Forgot your password?
typodupeerror
Security Privacy Apple News

Safari Privacy Bug May Be Leaking Your Data 152

Posted by timothy
from the problem-with-software-is-that-it-sucks dept.
richi writes "If you use Safari, your browser may be leaking your private information to any website you visit. Jeremiah Grossman, the CTO of WhiteHat Security, has discovered some Very Bad News. I have some analysis and other reactions over at my Computerworld blog. The potential for spam and phishing is huge. A determined attacker might even be able to steal previously-entered customer data." In short, autofill for Web forms is enabled by default in Safari 4 / 5 (and remotely exploitable), and the data that this feature has access to includes the user's local address book — even if the information has never been entered into a Web form.
This discussion has been archived. No new comments can be posted.

Safari Privacy Bug May Be Leaking Your Data

Comments Filter:
  • But not Firefox... (Score:5, Insightful)

    by alain94040 (785132) * on Thursday July 22, 2010 @05:19PM (#32996220) Homepage

    It seems that the bug is due to Safari allowing keyboard events to be generated from Javascript, so a malicious script can pretend to interact as if it were the user, whereas Firefox doesn't get fooled.

    --
    The Founder Conference [thefounderconference.com] is coming August 17

    • This reminds me of Windows. It's impossible to override certain key combinations like CTRL+ALT+DELETE.

      It's kind of obvious: you don't let a program ever, imitate the user in the same context. Web browsers should never have been able to create windows 'outside' of the rendering area to boot (unless full screen)... browsers should never have been able to 'see' what the user sees in regard to links...Internet explorer showing contents of C:\...and so on...

      • by telchine (719345)

        This reminds me of Windows. It's impossible to override certain key combinations like CTRL+ALT+DELETE.

        Is this true?

        Odd coincidence, but last nioght I got a Windows

        • Odd coincidence, but last nioght I got a Windows

          Did it hurt?

        • Yes, this sequence is trapped by the kernel and never delivered to normal userspace applications. On the original PC, as I recall, it was trapped by the keyboard controller and raised an interrupt, triggering a reboot if the OS didn't handle it. Windows always traps it and delivers it to a special privileged program. This makes it impossible to fake the Windows NT login screen. Faking something like xdm is easy, because it's just another program. The NT login screen requires you to hit control-alt-dele
          • by boxwood (1742976)

            I've never understood the Ctrl-Alt-Del thing on the windows login. Yeah if it comes up and asks for you to hit Ctrl-Alt-Del, you can be certain its the real login screen. But really, how many users are going to get a login screen and notice that it didn't ask for Ctrl-Alt-Del and then call up tech support? 99.9% of people will just enter their username and password and not take any notice.

      • And why should fullscreen get a pass?

        • by improfane (855034) *

          Only if the user invoked the fullscreenedness should it be permitted. I think in that way it would very difficult for software to 'fake' your desktop.

          • Then why mention fullscreenedness at all? That's a red herring. Do this instead:

            Web browsers should never have been able to create windows 'outside' of the rendering area to boot (unless user-invoked)

            Same applies to popups, no?

            • by improfane (855034) *

              By allowing popups to appear outside the page rendering area, i.e, the bit below your tab bar and browser GUI and with small borders, it gives websites free reign and ability to create realistic popup windows that imitate software of your system, so people get suckered into installing legitimate looking spyware.

              I am sure there are ways to 'overlay' ontop of a fullscreen application to make it clear that it is in actual fact, a web page. Even a small bar notification saying: 'Activated full screen mode. [Ok]

              • By allowing popups to appear outside the page rendering area, i.e, the bit below your tab bar and browser GUI and with small borders, it gives websites free reign and ability to create realistic popup windows that imitate software of your system, so people get suckered into installing legitimate looking spyware.

                Yes, I understand -- though there are things about those which make it obvious that they're browser-generated. But again, user-initiated is the key here. Current popup blockers do a good job, I think -- Chrome blocks popups, but makes it clear when a website has requested a popup and how to enable it.

