Hasta La Gadget!

This article was written on March 24, 2008 by CyberNet.

Last week we wrote about how Apple was trying to push the Safari “update” on any computer with the Apple Software Update installed, regardless of whether Safari had ever been installed before on the machine. I don’t believe there was really anyone in our comments who thought that it was okay for Apple to do this, and now Mozilla has stepped forward with their thoughts on the topic.

Needless to say Mozilla isn’t too fond with how Apple is using the Software Update application to distribute Safari. Maybe they’re concerned with how this could affect their market share, but in the end it seems as though they are genuinely on the side of the consumer:

That’s a problem because of the dynamic I described above — by and large, all software makers are trying to get users to trust us on updates, and so the likely behavior here is for users to just click “Install 2 items,” which means that they’ve now installed a completely new piece of software, quite possibly completely unintentionally. Apple has made it incredibly easy — the default, even — for users to install ride along software that they didn’t ask for, and maybe didn’t want. This is wrong, and borders on malware distribution practices.

It’s wrong because it undermines the trust that we’re all trying to build with users. Because it means that an update isn’t just an update, but is maybe something more. Because it ultimately undermines the safety of users on the web by eroding that relationship. It’s a bad practice and should stop.

What I’m left wondering is how many people who install Safari for the first time this way will actually use it? Is Apple just looking for a number that they can boast as to how many computers have Safari installed, or will they actually be able to see a jump in market share as a result of their slightly deceitful practices? We’ll have to keep an eye on the browser stats next month and compare them to how they have performed in the past.

[parts of the image by flatrock]

Copyright © 2009 CyberNet | CyberNet Forum | Learn Firefox

Related Posts:

• Safari Illegal to Use on Windows?
• New Apple Software Updater Appeases Critics, Kind of
• Firefox 3 Themes: Vista on XP, or XP on Vista
• Mozilla Firefox 1.5.0.5 Release Scheduled For Thursday
• Firefox 1.5.0.6 Will Be Released Sooner Than Expected

This article was written on August 03, 2007 by CyberNet.

Cookies are used in your web browser to store information, but have you ever thought about how easy it would be for a hacker to quickly gain access to them? It is actually frighteningly easy as Robert Graham, the CEO of errata security, demonstrated at the Black Hat security convention. All it really takes is a point-and-click of the mouse:

First Graham needs to be able to sniff data packets and in our case the open Wi-Fi network at the convention fulfilled that requirement. He then ran Ferret to copy all the cookies flying through the air. Finally, Graham cloned those cookies into his browser – in easy point-and-click fashion – with a home-grown tool called Hamster.

The attack can hijack sessions in almost any cookie-based web application and Graham has tested it successfully against popular webmail programs like Google’s Gmail, Microsoft’s Hotmail and Yahoo Mail. He stressed that since the program just uses cookies, he only needs an IP address and usernames and passwords aren’t required.

In front of everyone at the convention Graham demonstrated how he could intercept the cookies from a person sending an email. He had someone creat a Gmail account, and in no time at all Graham had intercepted the cookies therefore enabling him to send an email disguised as the victim. As mentioned in the above quote, there were no usernames or passwords needed.

–Secure Yourself–

One of the easiest things that you can do to secure yourself from such an easy attack is to use https:// instead of http:// whenever it is available. Some services like Gmail offer this alternative, and using it encrypts your session using SSL so that these types of attacks don’t happen.

Firefox users (with Greasemonkey), Internet Explorer users (with IE7 Pro or Turnabout), and Opera users can use a script such as this one that is setup to automatically replace the http:// with https:// anytime that you visit Gmail. That way you never have to think about doing it yourself.

You should also try not to visit sites that use sensitive information while connected to a public hotspot, but I think we all know that by now.

Source: TG Daily [via Slashdot]

Copyright © 2008 CyberNet | CyberNet Forum | Learn Firefox

Related Posts:

• Get 4 GB of Storage with Windows Live Mail Plus
• Switch to Yahoo! Mail from Gmail and Hotmail
• Use Yahoo! Mail or Gmail for MailTo Links in Firefox 3
• Yahoo, Hotmail and Gmail Keyboard Shortcuts to Delete Emails
• Helpful Tip: How to Report a Phishing Email