Does screen sharing icon always mean someone is watching?

Question

Level 1

73 points

Does screen sharing icon always mean someone is watching?

Is it always true that the existence of the sharing icon means that another computer is looking at my screen?

I have noticed that sometimes, but not always, as soon as I enable screen sharing, the sharing icon appears at the top of the screen; even though no one is apparently sharing my screen. I limit who can share to my own login credentials; I use a strong password and while it is always possible someone got it, it doesn't seem very likely they would turn on screen sharing at the exact time that I enabled it. When I click on the icon and then click to end screen sharing, the icon soon reappears.

Also, typically when you are sharing "on purpose" and you click to stop the sharing, you are given a warning that the other user will be disconnected. I don't get that warning when I stop the sharing, which leads me to suspect that indeed no one is watching ... which begs the question of why is the icon there if no one is actively sharing?

MacBookPro, Mac OS X (10.6.4), iPhone 4

Posted on Dec 31, 2010 3:05 PM

Reply

Answer 1

Dec 31, 2010 3:28 PM in response to Bill Elkus

Hi,

Are we talking about the Standalone Screen Sharing App (Invoked in the Go Menu > Go to server using VNC://xxxx) ?

Or iChat's Screen Sharing.

iChat shows the two red interlocked retangles which only show when connected (Or in process of doing so).

It would be possible to set up an Auto Accept on this (Although the Apple Script for other Auto Accepts does not include Screen Sharing)
You will always be asked to Allow a Share of your Screen

Using the Screen Sharing app itself in Leopard (to my MacBook Pro) I did not see an Icon in the Menu bar of the asking Computer.
A Black icon of a Display outline is seen on the Screen being Shared.

I have not seen this icon show up at any other time.

However if you do click the Icon it will tell you the IP (I was connected using An IP address) of who is connected.

Sounds like time to change the Passwords.

11:28 PM Friday; December 31, 2010

Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"

Reply

Answer 2

Bill Elkus Author

Level 1

73 points

Dec 31, 2010 3:40 PM in response to Ralph-Johns-UK

Thanks Ralph.

I was speaking about the native-OS screen sharing in 10.6, not iChat or VNC sharing or Remote Desktop sharing ... and I have personally seen the "sharing icon" that looks like binoculars appear literally as soon as I enable screen sharing; which doesn't make any sense if it were a security breach.

Also in doing experimentation with two computers side-by-side, during a screen sharing session (native OS, not iChat), if the target computer actively terminates sharing using the drop down menu, I recall that it generates a warning that the other computer will be disconnected ... and when I terminate it when the sharing icon appears as soon as I enable it, no such warning is created.

Finally, in side-by-side experimentation with normal screen sharing, the icon does not reappear right after ending the session (unless the other computer immediately attempts to share again) whereas when this happens to me immediately after enabling sharing, when I stop sharing using the tab, the icon comes back quickly... very quickly.

Its really odd.

Reply

Answer 3

Jan 1, 2011 11:51 AM in response to Bill Elkus

Hi,

For the points

You emailed me this post as well. One Method will do.

Copy of email for other readers

"Hi,

We are talking about the app tucked away in the Hard Drive/System/Library/Core Services folder ?
This is the same app as invoked in the Go Menu > Go to Server > VNC

(missing icon here) Said Icon (I see an Outline of Screen but also see it has the binoculars)

When I do this via the Go Menu I am asked to Log on to the other computer.
I have not got the "Remember this in my Keychain" activated.

I have not played around with it enough to find out if it will try to reconnect if the second (Shared) computer is shut down before the request end has Quit the App.

I also Quit by using the App Menu rather than the iCon drop down and so do not get the message.
Also if I use the Red Button on the Screen asking to Share the window closes and the App Quits with no warning popping up either.

I think, looking at your phrasing in the Post, that this has something to do with the way you are ending Screen Sharing - either stopping Permission when Connected or shutting down the the Shared Screen Computer whilst still sharing.
The other computer (asking to Share) is then trying to re-establish the connection - possibly with Keychain Stored info as soon as Permission is granted again."

7:51 PM Saturday; January 1, 2011

Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"

Reply

Answer 4

Bill Elkus Author

Level 1

73 points

Jan 3, 2011 5:38 PM in response to Bill Elkus

I have done more research and concluded that "no one is watching" even though the sharing icon is on. Here is my reasoning:

1) To be sure that no one grabbed my passwords, I turned off airport and all internet access, set up a new user account with a ridiculously complicated and secure password; then set up screen sharing so that only that new user could share my screen; no one else, not even with my regular user credentials. Sure enough, after a day or two, the screen sharing icon appeared again as soon as I woke my MacBook Air from sleep.

2) when I click on the sharing icon (binoculars inside a monitor) the tab only shows "Screen Sharing Preferences" and does not show any IP address. When I set up an actual sharing operation, the IP address always shows

3) from reading other posts from people wondering about this topic, someone wrote:

I encourage you to open terminal and run the command

netstat | grep vnc

the next time you see it. This will return either nothing (bringing you back to the prompt ending in $, or return a line such as this:

tcp4 0 39 10.0.42.116.vnc-server 10.0.42.243.54233 ESTABLISHED

In this case, my Macintosh is 10.0.42.116, and the computer connected to it is 10.0.42.243.

