{"id":25065,"date":"2019-04-22T14:56:36","date_gmt":"2019-04-22T18:56:36","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=25065"},"modified":"2019-12-23T16:32:20","modified_gmt":"2019-12-23T21:32:20","slug":"the-true-and-false-security-benefits-of-mac-app-notarization","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2019\/04\/22\/the-true-and-false-security-benefits-of-mac-app-notarization\/","title":{"rendered":"The True and False Security Benefits of Mac App Notarization"},"content":{"rendered":"

Jeff Johnson<\/a> (tweet<\/a>):<\/p>\n

Notarization is a kind of two-factor authentication. In order to notarize an app, you first need to sign it with your Developer ID cert, but then you have to submit it to Apple using the Apple ID and password of your developer account. If your signing cert is compromised, that by itself would no longer be sufficient to distribute the app.<\/p>

[…]<\/p>

A myth has been spread that Developer ID certs can only be revoked in entirety, meaning that all versions of all apps signed with a Developer ID cert would be invalidated when the cert is revoked. Apple has contributed a bit to this myth[…]<\/p>

[…]<\/p>

The ability of Mac apps to update themselves shows that the notarization malware scan is security theater. Apple’s notarization service scans for malware, but malware authors don’t need to submit malware to Apple! They can submit a perfectly innocent app for notarization, get the app notarized, and then flip a switch on their own server to download a malware software update when the victim opens the “innocent” notarized app. The downloaded malware update doesn’t need to be notarized, because the software updater will delete the quarantine attribute, thus bypassing Gatekeeper.<\/p><\/blockquote>\n

I guess the questions are:<\/p>\n