                A healthy amount of skepticism would also help. For example, if a website looks local, and is asking me for my bank details or twitter account, I'm going to wonder what kind of local spyware I have installed.

                I am sure there are ways to 'overlay' ontop of a fullscreen application to make it clear that it is in actual fact, a web page. Even a small bar notification saying: 'Activated full screen mode. [Ok] [Exit fullscreen]

                A

                • by improfane (855034) *

                  That's exactly the kind of notification I like. Either that or something similar but hopefully less annoying like the yellow bar in IE or Firefox nowadays.

                  When popups could set the positioning on your screen, that's a bad thing.

      • It certainly is possible to override CTRL-ALT-DELETE.

        Even something as basic as an Adobe 'Macromedia' Director projector can trap it using something like Meliorasoft's Keyboard Control Xtra" [meliorasoft.com]
        • by improfane (855034) *

          You're right but I just looked at the manual for that software: you need Administrator privileges to run that director plugin. After which you can run with normal privileges, in which case, if you're admin to begin with, you can do anything anyway, you don't need to use sneaky tactics like peeking at what the user sees or pretending to be the user.

          The horse has bolted so to speak.

          • by Tacvek (948259)

            Andy why do you need admin privileges? To install a kernel-mode driver! Even the admin users cannot directly trap CTRL-ALT-DELETE and the right to install new services/Drivers can be restricted even for administrator accounts (but in practice never is).

    • Bad Headline (Score:4, Insightful)

      by dch24 (904899) on Thursday July 22, 2010 @05:31PM (#32996392) Journal
      Jeremiah Grossman says in the comments:

      @Anonymous, Tom: I believe this may be a WebKit issue and not just Safari. While it is difficult to confirm now, I suspect this technique did in fact affect Chrome. Had some discussions with Google a while back surrounding this topic and recall them finding/fixing something, but I don't really get all the details straight. Will have to find an older Chrome version somewhere to confirm...

      @Harryf: good find, that is vaguely similar and potentially offers a way to make this more efficient.

      @klkl: it does, sorta, but getting it to work is more difficult than it should be. At least for me. :)

      Would that have been before or after Eric Schmidt resigned Apple's board and they became sworn enemies? He didn't get mad because Steve started stalking him, did he?

      Oh well, I'll hit submit in Safari now...

      • Re: (Score:2, Funny)

        by Anonymous Coward

        No need to hit Submit-- I've already got it.

    • "Internet Explorer, Firefox, Chrome, and Safari browsers are susceptible to attacks that allow webmasters to glean highly sensitive information about the people visiting their sites, including their full names, email addresses, location, and even stored passwords, a security researcher says."
      although the exploits are different for each browser. Read more here [theregister.co.uk]
  • If that old canard is so true, than I have to wonder why it is that their are so many security-related issues with F/OSS browsers that go unchecked for so long? While IE was justifibly a laughing stock nowadays webkit and firefox are barely much better -despite the 'many eyes' theory.

    Could it be that the job is simply to complex for most non-professionals and that the open source model has reached the end of it's useful life?

    • by bunratty (545641) on Thursday July 22, 2010 @05:30PM (#32996364)
      It could be that more of the vulnerabilities are being found in open source browsers than in closed source browsers. In other words, closed source browsers may have many more undiscovered security problems. IE still has security vulnerabilities they're not fixing, both ones that are publicly known and ones that only Microsoft and a few others know about. Chrome and Firefox have no publicly known security vulnerabilities today.
      • by natehoy (1608657) on Thursday July 22, 2010 @05:49PM (#32996660) Journal

        Actually, this is a perfect example of it.

        The vulnerability is in closed-source software, because Safari is closed-source. The vulnerability does not exist in Webkit (the open source component of Safari), so no one but Apple can fix this issue.

        The issue was discovered almost by accident. Safari allows Javascript to emulate keypresses (which is almost inconceivably stupid).

        If any respectable open source team member had seen Javascript events being passed to the keyboard buffer, he or she would have screamed blue bloody murder and it would have become a priority one bug faster than you can say "the developer who wrote that shit has just lost code submission privileges on this project".

