Battle What is the best protection for my M1 MacBook Air ?

[JB007]

Hello,
I recently purchased a M1 MacBook Air.
It is my first Mac and I hope you can help me to choose the best protection for it.

 

[ForgottenSeer 85179]

What are the best ad blockers extensions for Safari ?

(Without adding attack surface): DNS blocking

Don't use any browser extensions for best security and privacy. Safari is the only browser which can hide you in the mass (stay with default settings)

 

[forgottenuser79643]

I asked a friend what he did on his MAC for this, out of curiousity. He solved it with a combination of DNS blocking and little snitch, with AdGuard for cosmetic local filters. But that might or might not be too much effort, depending on how comfortable you're setting things up for and to 'set&forget' configuration.

 

[MacDefender]

My favorite is 1Blocker, ‎1Blocker: Ad Blocker & Privacy

This works for Safari on Mac as well as iOS, and because it uses Apple's ad blocking APIs, it cannot phone home about what it's blocked. It isn't free ($5USD a year) but their curated rules are really good and I've rarely had to whitelist or add additional things to block.

 

[JB007]

My favorite is 1Blocker, ‎1Blocker: Ad Blocker & Privacy

This works for Safari on Mac as well as iOS, and because it uses Apple's ad blocking APIs, it cannot phone home about what it's blocked. It isn't free ($5USD a year) but their curated rules are really good and I've rarely had to whitelist or add additional things to block.

I never heard about this Ad Blocker .

 

[seanss]

Hello,
I recently purchased a M1 MacBook Air.
It is my first Mac and I hope you can help me to choose the best protection for it.

If you're looking for more manual tools, take a look at the white hat security researcher / developer Patrick Wardle at Objective-See. He publishes a pretty great library of utilities for macOS. One that I use all the time is RansomWhere and it notifies you when a program tries to change permissions of a file or lock it!

 

[poopdookie]

What are the best ad blockers extensions for Safari ?

I hate to beat a dead horse, but in my opinion...Adguard. After the Safari extension purge I tried various ublock orign replacements. 1blocker was recommended as well as wipr, none did the job that ublock origin did, adblock max/magic lasso did well also but broke some things for me, eventually I just went with the crowd and am using Adguard, sigh.

 

[poopdookie]

I am also always wondering what is the best consensus Mac Antivirus (for those of us who use it) all the websites only test windows for the major vendors.

 

[SpiderWeb]

I am still trying to figure this out. NextDNS and the built-in security is my default now. All the AVs require reducing the security on my Mac in order to run. That seems backwards... For example M1 by default only allows Apple signed and checksum'd code to run in kernel. All AVs I have tried request that I disable this kernel security in Mac Recovery (it's like UEFI)... this is insane. They also request a special permission to access the entire drive when no app has this permission. Again, intrusive, backwards. And many AVs only run in Rosetta 2. Imagine having to use an emulator to run your antivirus. What the heck. lol

The consensus is M1 Macbook Air with Monterey is ridiculously secure.

 

[low L!fe]

intego VirusBarrier
or norton 360

 

[MacDefender]

FWIW I just tested this today, installing Xcode from the App Store:

No AV: 20 minutes
Kaspersky running: 3 hours and currently still not done. kavd is using 100% CPU and installd is using 20%.


For heavy IO workload the single threaded nature of Mac antivirus daemons in user space is devastating to the hardware accelerated in-kernel storage architecture of modern Macs.

 

[JB007]

The consensus is M1 Macbook Air with Monterey is ridiculously secure.

@SpiderWeb
I'm sorry but my English understanding is very low, so I would to be sure that when you say "ridiculously secure" you mean "very secure" ?

 

[SpiderWeb]

@SpiderWeb
I'm sorry but my English understanding is very low, so I would to be sure that when you say "ridiculously secure" you mean "very secure" ?

