April 10, 2026
Toggle trust, start a flame war
You can't trust macOS Privacy and Security settings
‘Off’ doesn’t mean safe: users say Mac privacy feels like a placebo
TLDR: A researcher’s demo shows macOS can still let an app read a protected folder like Documents after you click “allow,” even if settings say it has no access. Commenters erupted: some call it a secret bug and distrust Apple, others blame confusing prompts and permission fatigue—trust is the real casualty.
Mac fans are clutching their toggles after a new post from The Eclectic Light Company showed an app called Insent can still read your Documents folder after you click a consent prompt—even if macOS settings say that app has “no access.” Translation: the Privacy & Security screen can look locked down while the app still got in with your OK. Cue the comment chaos.
One camp is furious. “Trust is broken,” says the mood, with one user pointing to past Apple privacy controversies and declaring they don’t trust Apple at all. Another accuses the author of dropping a 0day (security bug not publicly known) and asks why Apple wasn’t told first. Meanwhile, a pragmatic crowd argues this is just how Apple’s permission system works: if you click allow, the app gets a pass—and the settings page isn’t great at showing that nuance.
The jokes came fast. One commenter mocked the instructions—“download Insent”—with a dry “As if that’s going to happen,” while another got Windows UAC PTSD flashbacks, dredging up memories of nonstop pop‑ups and permission fatigue. Even VPNs got dragged in (“can we trust those on a Mac?”), because once the trust avalanche starts, everything’s sliding.
Bottom line: the demo is simple, the implications are messy. You might have to use Terminal and even restart to fully yank back that permission. The community’s verdict? Apple’s prompts are confusing, the UI is misleading, and trust is wobbling—with equal parts outrage, debate, and gallows humor fueling the thread.
Key Points
- •The article demonstrates that macOS Privacy & Security settings may not reflect access granted via TCC prompts to protected folders.
- •Using the Insent app, a user can grant access to the Documents folder through a consent prompt, after which the app can list contents despite settings showing no explicit permission.
- •Revoking that access requires running “tccutil reset All co.eclecticlight.Insent” in Terminal and then restarting the Mac.
- •The behavior is specific to individual protected folders; access to Documents does not imply access to Desktop or Downloads.
- •Technically, sandboxd intercepts protected folder access and requests TCC authorization; logs show TCC granting SystemPolicyDocumentsFolder and notifying com.apple.chrono.