Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
Security Businesses Apple Your Rights Online

Paypal Advises Users To Stop Using Safari 362

Posted by Zonk from the watch-where-you-click dept.
eldavojohn writes "Over concerns for lack of an anti-phishing mechanism for Safari, Paypal is telling its Mac users to use another browser. An author from Ars Technica reveals that he has been using Camino and has fallen victim to a Paypal related phishing scam via e-mail so this story must hit home for him. 'Currently the Apple browser does not alert users to sites that could be phishing for your info, and it lacks support for Extended Validation. PayPal is, of course, a popular site among phishers in their neverending search for personal information, user IDs, and passwords. While it's not entirely fair singling out Safari (other Mac browsers like Camino also lack this support), it is perhaps at least a helpful reminder of the threat.'"
This discussion has been archived. No new comments can be posted.

Paypal Advises Users To Stop Using Safari More

Paypal Advises Users To Stop Using Safari

Comments Filter:

  • Maybe Apple should... (Score:4, Insightful)

    by gillbates ( 106458 ) on Monday March 03, 2008 @07:33PM (#22629560) Homepage Journal

    Tell Safari users to stop using PayPal...

    • Re:Maybe Apple should... (Score:5, Insightful)

      by Jeremiah Cornelius ( 137 ) * on Monday March 03, 2008 @07:39PM (#22629616) Homepage Journal
      C'mon.

      Apple is deficient here - no doubt about it. If you want Mom & Pop to click "pay now", you don't expect 'em to be able to parse "http://www.barclays.validation.co.uk". You don't have to be an "idiot" to fall for this - just outside your area of expertise.

      I have replaced Safari with FireFox on every friend and family mac I get my hands on. Re-theme it, copy and paste the icon resource, and they don't notice the change!

      Except for the missing ads - thanks to Ad Block+

      • Re: (Score:3, Interesting)

        by goombah99 ( 560566 )
        What theme do you recommend as the most "mac-like" and minimalist in screen real estate? and what do you mean copy and paste the icon resource.

        • Re: (Score:3, Informative)

          by Constantine XVI ( 880691 )
          The Firefox3 betas come with a new very Mac-like theme, called Proto. I believe you can download it for Firefox2 as well

        • Re:Maybe Apple should... (Score:4, Insightful)

          by Anonymous Coward on Monday March 03, 2008 @08:07PM (#22629958)

          What theme do you recommend as the most "mac-like" and minimalist in screen real estate?
          Please - that's like asking for "the most Windows-like and stylish".

          Minimalist use of screen real estate is not a Mac virtue: Apple's principle is that screen real estate should be used well, not minimally. That's why they've made a big deal out of having bigger icons than Windows, for example, even though that means the Dock takes up about three times as much screen real estate as Windows' taskbar. Big icons = easier to hit = more efficient for the user. You aren't wasting that space, you're trading it for your time. And I assure you, unless you flip burgers or something then your time is valuable enough that you can certainly justify buying a bigger screen if you really need more working space.

          (Incidentally, I do rather wonder why, with modern Macs all having wide-aspect monitors, the default Dock position is still along the bottom of the screen, and why windows still have their toolbars along the top rather than down the side, but those are whole other cans of worms...)

          • Re: (Score:2)

            by 7Prime ( 871679 )
            Compared to Vista, and even XP in some areas, it's definitely minimalist. The default icon size in Vista is HUGE, and there are so many beveled edges and circles everywhere that there's just an immense amount of wasted space.

            I would say that MacOS X has generally become more minimalist in both its spacial and overall feel. Leopard had a few drawbacks (3D dock, transparent menus), but even then it toned down a lot of needless flair in other areas.

