Slashdot Mirror
Inside Safari 3.2's Anti-Phishing Feature
MacWorld is running a piece from MacJournals.com's for-pay publication detailing how the Safari browser's anti-phishing works. The article takes Apple to task for not thinking enough of its users to bother telling them when Safari sends data off to a third party on their behalf. For it seems that Safari uses the same Google-based anti-phishing technology that Firefox has incorporated since version 2.0, but, unlike Mozilla, tells its users nothing about it. "Even when phrased as friendly to Apple as we can manage, the fact remains that after installing Safari 3.2, your computer is by default downloading lots of information from Google and sending information related to sites you visit back to Google — without telling you, without Apple disclosing the methods, and without any privacy statement from Apple."
In Apple's defense, they've never promised to do no evil. Their goal is to instill such unswerving devotion in their customer base that when they actually do some evil, it's here and gone in the news, and nothing has to change.
So far, so good.
The google service is designed to minimize privacy leaks. It downloads a coarse-hashcheck database (so Google learns nothing). And then if something hits, it queries a detailed hash.
So unless you get a match on the coarse-hash database, Google learns NOTHING. And google only learns a hash if it matches, which is not very useful, AND google doesn't store this information unless it is a match with their detailed database.
Test your net with Netalyzr
Every time apple upgrades Safari, they disable my brilliant adblocker, Pithhelmet, and so I wait for the developer to hack it out again... Maybe I won't upgrade. Maybe my next mac will be running on mixed pc hardware. I'm strongly considering that...
"The google service is designed to minimize privacy leaks. It downloads a coarse-hashcheck database (so Google learns nothing). And then if something hits, it queries a detailed hash."
The problem is the lack of disclosure.
I know Apple is based in the USA, with notoriously weak data protection laws, but over on this side of the pond distributing personally-identifiable information to a third party without explicit consent is a criminal offence. I wonder how close to the line this comes, or if it actually crosses it. I wasn't asked to agree to a new version of the EULA when I installed Safari 3.2 (I did it through the terminal, so maybe you are when you use the graphical update client?) and so I haven't even given implicit permission for Apple to tell Google about my browsing habits.
I am TheRaven on Soylent News
Remember, the people who designed the Internet (incorrectly) assumed that all computers on the network would be trustworthy, so the rules are pretty loose.
C'mon, Macworld is better than this. Okay, the article is critically reviewing the anti-phishing feature, but the writer seems to have a bone to pick and in order to post an emotionally charged article, takes things one step too far.
The internet was intentionally designed, itself, not to have a centralized authorizing body for each and every PC and server on the planet. It's decentralized on purpose. When a so called journalist writes something like this, I have a problem, because to me it's just pandering to the security freaks. It's a bit off topic, but I also have a problem reading the rest of the article because it makes it hard to trust what the guy has to say. There's probably good facts in the article, and if there's a problem Apple should be criticized, but I can't possibly continue reading when I see something stupid like this.
"All great wisdom is contained in .signature files"
First off, because it drives me nuts, it is "couldn't care less". (Cue picking on grammar errors in this post. Maybe I'll drop a couple in intentionally!)
Secondly there is adblock (and flashblock) for Safari in the form or SafariBlock, or if you don't care for Input Managers there's always things like GlimmerBlocker which is a local HTTP Proxy which will block ads (and flash and do other fancy things) across the whole system and not just one browser.
I had a look through my settings, in 2.0 IRCC there was an option to download the list instead of checking as you browse, as i cant find the option anymore I'm quite disappointed that Mozilla have effectively compromised my privacy OR left me undefended.
IranAir Flight 655 never forget!
You've got it backwards. There is no longer an option to check as you browse and the check against the local list has always been the default.
I don't recall that option. Anyway, isn't it just a list of hashchecks? No personal info?
No colour or religion ever stopped the bullet from a gun
Just use Firefox and be done with it, while all browsers have their faults (and features) Safari offers nothing unique (IMO) and Firefox most likely has a bigger team of coders behind it.
