Gatekeeper is designed to control which applications can run on a Mac. It has three settings: allow only applications downloaded from the Mac App Store; allow applications from the Mac App Store and approved developers; allow any application (that is, switch off Gatekeeper). The first option goes some way towards providing the sort of controlled security provided by iOS on the iPhone, while the last is more like the open market favored by Android (and traditional on the Mac). The middle option is a compromise between the two.
Peter James, global spokesperson for Intego, doesn’t think many people will select the first option. “But,” he says, “if you’ve got a computer that your kids use, you might want to stop them downloading any application from anywhere they chose; so it has its value.”
Gatekeeper works by code-signing. Developers are issued with certificates that sign the code. If the application has a valid certificate, Mountain Lion lets it run. If it has no certificate, or if the certificate has been revoked by Apple, Mountain Lion will not let it run. “Think of it like a driver’s license,” says James. “If you do something wrong, they’ll just revoke the license.”
The question being asked, however, is whether this is a serious attempt to improve Mac security, or the first step in the walled garden that will see Apple taking control over what can and cannot run on OSX – just like it does with iOS on the iPhone and iPad.
The question is valid because Apple describes Gatekeeper’s prime purpose as stopping malware getting onto the Mac. “It helps protect you from downloading and running malicious software. It brings you new levels of security.” Security companies have been quick to point out that in reality, it does very little for security. Sophos senior security researcher Chester Wisniewski points to several weaknesses: it only affects executable files, so “PDFs, Flash, shell scripts and Java will still be able to be exploited without triggering a prompt.” And it only applies to downloaded applications, so “files from USB drives, CD/DVD/BR or even network shares will all install and run without being screened.”
Sean Sullivan, security advisor at F-Secure, acknowledges some increased security but looks more towards the walled garden. “Gatekeeper also begins to solidify Mac's walled garden,” he writes. “By 2014, I expect somebody out there will be jailbreaking their Mac…”
Intego’s James also accepts the security limitations of Gatekeeper. It doesn’t, he points out, “do anything with objects on a web page. So a Java applet, being part of a web page, isn’t going to get scanned or flagged or anything. From what I understand today, Gatekeeper would not block the Flashback trojan, and it looks like malware that comes via the web will get through Gatekeeper pretty easily.”
James doesn’t think that Gatekeeper’s purpose is anti-malware. The bottom line, he suggests, is that the walled “iPhone is very secure, and nobody is complaining about this. I think what Apple is doing here is providing an optional parental control setting. But the simple fact is that nobody knows where Apple might take this in the future.”