consumer reports: stop using safari. get firefox
Consumer Reports joins the swelling ranks of those cautioning against using browsers like Safari that lack the basic security feature of Firefox's Phishing Protection.
In their latest Online Safety report, Consumer Reports says, "Apple’s Safari, has no phishing protection. We think it should.... Until Apple beefs up Safari, use a browser with phishing protection, such as the latest version of Firefox."
update: The Register notes the emergence of a pattern of Apple security shortcomings saying of Apple, "the consumer electronics giant has been lambasted for its slow response to a cross-industry DNS spoofing flaw, force-feeding Windows users its Safari browser under the guise of a security update and mismanaging the noteworthy Safari carpet-bombing flaw over recent weeks. A planned security talk by Apple's security team at the Black Hat conference this week was canceled at short notice after its marketing department objected."
Let's all hope (and Apple customers should do more than hope, they should demand,) that Apple ensures the next version of Safari includes the kind of phishing protection that every other browser, including even the niche browsers, already do. It's way overdue and Apple should not ship another release until they can include this basic security feature.
reactions, thoughts, comments, etc.
Safari's shortcomings aside, the statement "Mac users fall prey to phishing scams at about the same rate as Windows users" is curious. Basically, despite less phishing protection, Mac users fall for the scams at the same rate as Windows users. Does this mean that phishing protection does not work? Or just that Mac users are less likely to fall for the scams with or without protection?
Posted by: George | August 5, 2008 12:58 PM
That statement should be read as "with no technical solutions in place, Mac users fall prey to phishing scams at about the same rate as Windows users". Meaning that neither are Mac users more educated about phishing than Windows users, nor is their operating system giving them an immunity against all kinds of online threats.
Posted by: Wladimir Palant | August 5, 2008 2:10 PM
What is really curious is their advise in the 6th point. The screenshot on the right is clearly not a pop-up, just an image trying to look like one (same holds true for pretty much all fake security warnings). So "carefully clicking on the X" will most certainly bring you to the malware site, the exact opposite of the desired effect. Also, recommending a pop-up blocker is pointless for something that isn't a pop-up. One could recommend an ad blocker of course but it would probably be better to show how to distinguish fake pop-ups from real ones - and advising to close the window/tab whenever you see a fake one.
Posted by: Wladimir Palant | August 5, 2008 2:19 PM
Hey Asa, what's with your Apple obsession? They don't get some things right. OK. It's not your company. Focus your attention on Firefox. Firefox dowsn't get a lot of things right either (see all those open 10 year old Bugzilla entries). So instead of constant bitching at Apple, do the work that you are being paid for and improve Firefox, for god's sake.
Posted by: Not an Apple User | August 5, 2008 3:38 PM
Not an Apple User,
What specific work do you think I should be doing and how much are you paying me to do that work?
If you knew a bit more about me, you'd know that my concerns, and even what I'm being paid for, go well beyond the Firefox product. Mozilla's mission is to improve the Internet and my focus and what I'm paid to do is making the Web better. Firefox is a huge lever in moving the Web to a better place, but it's far from the only one.
There's little doubt among informed and concerned participants that online security goes well beyond one single browser vendor. You either don't agree or you're not among the informed.
I take online security seriously and I challenge everyone, users and vendors alike, to take it seriously. When other browser vendors willfully fail their users like this, I'm going to call that out.
If you don't want to read that kind of thing, don't visit my blog.
- A
Posted by: Asa Dotzler | August 5, 2008 3:57 PM
I'm paying you as much as those added "rls=org.mozilla:de:official&client=firefox-a" strings from the search field generate.
If you don't know what areas Firefox can improve then learn to use Bugzilla.
Honestly, I don't want to read your blog. It's constant Apple bashing and almost no really relevant information. I have to see your stupid blog posts because it's aggregated in MozillaZine feedHouse. I usually try to ignore your off-topic posts (after all, your Apple bashing has nothing to do with Firefox itself. It's just a symptom of your broken ego). If your ego needs that Apple bashing, fine, but do it where it's not spamming feedHouse. MozillaZine readers most likely use Firefox or a related browser (SeaMonkey etc.), so your Apple basing targets the wrong people anyway.