I use Firefox on Ubuntu, XP, and OS X Leopard so I have continuity/usability across the board, and that is what sells me on open source.
"If any question why we died, Tell them because our fathers lied."
Our AdRater plug-in has similar privacy issues. It's a plug-in that "phones home" to get information about the advertisers whose ads appear on a site. Here's what we tell users:
AdRater "phones home", but tells us as little as possible. AdRater sends the domain name associated with each advertisement you see to SiteTruth. Thus, we can tell what advertisers have reached you, but cannot tell what web pages you have been viewing. We can't tell if you click on an ad. AdRater does not use "cookies" or any other user identifiable information other than your current IP address.
If we change any of this, the changes will not take effect until you download and install a new version of AdRater.
AdRater does not rate ads on secure pages, so no information about a secure page is ever sent to our servers.
Now that wasn't hard, was it?
For really technical users, we publish the API AdRater uses, so you can check to see that we're telling the truth about what data goes back and forth.
Safari crashes on me every time I try it.
By that logic, Apple software should come with no EULAs or Terms of Use as well. Far more people would read (and comprehend!) a dialog message informing them about phishing security than the 10,000+ word EULAs that many Apple applications come with.
Which hindrance of the two do you think is more useful and has better usability? It's pretty obvious that this omission has absolutely nothing to do with usability.
The memory management on the PowerPC can be used to frighten small children. -Linus
http://www.worldwidewords.org/qa/qa-ico1.htm
It's simple. Just unplug your comp...
NO CARRIER
I wonder why.
First off, because it drives me nuts, it is "couldn't care less". (Cue picking on grammar errors in this post. Maybe I'll drop a couple in intentionally!)
Put this in the same category as people saying "I heart cats" (should be "I love cats") and "write me" (should be "write to me").
Jumpstart the tartan drive.
A lot of you seem to love Apple
I use Safari because it's well integrated with OS X. Firefox isn't, and Camino (which I use by preference) has a couple of bugs that are supposed to be fixed Real Soon Now that make it lock up behind a proxy and don't let me disable Apple's stupid insecurity dialogs.
I also use Safari and Camino because they don't use XUL the way Firefox does. I don't trust the security model for XUL nor the technique Firefox uses for the XUL installer, XPI. And in fact there's been at least one XPI-related vulnerability (quickly patched, but it shows that the class of problems I'm concerned about are real).
This doesn't mean I love Apple, or that I think the folks on the Camino team are cooler than the ones on the Mozilla team. This just means I'm more interested in the best tool for the job than where it comes from.
I'm going to play devil's advocate for a moment and point out that such disclosure is getting harder and harder to comply with.
"Attention: By default, Safari now downloads a database from Google and connects back to Google to verify whether sites you visit in your browser are rated as malicious by Google. If you would like to opt out of this feature, uncheck this box: [x] Use Google's malicious site checking service."
Just banged out a draft version for ya. Took me all of about 1 minute, and I don't even have a PhD.
The problem isn't complexity or difficulty.
Please help metamoderate.
I don't see this pattern of thinking in our industry changing
The important question here is of course this: who is making the choices?
Who decides that this is the way it will be? I can only imagine that Debian's popularity-contest was conceived by someone who knows how to write code, and presumably cares about privacy in relation to computers. They may not have the same values as me, but I think it's on their radar. It's probably also written primarily by the person conceiving it.
I'm still in school (although I've dipped my toes in the non-free real world for a year), so I don't know exactly who calls which shots and what the inter-company differences are. But I imagine that the policy regarding the use of the data is not made by techies.
I think they're made by people who worry about either selling stuff, telling the user to buy stuff or making sure the profit is big, while asking those who ensure you won't get your profit sued away. Who there thinks about their computer behaving exactly like they want (as distinct from getting the job done)?