Yes. Very secure. The architecture on M1 is hardened so no side channel attacks like Intel.
XProtect is Apple's version of Windows Defender. It gets signature database updates frequently.
Gatekeeper is another built-in feature which only allows trusted and signed programs to run and be installed so no tampering.
Apple is also using some form of checksum to check files have not been tampered with.
Access to the file system for programs is prohibited and can only be granted by an admin in the Settings menu.
Finally the latest M1 with Monterey do not allow anything to run in kernel space unless it's Apple signed.

The only way to get around it is to boot recovery which is password protected and disable secure kernel which is what Kaspersky, Eset, Bitdefender and others are asking users to do. It's unbelievable that someone would want to compromise their hardware security for a little bit of software security.

 

[JB007]

Yes. Very secure. The architecture on M1 is hardened so no side channel attacks like Intel.
XProtect is Apple's version of Windows Defender. It gets signature database updates frequently.
Gatekeeper is another built-in feature which only allows trusted and signed programs to run and be installed so no tampering.
Apple is also using some form of checksum to check files have not been tampered with.
Access to the file system for programs is prohibited and can only be granted by an admin in the Settings menu.
Finally the latest M1 with Monterey do not allow anything to run in kernel space unless it's Apple signed.

The only way to get around it is to boot recovery which is password protected and disable secure kernel which is what Kaspersky, Eset, Bitdefender and others are asking users to do. It's unbelievable that someone would want to compromise their hardware security for a little bit of software security.

Thanks for your explanations

 

[Shadowra]

Even if there is malware on Apple, there is much less indeed.
XProtect is completely sufficient

 

[oldschool]

Yes. Very secure. The architecture on M1 is hardened so no side channel attacks like Intel.
XProtect is Apple's version of Windows Defender. It gets signature database updates frequently.
Gatekeeper is another built-in feature which only allows trusted and signed programs to run and be installed so no tampering.
Apple is also using some form of checksum to check files have not been tampered with.
Access to the file system for programs is prohibited and can only be granted by an admin in the Settings menu.
Finally the latest M1 with Monterey do not allow anything to run in kernel space unless it's Apple signed.

So really all the user needs to add is good browser protection with µBO, etc. Wish I could afford a Mac.

 

[[correlate]]

If you do not like these programs, you can check this site, which provides programs dedicated to the operating system
Mac OS
-LuLu
-BlockBlock
-Do Not Disturb
Enjoy your day and free safety

The Objective-See Foundation

A non-profit foundation, focusing on macOS security.

objective-see.com

 

[Nevi]

What are the best ad blockers extensions for Safari ?

I also use 1Blocker: Ad Blocker & Privacy. I have used it several years on my Iphone, and it was the first extension I downloaded to my Macbook. Great adblocker.

 

[SpiderWeb]

So really all the user needs to add is good browser protection with µBO, etc. Wish I could afford a Mac.

Yup. And run standard user account. Mac has the same flaw Windows has that the first account is by default admin. You can avoid a lot of problems by downgrading your account or use Privileges to toggle between standard vs admin

GitHub - SAP/macOS-enterprise-privileges: For Mac users in enterprise environments, this application gives users control over the administration of their machine by elevating their level of access to administrator privileges on macOS. Users can set

For Mac users in enterprise environments, this application gives users control over the administration of their machine by elevating their level of access to administrator privileges on macOS. Use...

github.com

I am using Firefox on MacOS. I think while Chrome is more secure by default, Firefox is just as secure or more secure after a few tweaks.

It will be interesting what AV companies will be doing on macOS once Monterey is released. They can technically only provide complementary security. I doubt 95% of people will ever go into recovery to REDUCE their kernel security to run an AV. But like @oldschool has said, your browser is your most powerful antimalware. Google Chrome would routinely delete strange files I downloaded marking them as malware. Firefox also has a built-in scanner.

 

[JB007]

I also use 1Blocker: Ad Blocker & Privacy. I have used it several years on my Iphone, and it was the first extension I downloaded to my Macbook. Great adblocker.

Thanks @Nevi ; I saw it is paid, is worth it ?

 

[Nevi]

Thanks @Nevi ; I saw it is paid, is worth it ?

You can get the free version, that only block ads. The paid version also block trackers and have some kind of firewall etc. For me the free has been the best ad blocker to Iphones and Macs.