        • by ToasterMonkey (467067) on Thursday July 22, 2010 @06:36PM (#32997224) Homepage

          If any respectable open source team member had seen Javascript events being passed to the keyboard buffer, he or she would have screamed blue bloody murder and it would have become a priority one bug faster than you can say "the developer who wrote that shit has just lost code submission privileges on this project".

          I'm not buying your assertion that open source developers are more attentive or more dedicated than non-open source developers. What is the rationale for that?
          Other than defining the QA process to be whatever you want and being your own QA team, what advantages does a project being open source confer in this regard? Some outsider can swoop in and patch your critical security vulnerabilities for you, with tests, and no new bugs? Your users can fix bugs on their own, maintaining private one-off branches?

          Not to dig on open source or anything, but I think it's usefulness is being pushed a BIT too far sometimes. There are certainly places it shines, but this is not one of them.

          • Re: (Score:2, Insightful)

            by ewanm89 (1052822)
            the Q/A being in the open anyone can go file and read through the bug reports, and if anyone actually didn't assign such a bug as priority one, then the whole project would be ridiculed, probably here and in many other places.
            • the Q/A being in the open anyone can go file and read through the bug reports, and if anyone actually didn't assign such a bug as priority one, then the whole project would be ridiculed, probably here and in many other places.

              Some very large companies have customer accessible bug reporting systems for non open source software, and if a known bug isn't available to the public you can call support and they'll find it for you. Sun/EMC/Oracle do this, and I'm sure many others. Free self service bug report access is a nice feature of free software, but I think I was talking about open source.

              That said, there is no guarantee the bug reports are open to the public for all open source projects anyway, if they even have such a process

          • by amicusNYCL (1538833) on Thursday July 22, 2010 @07:14PM (#32997664)

            I'm not buying your assertion that open source developers are more attentive or more dedicated than non-open source developers.

            It may even go the other way, it may foster complacency. A programmer working on an open source project may be more likely to assume that someone else has already looked at the code and therefore that they don't need to do it themselves. In an organization there would be someone who's specific job is to audit everything, but if that's left as a community task with no one person taking responsibility for it then it might breed complacent developers.

            Obviously this is pure speculation.

          • Re: (Score:3, Interesting)

            by PopeRatzo (965947) *

            I'm not buying your assertion that open source developers are more attentive or more dedicated than non-open source developers. What is the rationale for that?

            It could be because between open source and non-open source developers, only one group has a boss to hate.

            Freedom to do the best job you can and the sheer desire to create a product that's good enough that you would use is a very strong motivating factor.

            I'm not saying this is necessarily the "rationale" you asked for, but maybe. Maybe the open sourc

            • by BitZtream (692029) on Friday July 23, 2010 @12:12AM (#32999668)

              Freedom to do the best job you can and the sheer desire to create a product that's good enough that you would use is a very strong motivating factor.

              I'm sorry, have you actually USED any OSS software?

              Yes, thats true for a few things, but the 'quality' and 'movtivation' of OSS devs is just as shitty as closed source devs. For ever good OSS project there are roughly 1000 shitty ones, and the same is true for closed source software.

              The people who write open source software are VERY OFTEN the EXACT SAME ONES writing closed source software. Most of the time its because one is so they can eat and the other is so they can relax and enjoy themselves.

              I'm not saying this is necessarily the "rationale" you asked for, but maybe. Maybe the open source developers didn't have to waste their time going to "team building" workshops, or Monday breakfast meetings or have to keep their mouth shut while their boss screws something up or takes credit for the developers' work.

              So instead of having real motivation like 'fix the fucking bugs or your fired and don't get paid' or we have OSS motivation 'I'll feel special if I fix a bug!' ... And you think thats going to make OSS safer? Let me tell you how developers work. They write some code that they are proud off and think is bug free, and then ... someone finds and exploits thier pretty code because only about 1 out of 10,000 even care about finding bugs rather than pushing out new features, and only one in 10k of those actually have the skills to examine code and applications to find bugs, even fewer still have the ability to figure out ways around security mechanisms.

