security wants to make changes popup

I would be concerned about a high number of extensions running on startup. I'm a fairly heavy user using Xcode for app development and Photo Editing software and I don't have any extensions on my Mac. There are the 2 background processes, OSMessageTracer and Adobe Acrobat Reader, that are standard with Ventura, but that's it.

EtreCheck will show the applications running on startup. The files will probably reside in one of these locations:

• /System/Library/LaunchDaemons
• /Library/LaunchDaemons
• /Library/LaunchAgents
• ~/Library/LaunchAgents
• /System/Library/LaunchAgents
• /System/Library/StartupItems

All these are accessible using Finder > Go > Go to Folder. There are a lot of files in some of these folders and most, if not all, are needed and should never be deleted. A bad actor will have one or several files in any of these locations to gain access to your system on startup.

Malwarebytes is another great free tool that will scan your system. The program is highly regarded in these forums and safe to use.

Smart not to trust it until you know what is going on. For starter, check Apple Menu > System Settings > General > Login Items. It is normal to have OS Message Tracer and Adobe Acrobat Reader running in the background, but other item should be scrutinized.

A common approach is to run EtreCheck and post the results. It is a safe program that is used frequently by this forum to diagnose problems.

Unfortunately even legitimate requests many times are very generic and non-descriptive with no details. Even when the app is specified, many times it does not clearly explain why it needs permission. Sometimes the only way to figure out the app involved is by the icon on the pop-up notice. This even occurs for Apple apps and notifications as well.

If you are unsure, then decline. If you find some function or feature is not functioning, then most likely it is due to declining the notice. Figuring out what and how to enable to previously declined item can be difficult.

Apple should not give vague warnings like this. It could easily be a virus, or Proton, or my Apple Mac. There is no reference to Keychain, or that it is from Apple, so it could be something else trying to trick me into providing my password.

However, this is the answer I received from Proton Help"

"This is the prompt is shown by macOS when an application needs to use the keychain. In the password box,

you need to enter your Mac OS password, so that the Bridge can connect to the keychain and be able to store the necessary information which is required for the proper functioning of the Bridge, and to ensure that the proper certificates are created. You will need to approve this action from your side."

It both seems very dodgy, but also made sense, so I tetatively did what was suggested, and it worked.

I just got this today and it was related to Proton Mail Bridge for me.

Hello Jim,

Any idea why EtreCheck does not appear in the App Store?

Guern

I would add that I also have a Proton Mail bridge and am investigating whether this caused the warning.

Guern.

Also just started getting message and am Proton Bridge user.