            I would generally agree that MacOS X isn't exactly what I woul

          • Re:Maybe Apple should... (Score:4, Insightful)

            by theurge14 ( 820596 ) on Tuesday March 04, 2008 @11:01AM (#22635482)
            Minimalist use of screen real estate is not a Mac virtue:

            Big icons is your only example of this? On the contrary:

            * The 'Maximize' button will only open the app window as large as the content inside of it requires, it will not fill the screen.
            * One menu bar along the top for all open windows ensures no screen space is wasted with repeated displays of a menu bar.
            * Mac OS X automatically resizes dialog boxes to accommodate the content inside of them.
            * Dialog boxes that open off the edge of the screen will be automatically moved back into the screen along with the rest of the app, and when closed the OS will shift the app back where it was before you opened the dialog box.
            * Most apps do not have a 'background' window as to allow interaction with the desktop while the app is open. One common example is Photoshop.

            Most Windows users I observe maximize all their open apps to completely cover the desktop and use the Start bar as a full-screen task-switcher. In other words, a multi-tasking MS-DOS.
        • Foxdie [mozilla.org]

          iSafari Leopard [mozilla.org]

          Resource? Command "I" to "get info" on Safari. Click on the Icon, and Command "C" to copy. Command "I" on FireFox to "get info". Click on the Icon and Command "V" to paste. Close all dialogues.

      • Re:Maybe Apple should... (Score:5, Insightful)

        by MacDork ( 560499 ) on Monday March 03, 2008 @08:03PM (#22629910) Journal

        C'mon.

        Apple is deficient here - no doubt about it.

        Deficient eh? I use Omniweb. Same issues I'm sure, but I'm comfortable with it. I have something I feel is far more secure than a colored URL bar and Extended Validation box that begs for attention... I have an encrypted system wide keychain [xvsxp.com] that is not going to have a username/password for paypa|.com. I might not catch that pipe as a lower case L... I my not catch a cyrillic character that looks just like an 'a' in there, but my keychain aware browser certainly will. It won't have a password for that domain, and that will instantly alert me to the fact that something is fishy. Proceed to open a new window and manually enter the address as a test... I rely on my keychain so much, I generally don't know the password for most websites I use, so I therefore cannot be suckered into revealing it. I'm sure Safari can be configured the same way.

        Instead of railing on Apple for not adopting the technologically deficient solution of other browser makers, perhaps they should instead focus on what is IMHO a superior approach to security... No dice on Windows Safari, sure, but on the Mac I have no fear of phishers.

      • Re: (Score:2)

        by iamacat ( 583406 )

        Apple is deficient here - no doubt about it. If you want Mom & Pop to click "pay now", you don't expect 'em to be able to parse "http://www.barclays.validation.co.uk". You don't have to be an "idiot" to fall for this - just outside your area of expertise.

        And if the phishing filter doesn't alert them, do you want to encourage Mom & Pop to go ahead and enter their credit card info on an unknown URL opened from an e-mail message? I, for one, welcome our new botnets with phishing web pages running on infected desktops overlords.

        I have replaced Safari with FireFox on every friend and family mac I get my hands on. Re-theme it, copy and paste the icon resource, and they don't notice the change!

        Maybe they want, but people here will certainly notice that their blogs no longer benefit from Apple's built-in spellchecker for text fields. You shouldn't muck with people's machines unless there is a compelling reason. Someday th

        • How exactly would they notice that when Firefox has built-in spell checking too? I'm not agreeing or disagreeing with your main point, but I think it would be erroneous to assume the type of computer users he's talking about will ever want to learn about how computers work.

      • Re:Maybe Apple should... (Score:5, Informative)

        by MightyYar ( 622222 ) on Monday March 03, 2008 @08:24PM (#22630118)
        Let Safari/Firefox save your username/password. Then when it doesn't auto fill-in, you know something is up.

        Safari is better for this strategy since it uses the secure key chain and not the - last time I checked - weak obfuscation that Firefox uses.

        • Re:Maybe Apple should... (Score:4)

          by Jeremiah Cornelius ( 137 ) * on Monday March 03, 2008 @08:41PM (#22630288) Homepage Journal
          The day I let a browser/OS save credentials to my critical, financial account information is the day Tom Cruise goes straight.

          I spent five years doing pen/VA for banks and insurance companies. I take none of this crap for granted.

          Physical security of your laptop becomes far too high a risk.

          "Keychain" is for .Mac, not Lloyd's.
          • it's not your choice to make for other people though.
            • These are people who say: You do security for a living. How do I keep from getting my credit card stolen on the Internet? Can you help me?