              Wait a minute now. We're talking about four browsers. The ones from Apple and Microsoft have security vulnerabilities and the ones from Google and Mozilla do not. Is it just coincidence?

              Wait, what? Are you blind or just born yesterday and don't have any clue wtf you're talking about? Let me quote what the person who found the bug said on the page linked since no one bothers to read it ...

              @Anonymous, Tom: I believe this may be a WebKit issue and not just Safari. While it is difficult to confirm now, I suspect this technique did in fact affect Chrome. Had some discussions with Google a while back surrounding this topic and recall them finding/fixing something, but I don't really get all the details straight. Will have to find an older Chrome version somewhere to confirm...

        • DOM event model (Score:4, Insightful)

          by bussdriver (620565) on Thursday July 22, 2010 @07:08PM (#32997596)

          The standard event model allows javascript to trigger events such as keystrokes.

          Its easy to see why a browser obsessed with speed would just forward the API call to the internal event model. I can totally see the appeal and instinctive reaction to a situation like this; its clean, fast and simple coding - security is not often a big goal when you are initially just trying to get something working; even so, this could get missed by multiple eyes... Plus this is not part of webkit - its bridging the engine to the GUI; which is an unusual situation compared to the bulk of code - all the hard work is in the engine this just ties that to a GUI, quite likely there is a separation between working groups - obviously there is one since the engine is open source and the GUI is not. Their job is to bridge and probably do not get the level of attention as other aspects of the program.

          I'm not letting them off the hook, this should have be caught within 1 version or during a security audit if there was one... and if there was:
          1) was the attention given to the engine only?
          2) do these people work on the code so they get tied up fixing bugs instead of just logging all the ones they uncover? (a lack of specialization)

        • by Smurf (7981) on Thursday July 22, 2010 @08:16PM (#32998254)

          If any respectable open source team member had seen Javascript events being passed to the keyboard buffer, he or she would have screamed blue bloody murder and it would have become a priority one bug faster than you can say "the developer who wrote that shit has just lost code submission privileges on this project".

          Given that most Safari developers working for Apple are very respectable Open Source team members that contribute heavily to WebKit, I will have to say that your assertion is simply not true.

        • Re: (Score:3, Informative)

          by BitZtream (692029)

          The vulnerability does not exist in Webkit (the open source component of Safari), so no one but Apple can fix this issue.

          Really? Because there is discussion between developers (not just fanboys like yourself) about it existing and being fixed in chome because its likely a webkit issue, not Safari.

          Of course, I don't know that for a fact because its too soon to tell, but that didn't stop you from spouting some ignorant bullshit so why should it stop me?

          Its a bug in the javascript and dom code ... which ... g

    • Re: (Score:1, Interesting)

      by Anonymous Coward

      Isn't this a bug in Safari, not Webkit? As such, it's Apple's responsibility, not the F/OSS community's.

    • by maxume (22995)

      Your post would make sense if the majority of the work done on Webkit and Firefox was not done by professionals.

      • Re: (Score:2, Insightful)

        by jc42 (318812)

        Your post [about F/OSS software being safer due to the "many eyes" phenomenon] would make sense if the majority of the work done on Webkit and Firefox was not done by professionals.

        I don't think any definition I've seen of Free/Open Software includes anything at all about the professional status of the programmers.

        In fact, much of the work on the most popular F/OSS packages is done by "professional" programmers. This is widely understood as a way to improve your public image and résumé, since it

        • Re: (Score:2, Informative)

          by maxume (22995)

          If you are going to shove words into my post, shove the words I was replying to into my post:

          Could it be that the job is simply to complex for most non-professionals and that the open source model has reached the end of it's useful life?

