main

PayPal warns: Steer clear of Apple's Safari browser

Daniel Fleshbourne   on 28 February 2008 - 13:04 · 32 comments & 15934 views

Advertisement (Why?)
If you're using Apple's Safari browser, PayPal has some advice for you: Drop it, at least if you want to avoid online fraud. Safari doesn't make PayPal's list of recommended browsers because it doesn't have two important anti-phishing security features, according to Michael Barrett, PayPal's chief information security officer.

"Apple, unfortunately, is lagging behind what they need to do, to protect their customers," Barrett said in an interview. "Our recommendation at this point, to our customers, is use Internet Explorer 7 or 8 when it comes out, or Firefox 2 or Firefox 3, or indeed Opera." Safari is the default browser on Apple's Macintosh computers and the iPhone, but it is also available for the PC. Both Firefox and Opera run on the Mac.

View: The full story @ InfoWorld

Post a comment · Send to friend Comments · There are 32 additional comments
(5 replies) #1 ScottKin on 28 Feb 2008 - 13:20
I wonder how long it will take for the Apple supporters here to respond?

Better yet: how will they respond?

Even Better yet: how soon will it take them to blame Microsoft?

The flip-side of this coin: I really feel sorry for Safari users, now that there is this gaping security hole in Safari.
#1.1 whoreman on 28 Feb 2008 - 13:34
(ScottKin said @ #1)
I wonder how long it will take for the Apple supporters here to respond?

Better yet: how will they respond?

Even Better yet: how soon will it take them to blame Microsoft?

The flip-side of this coin: I really feel sorry for Safari users, now that there is this gaping security hole in Safari.


Enough flame bait in there?
#1.2 +acxz on 28 Feb 2008 - 13:46
(ScottKin said @ #1)
I wonder how long it will take for the Apple supporters here to respond?

Better yet: how will they respond?

Even Better yet: how soon will it take them to blame Microsoft?

The flip-side of this coin: I really feel sorry for Safari users, now that there is this gaping security hole in Safari.


I would say it was a gaping hole in the security because phishing is easy to avoid without massive pop-up messages freezing the screen whenever the browser detects it =/
#1.3 Kirkburn on 28 Feb 2008 - 13:49
(acxz said @ #1.2)
I would say it was a gaping hole in the security because phishing is easy to avoid without massive pop-up messages freezing the screen whenever the browser detects it =/

Assuming that sentence was supposed to be in the negative - no, phishing is not easy to detect, at least not for the masses.
#1.4 betasp on 28 Feb 2008 - 13:51
Security hole, or a lacking feature? I don't think anti-phishing (or lack thereof) has anything to do with "gaping security holes," it has to do with a lacking feature. Do you know how anti-phishing works? What happens if the list that is automatic (outside of user control) gets compromised and the actual paypal gets listed, and the phishing site is approved? THAT is a security hole.

Last edited by betasp on 28 Feb 2008 - 15:17
#1.5 cork1958 on 28 Feb 2008 - 14:08
(betasp said @ #1.4)
Security hole, or a lacking feature? I don't think anti-phishing (or lack thereof) has anything to do with "gaping security holes," it has to do with a lacking feature. Do you know how anti-phishing works? What happens is the list that is automatic get compromised and the actual paypal gets listed, and the phishing site is approved? THAT is a security hole.


Have to go along with that, for the most part.
(1 reply) #2 guruparan on 28 Feb 2008 - 13:22
I am sure how Mac users feel the Safari in there Mac (maybe it will good)..but it looks ugly in Windows!!
#2.1 vetneufuse on 28 Feb 2008 - 14:12
(guruparan said @ #2)
I am sure how Mac users feel the Safari in there Mac (maybe it will good)..but it looks ugly in Windows!!
Ugly isnt the half of it... I don't get why everyone on windows has to change the UI.. use the darn native UI! heck you dont see MS changing Apple's UI to look like windows when they make apps on it do you?
(1 reply) #3 Jasbond on 28 Feb 2008 - 14:09
You can do the next best thing - just don't be an idiot and visit phishing sites.
#3.1 vetneufuse on 28 Feb 2008 - 14:17
(Jasbond said @ #3)
You can do the next best thing - just don't be an idiot and visit phishing sites.


So you are calling all the normal non-tech users out there idiots? Maybe you're an idiot if you are computer savy and do that but average users out there don't know as much as we do about URL's DNS systems and all that fun stuff to tell when something is phishing or not... heck today alone I got a phishing e-mail from "paypal" saying my account was under review for supicious activity from an address that looked like paypal's almost completely... except one little thing... it was secure-paypal.com which a average user might think (and yes they will! that this is paypal.com because it says paypal.com! right? and it says secure! so it must be secure too! that's how they think... believe me... years of dealing with them i've realized that the average person thinks like that...
(1 reply) #4 YaZoR on 28 Feb 2008 - 14:13
Who cares
#4.1 vetneufuse on 28 Feb 2008 - 14:18
(YaZoR said @ #4)
Who cares


People that might get scammed maybe?
(3 replies) #5 phiberoptik on 28 Feb 2008 - 14:33
And after you drop Safari, drop Paypal because they are the next biggest crooks on the planet next to the guys running the phishing sites.

