicon Macs to Require Signed Code