        • by phopon (977751)
          While it is true that most(all?) developers on things like the Linux kernel are professional, it isn't true that they are usually acting on their own. In fact from the looks of it, only between 15-25% of the code is from unpaid work. The majority is by people who are paid by one company or another to work on it.
    • Re: (Score:2, Insightful)

      by phantomfive (622387)
      Browsers are about the most complex piece of software you will find anywhere. Think about all they can do. They have a not just one page rendering algorithm, several different types. Different modes mean different things, and W3 lists over 20 different modes. [w3.org]

      Then they have the networking part, that communicates to servers, opening several sockets at a time and coordinating their retrieval. And they have to be able to do it with HTTP1.0 or HTTP2.0. And they have to be able to handle weird HTTP things
      • Re: (Score:2, Insightful)

        by pclminion (145572)

        In short, if I had a choice between writing a kernel and guaranteeing that it was vulnerability-free, and writing a browser and guaranteeing it was vulnerability-free, I would take the kernel any day. It's a significantly easier piece of software.

        The kernel (let's use Linux as an example) is significantly higher quality, not because it is a simpler piece of code but because it is written by people who aren't morons and actually care about robustness. A web browser has a lot of spec cruft to contend with,

        • The thing is, we have decades of experience knowing how to deal with all that; not only that, there have been books written, classes taught, and academic discussions about the best way to do it, and the best way to organize it, and the basic structure isn't going to change much. All those problems you mentioned are serious problems, it's true, but they've been solved, and you can learn about the various solutions in an undergraduate class and choose the one you want. A single person can write a basic kern
        • Re: (Score:3, Insightful)

          by BitZtream (692029)

          I've written my own kernels for microcontrollers and I've done a fair amount of embedding Gecko and now Webkit.

          Embedding Gecko pretty much means you have to become a browser dev because mozilla is full of idiots but I digress.

          I would, without any doubt in my mind, write kernel code over browser code.

          Kernel code is freaking EASY compared to a browser. I'm more confident in fake 'memory protection' I can create without an MMU than I am of anything in a browser, and I know the fake memory protection is trivia

      • After that, they have to be able to parse at least three different image types (and image parsing libraries are a great place to look for vulnerabilities because they are complex and the data is hard to validate). And they have to be able to interact with the OS in some way to allow movie and audio playing. And flash. And Java Applets. And any other weird plugin.

        says who ? why does this level of interaction have to deal with the os level ? WTF ? Why do application layer programs have to crash the whole box . please tell me why ?

        • You sir, are dumb. Please go educate yourself. And at least try to understand what you read before responding.
        • why does this level of interaction have to deal with the os level ?

          How exactly does the browser play video and audio without the OS? Should browsers come with their own audio and video drivers now?

      • Re: (Score:3, Insightful)

        by bit9 (1702770)

        Browsers are about the most complex piece of software you will find anywhere.

        I don't disagree with your main point that web browsers are very complex. However, the above quote is pure hyperbole. There are many types of software that make web browsers look like child's play. Among them, I would say, are avionics software, flight software for satellites, etc. Those are just a couple examples - I'm sure there are quite a few others.

        • I would argue that avionics software and flight software for satellites is actually simpler than a browser. The difference is that it has unbelievable levels of documentation and testing. When I was working with avionics software, the FAA simply forbade dynamic memory allocation for critical software. They have lightened up a bit and now allow memory to be allocated at initialization, but that's it. The important thing for this type of software is that it is predictable and deterministic. If the softwa

          • by bit9 (1702770)
            I find it amusing that people think that because embedded software has to be predictable, deterministic, and well-documented, that it is therefore simpler. That's pure nonsense. The complexity of the software is driven by the system's requirements, and no, I don't mean the requirement that it be predictable and reliable. I don't know what avionics software you've worked with, but from what I've seen, avionics software has to control a huge number of different systems, and respond to a huge number of differe
            • I've worked primarily with display systems. Much of the complexity is in input validation and source selection. If you have a valid source, then you display the value otherwise you throw up a red "X". You don't try to guess what should be displayed like some web browsers do (and this adds complexity for the web designed since each browser guesses differently).