In any case, we probably don't need to target /. to get the message out; but how do we convince those who decide to give the user some input on the decision?
The article takes Apple to task for not thinking enough of its users to bother telling them when Safari sends data off to a third party on their behalf.
I don't really want to be bugged every 5 seconds that my computer is doing something on my behalf. Those sort of "features" are what I dislike about the Windows operating environment. Maybe it is just me, but there is a definite sweet spot for the trade-offs of security versus convenience. To say what you said in a more positive tone would be that Apple seems to lean towards convenience.
I fail to see how this is a big deal. Did you read the article? If so, you would not panic as well.
First of all, everything is transported in hashes. You do not compare the actual URLs that customers visit, only the hashes. Google has no actual links that indicate the banks that you use and the pr0n sites you have browsed. Only hashes.
Also, this is a configurable option. Apple does not force you to use Google. Apple does not force you to use this feature. I think it would be easier if Apple has explained this feature in the release notes to a greater extent and if users had to accept some sort of a license agreement when enabling this feature. Nothing else beyond it.
That said, Microsoft did the same thing with Windows Media Player, Internet Explorer, and Windows Search. Firefox enabled it by default.
I can't say about FF, but unlike MS, Safari's phone-home feature is easily turned off - btw, it was enabled by default.
Many of us have software firewalls to block these kind of accesses
The dedicated firewalls I've put up (Linux and OpenBSD) basically allowed traffic back upon request - and would allow this traffic out and back. It's been a while since I've done that (re: I'm curious, not baiting) - how do you prevent this using a firewall?
Barring some government regulation to put an end to this, which honestly won't happen...
...because no one government can control software that's distributed world wide.
I'm racking my brane for an appropriate Noam Chomsky quote - he must have one - that would basically explain that the government - any government - is the last place we'd want to look for the solution you suggest.
If there were some sort of control on the backplane (net infrastructure before end-user) for phishing, malware, spyware, virus vectors and so forth - then none of the products or companies you mention would have to go to these extreme lengths.
I'm imagining the number of designers and programmers, the number of modules, the number of source lines of code, the number of defects, the number of defect reports, the number of defect fixes, the number of products - all working against evil - all at the desktop level. Then, I'm imagining the amount of network bandwidth and cpu bandwidth taken to undertake this protection - all at the desktop level - and multiplying that by the number of desktops.
And I'm not liking the numbers I imagine - not one little bit. It adds up to a lot of waste - yes, waste.
Thinking about Mozilla, FF, MS, Apple, et al and government regulation is not even wrong. Why are we not pressuring our governments to legislate serious jail time for those responsible for all of this waste?
I'm familiar in advance with how difficult tracking some of the craftier bastards is - very familiar. But I'm also questioning if some serious consequence and fear of same might prevent this desktop-level waste...
There's no contradiction in what I'd said earlier about this concept and there being no world-wide government - let the consequences to trade be clear enough and it's financial impact known to the US, UK, EU, Jpn and so forth - and watch how quickly those in "uncontrolled" countries get - shall we call it - alignment. (And in that, I'm hoping for some clear resolution to piracy and thuggery on the high seas, as well.)
Pathological kinda promises Path + Logical - but instead, you get stuck with pathetic.
It was defiantly in [ Mozilla/5.0 (Windows; U; Windows NT 5.0; en-GB; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17 ] either check against a downloaded list or ask google about each one.
Submitting the hash of every site you visit makes it very easy for google to see if you have or haven't visited a site. all the hashing stops is google having a list of sites youve been to, but a rainbow table means they can instantly see everybody that has been to www.slashdot.org. It depends if it is now done by list or by actively checking (asa clarifies above that the default is using a list which allows me to maintain privacy )
IranAir Flight 655 never forget!
how do you prevent this using a firewall?
Either you use a whitelist, which makes surfing the Web pretty impractical, or you use a blacklist. If you know where they're sending this information, a firewall and/or proxy can be pretty effective -- or just a good old-fashioned /etc/hosts.