By this method you can determine if there is a glitch causing the icon to appear or if there is actually a connection being made to your Macintosh."

...I did this, and Terminal just brought me another command line. When I set up real screen sharing, and try that Terminal command, I get a reply just like this writer suggested.

So, I have concluded that under some conditions which I cannot predict; the screen sharing icon is "on" even though no one is really sharing my screen.

Anyone else had this happen, or have an explanation for why?

Thanks

Reply

Answer 5

Jan 12, 2011 5:18 AM in response to Bill Elkus

i have the exact same issue on a macbook pro 2.53ghz running 10.6.5.

i use the mac screen sharing often to view other machines i own in several different locations (i connect via the mac.com screen sharing option since all the machines are logged into my mac.com account or a member on my mac.com family account).

99% of the time i am other viewing remote machines from my macbook pro.

on the remote machine that is being observed/controlled, you usually can see the binoculars in the display icon at the top right of the screen. if you click on it, the ip address of the machine that is "viewing" is clearly displayed.

however, recently i have noticed that my main machine (which should not be being observed/controlled) shows the binoculars. but when i click on the icon, it just says "open screen sharing preferences" and does not show the ip address of a machine viewing me.

so i assume that no one is viewing my machine...but i can't figure out why

the other day i even had the problem after i disconnected from the internet (turned off airport with no wired connection).

strange....

Reply

Answer 6

Feb 16, 2011 8:03 PM in response to Bill Elkus

Is there any way to recall the remote loggers IP address? It showed up after clicking on the binocular icon, but I did not record it at all before disconnecting remote login. I have then followed up by disabling remote login/management features and changing password.

Reply

Answer 7

Feb 17, 2011 1:23 PM in response to JohnnyJoe90

Hi,

Welcome to the  Discussions

You could try Console (Applications/Utilities) and the section on /var/log and then the appfirewall logs

9:23 PM Thursday; February 17, 2011

Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"

Reply

Answer 8

pete i

Level 1

0 points

Mar 21, 2011 6:11 AM in response to Bill Elkus

I have seen this on my MacBook Pro and my iMac, but can not predict when it will happen nor can i reproduce it faithfully. I'd ver very interested in learning any tricks someone might have on resolving this. Did anyone file a bug against MacOS on this?

Reply

Answer 9

Mar 22, 2011 2:59 PM in response to pete i

Hi,

The Terminal Instruction appears to be very clear.

I encourage you to open terminal and run the command

netstat | grep vnc

the next time you see it. This will return either nothing (bringing you back to the prompt ending in $, or return a line such as this:

tcp4 0 39 10.0.42.116.vnc-server 10.0.42.243.54233 ESTABLISHED

The line that maybe reported may also show in the Console Logs.

9:59 PM Tuesday; March 22, 2011

Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"

Reply

Answer 10

Mar 23, 2011 11:43 AM in response to pete i

The thing to do will be to go through the Console Log when you see this happening.

You would be looking for things like ARD (Apple Remote Desktop), connections being made or Video Frameworks of some sort being used.

6:43 PM Wednesday; March 23, 2011

Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"

Reply

Answer 11

mrdan

Level 1

0 points

Dec 13, 2011 5:08 AM in response to Bill Elkus

I had the same issue come up just there. I had reinstalled windows 7 in bootcamp and once I rebooted into OS X (10.7.2) the screen sharing icon was always present (with seemingly nobody connected) even if I disabled screen sharing or restarted the machine (iMac 27").

However I screen-shared to the iMac from my Air, saw that the icon now showed the laptop's IP and when I disconnected the icon disappeared. It seemed the act of actually connecting "reset" the icon.

Also, I noted that even though the icon was on the iMac, if I had screen sharing disabled I wasn't able to connect to it. So I don't believe screen sharing was permenently running or anything like that.

(Also also, I realise this is a pretty old post at this point but someone may come along looking for answers like I did...)

Reply

Answer 12

Cerebrl

Level 1

0 points

Feb 16, 2012 9:15 AM in response to Bill Elkus

Yup, I'm having the same issue. The small binoculars are showing in my menu bar, even if I turn OFF screen sharing and RESTART my computer. Now the screen saver won't activate and the display won't turn off if inactive for set period ever since this icon showed up.

I'm running 10.7.3 on a Mac Pro and use iCould with other computers for syncing. I hope someone can provide some helpful advice. Thanks in advance.

Reply

Answer 13

Jan 4, 2011 12:02 PM in response to Bill Elkus

Just to confirm I have not seen this.

8:02 PM Tuesday; January 4, 2011

Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"

Reply

Answer 14

pete i

Level 1

0 points

Mar 22, 2011 3:27 PM in response to Ralph-Johns-UK

Hi. I copied and pasted that exact command in to the terminal and got nothing returned just username$. Anything else to check?

Reply

Answer 15

Nov 4, 2011 9:31 PM in response to Bill Elkus

Same problem here - small binoculars showing screen sharing in menubar but definately nobody is using screen-sharing. Must be a OSX Lion bug (I am using 10.7.2). Anyone else noticed this?

Reply