              Since dynamic memory is forbidden or strictly controlled, the complexities of memory management are avoided. This would be for critical avionics s

              • by bit9 (1702770)

                I've done some work on avionics displays code too, and from what I saw, the displays code is one of the least complicated parts of a typical avionics system. But that doesn't paint an accurate picture of the avionics system as a whole. Other parts, such as flight controls, vertical profile, the terrain avoidance system, etc are an order of magnitude more complex.

                Also, there seems to be a tendency in this thread to equate complexity with convoluted code. Convoluted code can be quite complex, but is often unn

      • by lennier (44736) on Thursday July 22, 2010 @07:29PM (#32997812) Homepage

        After that, they have to be able to parse at least three different image types (and image parsing libraries are a great place to look for vulnerabilities because they are complex and the data is hard to validate). And they have to be able to interact with the OS in some way to allow movie and audio playing. And flash. And Java Applets. And any other weird plugin.

        All of these are certainly complex requirements which could understandably lead to bugs.

        What it is not acceptable is for bugs in a data processing algorithm - say, image rendering - to even be able to lead to vulnerabilities.

        There is no logical need, for example, for a JPEG parser to even conceivably trigger arbitrary code execution if the programmer makes an off-by-one error in an array subscript. It's simply irrelevant to the task of that code. It should be literally impossible to make a mistake in such code in such a way as to trigger code execution.

        Because Internet programming is so complex that if vulnerabilities are not made impossible, they are a certainty, and a certain vulnerability times the size of the Internet mean even the smallest mistake is no longer tolerable. Humans simply can't work with that degree of precision, nor should they ever need to. This is exactly what we built computers for: to take over the repetitive drudge work which we can't do without error. So while a programmer can be assured to make errors, it's the job of the language to make it impossible for errors in data manipulation to lead to logically-unrelated weirdnesses like code execution.

        Surely this isn't rocket Turing Machine science. We don't have to solve the halting problem to get rid of buffer overflows, do we?

      • Then they have the networking part, that communicates to servers, opening several sockets at a time and coordinating their retrieval. And they have to be able to do it with HTTP1.0 or HTTP2.0.

        Can you point me to some resources (like, say, the RFC) for HTTP 2.0? I'm having trouble finding any evidence that it exists...

      • Browsers are about the most complex piece of software you will find anywhere

        So much the better then to keep them simple by omitting useless features like autofill. I don't need my browser to remember my personal information for me. (Seriously, who needs help typing in their own name!?) This is is a gimmicky feature thrown in to impress rubes. It is near worthless for legitimate use and and a crack waiting to happen.

    • by natehoy (1608657) on Thursday July 22, 2010 @05:46PM (#32996618) Journal

      Umm... WHAT? Sorry to burst your conceit bubble there, Sparky, but... "Many eyes make bugs shallow" does not apply to Safari, because Safari is not open source software.

      Webkit (the open source rendering engine that Safari uses) is not vulnerable. Chrome and Chromium (also built on Webkit) are also not vulnerable. Webkit is fine, at least in regards to this vulnerability.

      Safari (the closed-source browser built on Webkit) is vulnerable.

      This is a closed-source software bug that has been reported to the vendor.

      I don't disagree that all software has bugs. That's going to be true. But this is an example of the opposite.

      • Re: (Score:3, Informative)

        by Lars T. (470328)

        Umm... WHAT? Sorry to burst your conceit bubble there, Sparky, but... "Many eyes make bugs shallow" does not apply to Safari, because Safari is not open source software.

        Webkit (the open source rendering engine that Safari uses) is not vulnerable. Chrome and Chromium (also built on Webkit) are also not vulnerable.

        Well, yes and no.

        Jeremiah Grossman said...

        @Anonymous, Tom: I believe this may be a WebKit issue and not just Safari. While it is difficult to confirm now, I suspect this technique did in fact affect Chrome. Had some discussions with Google a while back surrounding this topic and recall them finding/fixing something, but I don't really get all the details straight. Will have to find an older Chrome version somewhere to confirm...

