Welcome to the MacNN Forums.

voodoo · May 12, 2003, 05:16 PM

http://www.secunia.com/advisories/8756/

I missed it, so somebody else must have too.

sounds pretty benign, but hey.

"Apple Safari and Konqueror Embedded fails to validate the Common Name of a SSL certificate. This makes it possible to spoof SSL sites, so that users can't trust the authenticity of a SSL website."

ophion · May 12, 2003, 08:16 PM

THAT seems benign? Do you do any online shopping or banking?

voodoo · May 12, 2003, 08:23 PM

Originally posted by ophion:
THAT seems benign? Do you do any online shopping or banking?

Well, *if* it occurs it is very very serious. I meant that it was so unlikely to happen that it was benign. Safety due to obscurety. There are so few Safari users in the world (well and Konqueror) that nobody will try to exploit these flaws.

I do hope Apple does something because I do a lot of online banking. In fact that is how I do all my banking.

ophion · May 12, 2003, 09:41 PM

Ah, yes, quite right, though the "security through obscurity" doctrine leaves me cold--there is always someone looking to take the piss.

I do all of my banking online, too. Safari currently does not work correctly with my bank's site. I am not sure whether the fault is in Citibank's JavaScript or Safari's interpreter. I have reported the problem to both companies.

voodoo · May 13, 2003, 09:21 AM

There are two options:

1. bug in Safari
2. bug with your bank

If your bank works with more than IE, Safari would begin to look suspicous. Of course Safari is in beta and remember to send the Safari team a bug report as well.

I find Apple to be awfully quiet about this ... issue.

car1son · May 13, 2003, 10:22 AM

There should be a little extra embarrassment because this exact same problem was discovered and widely reported 6 months ago in Internet Explorer and Netscape - and promptly fixed.
Evidently the Safari team doesn't have time to read the news.

ophion · May 13, 2003, 01:57 PM

Originally posted by voodoo:
There are two options:

1. bug in Safari
2. bug with your bank

Yes, that's what I meant when I wrote "I am not sure whether the fault is in Citibank's JavaScript or Safari's interpreter."

If your bank works with more than IE, Safari would begin to look suspicous.

I currently use Mozilla for my banking, and the site works fine in it.

Of course Safari is in beta and remember to send the Safari team a bug report as well.

I find Apple to be awfully quiet about this ... issue.

When I reported the issue to Apple, I used the bug button within Safari.

I, too, find Apple to be a bit quiet on the issue. I have been checking Software Update, expecting a patch to appear. Safari is Beta and all, but it is quite widely distributed (as Apple brags on its site). I would expect Apple, now that it is again a browser vendor (remember CyberDog?), to treat security issues seriously.