Posted by: Not an Apple User | August 5, 2008 4:37 PM
Not an Apple User,
I've been working for Mozilla for more years than Mozilla's been earning any Firefox revenues at all. I've been working on Mozilla more years than there's even been a Firefox. Hell, I've probably put more into this project as a volunteer than you and most others ever will.
Until your contributions come even close to matching mine on this project, telling me, on my own blog, what you think I ought to be blogging about, or what I ought to be working on at Mozilla, is going to get you absolutely nowhere with me.
Not happy with FeedHouse? You could always subscribe to just those feeds you want rather than an aggregation service that includes things you don't want to read. Too much work? Then perhaps you should petition MozillaZine to remove my feed from FeedHouse.
Take your complaining somewhere else.
- A
Posted by: Asa Dotzler | August 5, 2008 4:56 PM
Hey Asa,
We can see clearly "Not an Apple User" is a troll. I wished you did not react to trolls, and give them attention. I've been using Fx from its Phoenix days and converted many many of my friends and colleagues to switch to it,so, Keep up the good work, and please ignore these trolls :)
[off-topic]
btw, I tried very hard but I could not find any responses from jwz about the Firefox phenomenon ( and its success ) - could you point me to any such content ?
Posted by: Nitin | August 5, 2008 9:10 PM
This story must be devastating to those who are loyal Safari users and advocates. What possible argument could someone have that would influence users of other browsers to switch to Safari? Or even other Apple products.
I've never used Safari so I won't bad mouth it, but I can't help but notice how things have come full circle real quick. Imagine using such an obvious and transparent tactic to gain users by trying to sneak their product through in an update.
Perhaps we all should not judge Apple so harshly after all it says on Safari's home page "The world's best browser." It doesn't say anything about being the safest.
Posted by: Ken Saunders | August 5, 2008 10:39 PM
Asa
I agree with Nitin; Notanappleuser is little more than a troll. I admire your tolerance of trolls but in some respects wish you would just delete their comments since they add nothing of substance to the blog.
I e-mailed your post to my son who just bought a new Apple and is currently using Safari, advising him to reconsider his choice of browser. Thanks for the information.
Posted by: James | August 6, 2008 8:51 AM
As most browser users have no clue about phishing i can understand the advice.
And for those people wanting to turn this into a marketshare debate: on that subject my #1 wish atm is IE dropping below 50%, also on non-geek sites. Some examples for last month:
-startpagina.nl : 94% IE
-w3schools.com : 52% IE
-svg.startpagina.nl : 36% IE
Posted by: stelt | August 6, 2008 4:41 PM
Are you using some other internet browser? if yes then please do try safari browser as its the ultimate to work with.
http://www.safaribrowserwindows.com
Posted by: amit | August 7, 2008 6:00 AM
I am also not an apple user, but I'm also not a troll, I swear.
Though at the risk of maybe sounding like one:
I have to wonder if Apple's problem isn't more or less the opposite of Firefox 3's problem with self-signed certificates: "Security" never seems to be convenient.
What Apple is really selling, more than anything else, is the "user experience" that many people find superior to anything else they've tried. Because that's their primary selling point, I would assume there's a downright rabid resistance to any changes that cut into it - including inconvenient security features. I imagine this is doubly true for changes that are promoted by people not affiliated with Apple corporation - I expect that they really don't want "outsiders" dictating how they design things and it makes them perhaps a bit more resistant to being changed than they should be.
Disclaimer: despite my one very strong philosophical objection to the new "self-signed certificates" behavior, Firefox 3 is still easily my preferred web browser. I don't see this changing, either, unless something goes horribly wrong.
Posted by: Epicanis | August 11, 2008 8:10 AM
I've used mozilla when it was lavender, IE was wiping out the last remnants of Netscape and it really looked as if the entire web would be closed and under the complete control of Microsoft. It was firefox that reversed this and if you are a safari fan you have to be grateful for people like Asa who worked so hard so that there can be a choice. That you can be on linux or freebsd or mac or even os/2 or Haiku and still be able to use the web.
but it doesn't seem right to me to go from fighting against a closed web controlled by Microsoft only to end up with a closed web controlled by Apple.
Posted by: ari-free | August 11, 2008 3:31 PM