        @anonymous: this hack may have worked on Chrome at one time, but no longer. Trying to confirm, but difficult to get old OS X copies. :)

    • The problem is that the people who use firefox are not cut from the same cloth as the people who develop it.

      GCC is a robust and powerful compiler because the people who use it can fix it when it is broken and improve it.

      The vast majority of those who use firefox and other such products are utterly incapable of fixing problems, or even of identifying when there is a problem.

      • by ewanm89 (1052822)

        GCC is a lot more complicated than a browser, compilers are very tricky tools to make. A lot of users that can code C certainly wouldn't be able to make a compiler without training in that area (the difference between a CS degree and a software engineering degree). On top of that GCC is a whole load of compilers, assemblers and processors not to mention the optimizers. Add the question of how does one compile a compiler without the compiler, then one realises that just the build process is nastily complica

    • by lennier (44736)

      Could it be that the job is simply to complex for most non-professionals

      s/non//

      I think reality is showing us that programming in the modern Internet's always-on, concurrent environment in non-thread-and-memory-safe languages is not merely difficult for amateurs, but impossible for even professionals to do safely.

      I also think the answer will have to involving throwing out the von Neumann model, since we're manifestly living in a very non-von Neumann environment. Stuff happens all at once in a single giant massively-connected network of communicating processors (ie, the Internet)

      • s/non//

        So, most -profesionals? How... -professional of you.

        Sorry, I couldn't resist when there's a bug in your joke regex about software development being hard...

        (Maybe Erlang?)

        Not till it has better Unicode support, at the very least.

        We have Algol-descended languages based on the control-flow idea of 'do this thing, then that thing, in my private resource space',

        JavaScript still functions more or less like this. Try developing a Chrome extension -- if you want to communicate between tabs, you're going to end up sending messages. Granted, it's not going to be nearly as efficient as Erlang if you're handling large data structures...

        Me, I'm waiting for someth

    • by mjwx (966435)

      If that old canard is so true, than I have to wonder why it is that their are so many security-related issues with F/OSS browsers that go unchecked for so long?

      Because Safari is not an Open Source browser. No one but Apple can look at all of Safari's source code let alone submit a fix. Thus the old canard remains unchallenged, this is not endemic to WebKit or KHTML as it's affecting Safari only so I'd say the issue is in Apple's code, not the Open Source code.

  • Who fills out all their personal information into OS X's address/contact listing? I certainly don't

    • Re: (Score:2, Informative)

      by Spy Hunter (317220)

      Even if you've never used the Address Book app this information could be in there. In the OS X first-launch setup dialog it asks for your real name, and that gets automatically inserted into the address book. I'd wager that most people who use Macs have done this, so their real names are accessible to any website using this technique.

      Additionally, though this is less likely, if you fill out the registration form during setup I believe that information also goes into the address book, so there's your home

    • by natehoy (1608657)

      OK, fair enough, but (assuming you use Safari), this issue goes a little deeper...

      What information have you filled into web forms? Is Safari set up so it remembers that information?

      Sure, your name and address may be safe from the address book, but have you ever entered your name and address on a site and had it remembered?

      If you use Safari and you wish to continue using it, it's a very, very good idea to read the first article and turn off the "remember stuff in web forms" immediately, and keep it off until

    • by theurge14 (820596)

      I do. It's a rather useful feature.

      That I will be using again once this bug is fixed. :P

    • by tehcyder (746570)

      Who fills out all their personal information into OS X's address/contact listing? I certainly don't

      I know it's hard to believe, but just because you don't use a particular feature of an OS, it's just barely possible that others do.

  • by mark72005 (1233572) on Thursday July 22, 2010 @05:32PM (#32996424)
    "If you use Safari,..."

    Phew. That takes care of everyone.
    • Re: (Score:3, Funny)

      Well, everyone worth taking care of, at least.

    • Bug? (Score:3, Funny)

      by Anonymous Coward

      Just don't hold it like that.

    • by lwsimon (724555)
      I use Safari in Windows, and I'm taken care of too - I read the article (gasp!), turned off Autofill, and went about my day.
      • Re: (Score:1, Funny)

        I use Safari in Windows (gasp!)

