Mac Security · Mac Privacy Controls · Lesson 1 of 5

Auditing Privacy & Security

Review the four permissions that give apps the most power, and take access back.

The four permissions with the most power

You already met privacy prompts and the Privacy & Security page in System Settings. Now you'll do a proper check, called an audit. An audit means looking through a list on purpose, item by item, and asking if each one still makes sense.

Most permissions are small. A map app that sees your location can't read your email. But four permissions give an app far more power than the rest. Check these first.

• Accessibility lets an app control your Mac. It can click buttons, type, and work other apps as if it were you.
• Screen & System Audio Recording lets an app see everything on your screen and hear what your Mac plays. Older versions of macOS call it Screen Recording.
• Full Disk Access lets an app read almost every file, including mail, messages and other apps' data.
• Input Monitoring lets an app watch your keyboard, mouse or trackpad, even while you use other apps. That can include every password you type.

Here's why these matter most. Put Accessibility and Screen Recording together and an app can watch your screen and act on what it sees. Add Input Monitoring and it can catch your typing. This is exactly the access that remote control scams and stealers try to get.

Some apps truly need them. A backup app needs Full Disk Access. A screen sharing app for work needs Screen Recording. A tool for people who can't use a mouse needs Accessibility. The question is always the same: does this app need this power to do its job?

To start, choose Apple menu › System Settings › Privacy & Security, then click each of the four lists.

On the practice computer, open Accessibility and see which apps are listed. Turn off Coupon Saver's Accessibility and its Screen & System Audio Recording. Then check that Full Disk Access holds only your backup app.

Taking access back

Once you find an app that shouldn't be on a list, you have two ways to take its access away.

• Turn the switch off. The app stays on the list but loses access. If it asks again later, you'll see a new prompt.
• Remove it from the list. Select the app, then click the minus button (−) under the list. This works in lists like Accessibility and Full Disk Access. Use it for apps you don't use any more.

macOS may ask for your Mac password before it lets you change these lists. That is a good thing. It means an app can't quietly give itself this power.

Some apps keep their old access until they quit. After you change a switch, macOS may offer Quit & Reopen. If it doesn't, quit the app yourself so the change takes hold.

Deleting an app doesn't always clean up its entries. You may still see its name on a list. Remove it there too, so the list stays short and easy to check.

Watch for clues while you look:

• An app name you don't recognize.
• A name that is vague, like "Helper" or "Service", with no maker you know.
• An app you installed for one small job that now sits on several of the four lists.

If you find one, turn off its access first. Then look it up, find out who makes it, and delete it if you don't need it. If you can't tell what it is, ask someone you trust before you delete anything.

Recent versions of macOS may also check in now and then, asking if an app should keep recording your screen. Take that as a free reminder to think again.

A good rhythm is to audit these four lists every few months, and any time you install something new.