Why are we not pressuring our governments to legislate serious jail time for those responsible for all of this waste?
Partly, because some of us would rather it go the other way -- after all, if a teenager can write a program in his parents' basement that brings major corporations to their knees (or causes a ton of expense), I think it says as much about the corporations than it says about the teenager.
And that teenager could still grow up to become a well-rounded human being.
So, partly, it's because we like the underdog, and we don't like the evil corporations.
I think the other side to it is, the amount of punishment is irrelevant when the perp is never caught.
No, all signs point to solving this at the other end. Any computer system can be set up securely. When it's not, I feel like the user should be held liable. After all, if we gave actual jail time for harboring botnet nodes, people might start paying more attention to keeping their machines clean.
Don't thank God, thank a doctor!
It does, however, present it in a non-technical way first:
AdRater "phones home", but tells us as little as possible.
For many users, that says it all.
AdRater sends the domain name associated with each advertisement you see to SiteTruth.
A domain name is pretty common knowledge. Even if it isn't, now you know some information is going to something called SiteTruth.
Thus, we can tell what advertisers have reached you, but cannot tell what web pages you have been viewing. We can't tell if you click on an ad.
Again, non-technical.
It seems like a non-technical user could read this and understand enough to decide whether or not they need to care -- and if they need to care, they can ask for help understanding it. Us technical users are grateful that all the relevant information about IP addresses, domain names, and cookies are all right there, so we don't have to go digging for clues as to what the "non-technical" marketspeak might mean.
Don't thank God, thank a doctor!
So, a single popup the first time, giving you the option to either allow it or turn it off, and also the option (checked by default) to not see that dialog anymore.
But this isn't even in the EULA.
Don't thank God, thank a doctor!
In a stock installation of Firefox 2.0 and higher, Ctrl-K. Type a letter, any letter, *without* hitting Enter. You have now sent information to Google and any would-be MITM, all so that Google could recommend "amazon" for "a," all sent in glorious clear plaintext.
Now imagine that you had sensitive text information in your clipboard and it found its way into the search box purely by accident. Oh, to be the man in the middle of that.
Just because it's the search box instead of the *hash* of a URL to which you are actively trying to connect doesn't make a lick of difference. In fact, I'd say that the search box, until you hit enter, should be neutral territory, safe from the network. At least with the address bar and hitting enter, or clicking a link, you are consciously interacting with "something" on the net. At least anti-phishing features are implemented in the name of security, while this bullshit is perpetrated in the name of laziness and/or convenience. (I'll refrain from overemphasizing the potential for exploitation of these results and their prioritization through monetary influence.) So where are all the people jumping up and down about Mozilla being evil and tailor-made for producing dumb products for dumb customers? Are their needs simply satisfied by the fact that suggestions can be turned off using FF's HIDDEN config panel? If so, then aren't the needs of Safari's detractors met by the disabling of this feature in Safari's UNHIDDEN config panel?
Kind of puts things in perspective, doesn't it? Unless you're the rabid, irrational hate-Apple-at-all-costs type.
to repeat what i said on the macworld article's comment board,
sudo dscl localhost -create /Local/Default/Hosts/safebrowsing.clients.google.com IPAddress 127.0.0.1
(or do the obvious with /etc/hosts if you're still running tiger (not that i know if safari 3.2 is available for tiger....))
Media that can be recorded and distributed can be recorded and distributed.
-kfg
And it comes in a new kind of package file (well, new to me), in "xar!" format. XAR is a new archive format, with an annoying command line.
To see what's in the package if you want to see what Apple's doing before you let them do it:
In other words, the usual .pkg file, just stored in a gratuitous new archive format. Explanation for "why do we need yet another archive format" in the project's source. At least they're open-sourceing their new format instead of making everyone reverse-engineer it like <include src=usualsuspects> would.
To make file(1) know about this:
Apple needs to do this already. Sheesh.