mac security - allow Zotero to monitor keyboard?

andymeek

macOS 10.15 (Catalina), Zotero 5.0.75.
I got a message, I presume from Zotero, to change my Security & Privacy settings so that the Zotero app is allowed to monitor input from the keyboard even when using other apps - which I did.
Anyone know why it needs this or what happens if I disallow it? It's the only app I have set to do this and it makes me kinda nervous ...

dstillman

Why do you say "I presume from Zotero"?

That's not a permission Zotero needs or requests. Can you take a picture of the Input Monitoring pane in System Preferences where it shows Zotero, upload it somewhere (e.g., Dropbox), and provide a link here?

dstillman

Also, can you provide a Report ID from Zotero?

djross3

(OSX has been getting stricter about many things. I wonder if this has something to do with word processor plugin interaction, which is the only time I can imagine this would be relevant.)

dstillman

We're well aware of the new restrictions in Catalina, but this isn't one of them that should apply to Zotero.

andymeek

Screenshot here https://www.dropbox.com/s/xiwp2wxvohcitmq/Zotero permission to monitor keyboard input macOS 10.15, Zotero 5.0.75.png?dl=0

If I remember correctly, I launched Zotero and got the progress bar to indicate it was updating. I then saw a message telling me to set the security setting. I assumed it was something to do with integration issues eg with a word process or browser.

andymeek

Error report ID: 88844958

dstillman

That's really quite strange. Are you running any system utility that might inject itself into other programs?

Delete Zotero from the Applications folder, open Terminal via Spotlight, paste in the following command, and press Return:

tccutil reset All org.zotero.Zotero

That should remove Zotero from all sections in the Privacy preferences.

If you then install Zotero again from the download page and open it, are you prompted again?

dstillman

(And say no if you're prompted again, because Zotero definitely doesn't need this.)

DWL-SDCA

Catalina

{edit: my sincere apologies for the rambling style of this narrative.}
I think that something about this should be added to the Zotero documentation. People are going to encounter this. I was able to import metadata from database and publisher websites without problem many times a day for many days but today the situation presented itself.

The exact message is:

"Zotero.app" would like to receive keystrokes from any application. Grant access to this application in Security & Privacy preferences, located in System Preferences.

See Screen-shot here:

https://www.dropbox.com/s/4t1hikudgdrxyrn/Screenshot 2019-10-14 16.17.53.png?dl=0

There is no option to say "no" as you suggest. Clicking the DENY button makes the dialog box go away but the metadata will not download and the Saving to Zotero notice seems to remain indefinately. If I try again I receive the same alert.

This is the second time I received this "Keyboard Receiving" alert upon clicking on the Zotero import icon when on a publisher website (this one was: 10.1002/ejsp.2508). The first time I just ignored the alert and moved on. Looking back, the item I hoped to import is not in my Zotero Library or collection. I find it interesting that I was able to add other article metadata from that publisher (Taylor and Francis) after ignoring the alert that day. (I was able to import it today.) This was not the first item I imported today using the Zotero icon on my Firefox browser and the other article metadata came through fine.

This time the import wouldn't go through until I opened system preferences and gave permission. The Saving to _collection_ notice box appeared but nothing was saved. The "saving to" notice didn't go away on its own. Only after giving permission and restarting Zotero could the import take place.

dstillman

There is no option to say "no" as you suggest. Clicking the DENY button makes the dialog box go away but the metadata will not download and the Saving to Zotero notice seems to remain indefinately. If I try again I receive the same alert.

By "say no" I meant click Deny. The fact that it's asking for this permission is some sort of bug — in either Catalina or in Zotero's Firefox base — and you shouldn't grant it. You should follow the steps I give above to remove this permission if you've already granted it.

Saving from the connector, which takes place over HTTP, also shouldn't have anything to do with this. If you can reproduce it while clicking the save button, I'd want to see a Debug ID from Zotero for a save attempt from the connector where this occurs, and where you're saying the save fails.

DWL-SDCA

I'll remove the permission. I had to grant the permission this afternoon so that I could complete my work. I tried clicking deny but I couldn't do anything with Zotero. The alert box did go away when I clicked deny. But came right back as soon as I clicked in the Zotero window. I only got Zotero to work again by granting permissions, quitting Zotero and restarting Zotero again. Before and after I clicked "deny" Firefox allowed me to open new tabs and I tried (unsuccessfully) to research this situation via Google. I clearly didn't search using useful keywords.

I'd need to keep debug on always until the intermittent problem occurs again. I am willing to do this but only if you say that the debug file's utility would outweigh the cumbersomeness of the file's massive size. (I guess that I could turn debug on and if the issue doesn't occur turn it off and immediately turn it on again to wait for the error.)

Do you want to suspend this conversation here and take it up on the development site or by support email?

dstillman

I'd need to keep debug on always until the intermittent problem occurs again. I am willing to do this but only if you say that the debug file's utility would outweigh the cumbersomeness of the file's massive size.

