The IT Nerd

I just spotted this link over at Consumer Reports that lists “7 online blunders” which can lead to identity theft or could trash your computer. Most of these blunders are things that have been around for a while, but blunder #5 caught my eye because it directly addresses Mac users and their false sense of security:

“According to this year’s State of the Net survey, Mac users fall prey to phishing scams at about the same rate as Windows users, yet far fewer of them protect themselves with an anti-phishing toolbar. To make matters worse, the browser of choice for most Mac users, Apple’s Safari, has no phishing protection. We think it should.

What you can do: Until Apple beefs up Safari, use a browser with phishing protection, such as the latest version of Firefox (shown at right) or Opera. Also try a free anti-phishing toolbar such as McAfee Site Advisor or FirePhish.”

Consumer Reports is the latest in a growing string of organizations to take Apple to task over its handling of security issues. Not to mention that unpatched security holes have occasionally prompted security watchers such as US CERT to advise against using IE. Safari could easily end up in the same boat if Apple doesn’t get serious about security.

But Apple is only half the problem. Apple users have been force fed the story that Macs are more secure than Windows boxes. Up until recently that’s been largely true. But no computer platform is truly secure. Anything can be hacked, cracked, pwned, or exploited. So it is up to users to practice the same safer computing methods that have been drilled into Windows users for years.

Speaking of security. Apple was supposed to take part in the Black Hat security conference this week. However, Apple’s marketing team got in the way and vetoed the talk at the last minute. That’s unfortunate because Apple’s lack of clarity on security isn’t giving people the “warm fuzzies” at the moment.

Apple patched Safari last week, but according to this ZD article, security researcher Billy Rios notes that when Safari is used on a computer with Firefox 2 or 3, there is a risk of an attack that allows a remote attacker to steal files using the “carpet bomb” method. He’s not going into other details at this time so that Apple can fix the issue, but its not good optics for Apple. To be fair, its a problem due to an interaction with another product, so Safari in isolation should be fine (in theory).

Oh yeah, if you look at Billy’s blog, he also has this quote:

“UNREALTED NOTE TO MOZILLA:  Firefox 3 shouldn’t FORCE itself to be my default browser after I install it (YES, I unchecked the default browser checkbox during install)”

Hmmm…. That sounds vaguely familiar. I saw that coming a mile away, just not from him.