Malware has one common feature: it usually tries to trick you into giving it your password. Without that, it can’t do many of the nasty things it intends, like stealing your private information. One fundamental defence we all have against malware is our ability to distinguish between genuine and fake requests for a password. To help you achieve that, this article looks at some of the standard password dialogs used by macOS. If what you see on your Mac doesn’t match one of these, then it’s most likely to be a fake.

Keychain access

Although your login keychain is normally kept unlocked while you’re logged into your Mac, the macOS security system determines whether each request for passwords, certificates, and other contents are correctly authorised. If the app isn’t trusted or the keychain is locked, then the security system, not the app, displays a dialog asking you for the password to that keychain to authenticate before it will provide the password or other secret to the app.

That authentication dialog is very important: although malware might try to forge it, it contains distinctive features you should always look for:

• The icon consists of a locked padlock, on which is superimposed a miniature icon representing the app or component that has asked to access the keychain.
• The bold text names the app or component which has called for keychain access, and states which item it’s asking to access: here, a named secure note.
• The smaller lettering specifies that it’s asking for the keychain password, that is the password used to unlock the named keychain, not your Apple ID or any other password.
• If you’re in any doubt about its authenticity, click on the Deny button and the request will be denied.
• If you’re in any doubt about its authenticity, open Keychain Access, lock the keychain there, and repeat the action while watching the keychain to ensure that it’s unlocked and handled correctly.

Note that it doesn’t provide or ask for your user name, only the password for that keychain.

Older versions of macOS may display this slightly differently, but still contain the same key items of information to reassure you that the request is genuine. While Ventura changed many of these dialogs to its new vertical format, this remains unchanged, and hasn’t changed in Sonoma either.

Privilege authentication

The other everyday reason for being asked to enter your password is to authenticate for other purposes that require elevated privileges, such as for a process to run a privileged helper, or to make changes in System Settings.

In Ventura and later, that has adopted the new format and should contain the following:

• The icon consists of a locked padlock, on which is superimposed a miniature icon representing the app or component that is asking for your password.
• Bold text names the app making the request.
• Below that is a general indication of the purpose of the request.
• Below that is the instruction to Enter your password to allow this.
• There are two text boxes, to contain your user name (already completed) and password.
• There are only two buttons, one of which may be OK or something more specific, and the other is Cancel.
• If you’re in any doubt as to its authenticity, click on the Cancel button to deny the request, and consult the app’s documentation.

On Macs with Touch ID support and an appropriate keyboard, in many cases now you may first see the prompt for biometric authentication using your fingerprint.

Only if that doesn’t work, or you opt to use your password, should you see the normal dialog. The Touch ID dialog is a strong indicator that this request is genuine, and can be trusted, as malware won’t be able to access this feature through macOS, and it’s not an easy dialog to fake, as the malware would have to detect whether that Mac was able to use Touch ID first.

Dialogs in Recovery are not only different as they’re all in Dark Mode, but they’re far simpler.

Apple ID password

Another common type of password request dialog is that for your Apple ID and password. Unfortunately, these vary more, but have some common features that can help tell the genuine from the fake.

• The icon is that of the requesting app, and doesn’t include a locked padlock.
• Text that makes it clear that your Apple ID and password are required.
• A prompt for the Apple ID, email or phone number, which isn’t pre-completed with your user name.
• At least two buttons, one of which is Cancel.
• Possibly a link to what to do if you’ve forgotten your password.
• If you’re in any doubt as to its authenticity, click on the Cancel button, and check the app’s documentation.

The simple summary is that, if you’re ever in any doubt that a request for a keychain, admin user or any other password is completely genuine, click on Cancel or Deny, and check with the app concerned whether that request is expected.