You can clear output anytime while it's running without disabling logging.

DWL-SDCA

I will turn on debug.

andymeek

I'm not aware of running any utilities that would cause this behaviour.

I installed the very latest update to Catalina 10.15.3 - macOS 10.15 (19A602)
I deleted the Zotero app.
Tried to run the command tccutil reset All org.zotero.Zotero
tccutil: No such bundle identifier "org.zotero.Zotero": The operation couldn’t be completed. (OSStatus error -10814.)
Presumably this is correct because it is in the bin.
Checked the Security / input monitoring settings - Zotero no longer listed.

I downloaded the latest Zotero app (5.0.76) and installed it.
It appeared to install and run OK, although there were residual messages "Update failed. The partial Update could not be applied. Zotero will try again by downloading a complete Update.
and then
Downloading Zotero
Connecting to the update server ...
with a completed progress bar but the dialogue did not self-dismiss. I closed it.

Checked the Security / input monitoring settings - Zotero had reappeared as having permission to read the keyboard - WITHOUT soliciting my permission by a dialogue.

I tried to remove this by the +/- buttons on that screen, but it would not obey.
So I ran the command tccutil reset All org.zotero.Zotero and received the reply
successfully reset All approval status for org.zotero.Zotero
Zotero now not listed in the Security settings screen, as intended.

DWL-SDCA

Debug D43717032

This is a rather long log but the alert box appeared at the very end. I clicked DENY and was able to continue and to import another item. I will restart logging. The last time this happened problems developed soon after I clicked deny.

michaelhenehan

Exact same thing happened to me, right after I installed LibreOffice and the LibreOffice plugin with Java Development Kit- I never had this problem before..

goldmund00

Same happened to me. The popup showed right after I drag-n-dropped a pdf from Finder to Zotero.

dstillman

If you're seeing this, it'd be helpful if you could test to see whether you can reproduce it reliably:

1) Close Zotero.

2) Open Terminal from Spotlight, paste in tccutil reset All org.zotero.Zotero, and press Return. The Zotero entry should disappear from the System Preferences → Security & Privacy → Privacy → Input Monitoring pane (whether or not you accepted it, which you shouldn't have).

3) Restart Zotero and do whatever you did originally before you received this prompt.

martijnboersma

I did not get this notification until I imported a few hard to find articles from sci-hub.

Importing 'dodgy' PDFs from couldn't be the reason, could it?

dstillman

Importing 'dodgy' PDFs from couldn't be the reason, could it?

No, not really.

Ang3lo

Same happened to me. The popup appear right after I uploaded a pdf from Finder to Zotero (thanks Catalina!).
A very disturbing situation.
I need to know if I am safe or if it is better to uninstall and switch to other softwares.
Someone could advise me?

dstillman

We have no reason to think this is anything other than a bug. See my post above for what we need to debug it further.

Ang3lo

Ok thanks.
It is a very strange kind bug, please when you will have some news about this inconvenient can you inform us?
Thanks again

dstillman

We can't reproduce it, so we need people who can to follow the steps I gave above.

DWL-SDCA

Was my debug (above) not useful? I can try to capture the alert again.

Ang3lo

I followed your steps and it would seem that everything is fine.

P.S. I have installed Zotero on two macs (iMac Pro and MacBookPro) and curiously I had the problem only on iMacPro

dstillman

Was my debug (above) not useful? I can try to capture the alert again.

Nothing relevant was logged, but that's not surprising — whatever's causing this, it's likely at a lower level that what we log. (In your case I was also just curious about the save failing after, but I'm not sure that was actually related.)

The goal here is really just to see if anyone is able to reliably reproduce the problem after each reset, such that we could do further troubleshooting with known steps to reproduce. But I suspect the cause of this is subtle enough that we're not going to find that. If it were something clearer, we'd likely be getting many more reports of it and likely would've seen it ourselves.

dstillman

I followed your steps and it would seem that everything is fine.

@Ang3lo: So just to clarify, you did the reset step and added the same PDF you added before and the problem didn't occur and Zotero no longer appears in Input Monitoring?

Ang3lo

@dstillman: I think yes. I no longer have the original pdf files, so I downloaded the zotero pdfs to my desktop, deleted them from zotero and then reloaded them back from Mac to zotero again, and everything seems fine (no imputes monitoring).
Do you think that some pdf has some malicious code?

Ang3lo

@dstillman: I just checked the security settings and the Zotero icon is AGAIN present in the "Input monitoring" !!!!!
I realize that this strange inconvenient happens every time I load new PFDs in my collections like I did last night.
Now I have just uninstalled Zotero and deleted all the folders with the pdfs. There is something strange (zotero or pdfs or both?) When you solve it I will install it again. I am sorry since Zotero was very helpful and I liked it.
Thank you very much for your cooperation.

P.S.: it might be important in previous messages I didn't mention it but my pdf collection was on iCloud