If ANYONE here uses paypal, and hasn't been to http://www.paypalsucks.com do yourself a favor and read some of the stuff that goes on with that company, I can speak from experience about them ripping me off.

It's one of those things you really don't care to believe, until you read the actual situations that people have been put through, then at least you go to yourself "wow maybe I should seriously re-consider using them"


#5.1 roadwarrior on 28 Feb 2008 - 17:17
Millions of people (myself included) have used PayPal for years with no problems at all, but of course, you don't see them creating web sites to promote the fact. Any large business is going to have a small percentage of people who aren't happy with them.
#5.2 TRC on 28 Feb 2008 - 23:15
I've also been using Paypal for years, never had a single problem with them. Are you going to go by millions of users who've had no trouble with them or some website called paypalsucks? It's call using your brain. Even if you are worried, simply don't verify your bank account with them and don't keep funds in your Paypal account. By doing that they cannot freeze your funds (since you don't have any to freeze) nor can they withdraw money from your bank.

Last edited by TRC on 28 Feb 2008 - 23:36
#5.3 C_Guy on 03 Mar 2008 - 17:12
Sorry if you've been victimized and feel the need to spread crap about PayPal but maybe you need to take responsibility for falling for those phishing scams. Maybe you were using Safari at the time
#6 The_Decryptor on 28 Feb 2008 - 15:45
I just avoid it by going to paypal.com

If a user thinks they are going to the real paypal site, they're probably going to ignore any warnings that it isn't ("Oh it's just a false alarm"

And I fail to see how lack of EV certificates support is going to open people up to phishing, it's not that noticeable (Firefox 3 turns the background of the favicon green and shows the name of the company, it's not noticeable).
(2 replies) #7 +rm20010 on 28 Feb 2008 - 16:53
Can a Leopard user please confirm if anti-phishing made it into Safari?
#7.1 Galley on 28 Feb 2008 - 19:32
I've never noticed anything like that, but I've probably never visited a bogus site, either.
#7.2 osirisX on 28 Feb 2008 - 21:03
It's gone. But the red bar is still in Safari's resources.
#8 n_K on 28 Feb 2008 - 18:22
Drop paypal, its ****
(4 replies) #9 AeronPrometheus on 28 Feb 2008 - 18:30
Any company, anyone, that recommends the use of Internet Explorer does not have an acceptable understanding of technology.
#9.1 RangerLG on 28 Feb 2008 - 18:57
They recommend IE7 (or greater), which has a very good anti-phishing system built in.
#9.2 HawkMan on 29 Feb 2008 - 02:39
It also works very good, is at least as secure as FF, if you're on Vista its a lot more secure than FF, and it does everythign you need a browser to do.

so again, why do they not have an acceptable understanding of technology, I think that award goes to you.
#9.3 Patchou on 01 Mar 2008 - 18:56
(AeronPrometheus said @ #1)
Any company, anyone, that recommends the use of Internet Explorer does not have an acceptable understanding of technology.

lol. Care to explain? my understanding of technology is not that good either.
#9.4 C_Guy on 03 Mar 2008 - 17:13
Actually, anyone who bashes IE for no reason deserves even less respect.

Learn something about software, then come back and post.
#10 osirisX on 28 Feb 2008 - 21:02
Early on in the Leopard beta, Safari 3 had anti-phishing measures. For some reason they removed it but left the resources inside the app (The red warning banner is still there).
(3 replies) #11 LTD on 28 Feb 2008 - 22:29
Or you can just drop ****ty PayPal.

Let's see . . . sacrifice a core element of the Apple User Experience over one of several (if not many) online payment methods.

Not likely.



#11.1 RAID 0 on 28 Feb 2008 - 23:06
#11.2 HawkMan on 29 Feb 2008 - 02:42
ah because paypal is the only site that can be abused by phisers ? of course, it's so obvius...

and exactly what shold you use instead of Paypal then ? since paypal is currently the only system of it's kind universally compatible on pretty much everything. still I don't use Paypal, much since I pay with my Visa.

Granted if you ue Safari, the consequences of being the victim ofphising with your Visa is far worse than if it was paypal.


Seriusly can you EVER accept that not eveything Apple is perfect, they do have flaws, and for the average joe, wich is who Apples is aiming fo with their products, Phising is a SERIUS problem, and thus sois the lack of anti phising features.
#11.3 C_Guy on 03 Mar 2008 - 17:17
More like, sacrifice Apple's joke of a browser to keep yourself safe, or fall for Steve Jobs' distorted view of reality and try to pass it off as fact on Neowin.

Hhhmmm... so hard to choose.
#12 thejohnnyq on 28 Feb 2008 - 23:57
Finally some common sense. Safari is very scary, and has a lot of issues. I have been investigating some issues that i have found, and from what i see so far, Safari pulls data from goggle, (previous searches) and that is for the address bar. I have been tracking and replicating this, scaring the hell out of people.

papal may have its problem, but i am glad they spoke up.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)