macnn
02/28/2008, 1:50pm, EST
Thursday, February 28th
Safari not secure against phishing, says PayPal
PayPal warns its members to avoid using Safari when making transactions, since it has a distinct lack of protection against phishing – the act of coaxing a user to click on a false link on a false web page for malicious purposes. PayPal users are typical targets for phishing attempts, where the page asks users for their personal login information. Once this information is collected, malicious users have free reign over a compromised PayPal account.
According to PC World Safari is the only major browser to be vulnerable in this way.
"Apple, unfortunately, is lagging behind what they need to do, to protect their customers," said Michaek Barret, chief information security officer for PayPal. "Our recommendation at this point, to our customers, is use Internet Explorer 7 or 8 when it comes out, or Firefox 2 or Firefox 3, or indeed Opera."
Safari also does not support EV certificates, a relatively new standard that gives the user a visual cue that a website is valid.
Filed under: Apple, industry, security, software
Other story tags: Safari, Paypal, phishing
, 
, 23
, 
, 
, 
, 
, 
Top
subscribe to comments
for this article
Paypal must be nuts to not fix this themselves. More Microtards in action.
What kind of statement is that? And phishing is a social issue not a technical one.
Someone must have made a few bucks to make that statement publicly. :-)
Always type in the address yourself.
I use PayPal all the time to send money to individuals who cannot take credit card payments. Same thing the other way.
Whoever is referred to as Microtards is probably not involved in any way here.
Other browsers already have this. Safari should. While it isn't 100% fool-proof, it will most likely save many ignorant users from the agony of identity theft and flat-out robbery.
The author of the article may have a point. Phishing is social engineering, but there are ways to reduce risk, and other developers are implementing them. Apple should too.
1) I get an email from my bank and 101 other banks warning me that I need to log in etc etc ... I DONT, just always manually type in your banks url yourself and manually log in
2) PayPal send me an email warning to change password, click link etc HOW ABOUT paypal jst educate users to NEVER to respond to such emails and always manually go to paypal and log in ??
it's not that hard