        There, fixed it for you

      • How do you know you haven't already had the information taken from you?

        • How do you know you haven't already had the information taken from you?

          You don't know if you've had info taken from you, either. What do you do about it?

          • I don't use Safari so I know this particular exploit hasn't worked on me. Improves my chances, at least.

            • Heh. It is interesting that odds fluctuate based on what you don't know.

              • Yep. General statistics. If you watch the movie 21, he'll explain variable change.

                *situation is that he's hypothetically offered a car that is behind 1 of 3 doors. After choosing one, the host of the show opens one of the doors to reveal nothing. Now does he want to stick with his choice or change it.*

                Micky Rosa: He says, "Ben, do you want to stay with door number one or go with door number two?". Now, is it in your interest to switch your choice?
                Ben Campbell: Yeah.
                Micky Rosa: Well wait, the host knows where the car is. So how do you know he's not trying to play a trick on you - trying to use reverse psychology to get you to pick a goat?
                Ben Campbell: Well I wouldn't really care. I mean, my answer's based on statistics - based on variable change.
                Micky Rosa: Variable change? But he just asked you a simple question.
                Ben Campbell: Yeah, which changed everything.
                Micky Rosa: Enlighten us.
                Ben Campbell: Well, when I was originally asked to pick a door, I had a 33.3% chance of choosing right. But after he opens one of the doors and re-offers me the choice, it's now 66.7% if I choose to switch... So yeah, I'll take door number two and thank you for the extra 33.3%.

                • Heh nice. I'm thinking of Red Dwarf. The ship's blowing fuses all over the place. They escape in Starbug. Lister says "We're just leaving as a precaution. That ship has all these redundant backups and safety devices, the odds of the ship actually exploding are one in...." *ship explodes* "... One."

    • by tehcyder (746570)
      How about if my other half inadvertently downloaded Safari while installing an update of fucking iTunes for her fucking iPod, and I clicked it once by accident and decided that in future I'd rather surf the web with an etch-a-sketch, but never actually deleted it because the last time I tried that it deleted her entire catalogue of music, and signed me up to an S&M dating website?
      Do I still count as a Safari user?
  • and the data that this feature has access to includes the user's local address book

    The only card that can be read is the "Me" card, not the whole address book.

    • ...and having the "Me" card may allow me, as a wiley hacker, to work out if your account password is based on any information held in that card.

      Or maybe it gives me your phone number so I can call you & do a bit of social engineering to make you install an application I want on your machine, or even get you to reveal your password to me...

      Please do not underestimate the value of information to any hacker - even the "Me" card means someone can ending up knowing more about you then when they didn't have i

  • ...unless, of course, they give me a free bumper for my MacBook.
  • ... you are holding your Safari browsers the wrong way.

  • by aapold (753705) on Thursday July 22, 2010 @07:57PM (#32998062) Homepage Journal
    and they are: Alan Jones, 9112 Tarquin Drive Luton New Hampshire, Bday Nov 3, 1970, SSN# 867-53-0909...
    Arthur J. Smith, 30612 Jethro Lane, Biscuitbarrelville Connecticut,
    James Walker, 26318 Adrian Telescope Road, Harpenden Maine
  • Seems to me that autofill creates a database of personal information that is accessible by the Internet and dependent on a browser's security model. Does any kind of software have a worse record for security than Web browsers? (Maybe e-mail clients?)

    The first thing I do in any browser is turn off autofill for all fields. Anything I need to type into a form is either already in my head or I can look it up easily (credit card number for instance). Either way, it's personal info that IMO does not need to be at

  • Overblown? (Score:2, Redundant)

    by nilbog (732352)

    The only time the data is given to the browser is when you've already started typing it. Iirc you have to enter one field and then tab to the next. So if you're giving this data anyway it's not really a vulnerability. The only potential victims are people who start entering data and then decide not to. Worth paying attention to, but not exactly a huge problem.

Genius is ten percent inspiration and fifty percent capital gains.

Working...