              Not a choice I sneak on to their computer, in the dead of night! :-)

          • Re: (Score:3, Insightful)

            by MightyYar ( 622222 )
            I wouldn't trust it on my laptop, either. If someone is sitting on your home computer, you've got bigger problems than the password to your eBay account.

            But if I did have it on my laptop, I'd sure as hell change my passwords the first chance I get.

            • Re: (Score:3, Insightful)

              by Jarjarthejedi ( 996957 )
              "I wouldn't trust it on my laptop, either."

              "But if I did have it on my laptop, I'd sure as hell change my passwords the first chance I get."

              This seems like a bit of an illogical statement, along the lines of calling to cancel a lost credit card. You seem to be making the claim that a laptop with those saved credentials can be lost, which is a good enough reason to not make use of it, and yet people have been losing and canceling credit cards for years, a laptop is much easier to notice missing than a piece

      • Re:Maybe Apple should... (Score:5, Interesting)

        by misleb ( 129952 ) on Monday March 03, 2008 @08:41PM (#22630284)

        I have replaced Safari with FireFox on every friend and family mac I get my hands on. Re-theme it, copy and paste the icon resource, and they don't notice the change!


        And with Firefox 3, you don't even need a theme. They look very similar now. Firefox 3 even seems to use the Aqua style widgets.

        -matthew

      • Re: (Score:3, Insightful)

        by catwh0re ( 540371 )
        While I agree that anti-phishing features would be a plus for Safari.(go download an extention like you do for any other browser) I think the problem should be addressed on the Paypal end. After all their website, links to ebay and methods are severly lacking as is it - even when you aren't diverted to a phishing scam there are a whole list of reasons not to use paypal.

      • No ads required in Safari (Score:4, Informative)

        by Lord Satri ( 609291 ) <alexandreleroux@@@gmail...com> on Tuesday March 04, 2008 @12:24AM (#22631872) Homepage Journal

        Except for the missing ads - thanks to Ad Block+
        I recently switched to Safari as main browser (at home, work = Firefox under Debian) for various reasons, and one of the software that made that switch enjoyable is http://safariadblock.sourceforge.net/ [sourceforge.net] ... (much easier to use than PithHelmet in my opinion, and open source)

      • Re: (Score:3, Interesting)

        by dangitman ( 862676 )

        Re-theme it, copy and paste the icon resource, and they don't notice the change!

        Yeah right. Firefox fails because of the way it handles text fields in a totally non-Mac-like way. Have your cursor at the end of a single-line text field (like the URL entry field) and want to go back to edit something at the beginning of the line? In just about every other Mac application, you simply hit the up-arrow once, and it goes to the beginning of the line of text. But not in Firefox, for some reason. Instead, I have to hold down the left-arrow and wait for it to get to the start of the line.

        The

    • Re: (Score:3, Funny)

      by Breakfast Pants ( 323698 )
      Paypal will have to tell phishing sites to copy this Safari warning as well, which I'm sure they will be happy to do.

    • Oh, stop whining. (Score:5, Insightful)

      by Whiney Mac Fanboy ( 963289 ) * <whineymacfanboy@gmail.com> on Monday March 03, 2008 @07:58PM (#22629852) Homepage Journal
      All Paypal did was have a faq [paypal.com] containing a list of anti-phishing features & browsers that support those features.

      They don't recommend against Safari, they just recommend browsers that support anti-phishing features.

      No doubt when Apple gets around to adding these features (pity Safari's not OSS, or it could be added easily by third parties), PayPal will add them to the list.
      • Whiney Mac Fanboy goes head to head with a Mac Fanboy who is currently whining!

  • IE (Score:2, Insightful)

    by webmaster404 ( 1148909 )
    So wait.... you shouldn't use a (decently) secure browser such as Safari that is partly open-source, while you should use a browser that is fully proprietary (though with anti-phishing) and has a track record of being insecure? Not to mention how easy it is to keylog most Windows systems have already? Honestly, I think that making sure your browser is secure is much more important then making sure your info isn't going to an incorrect site.

    • Re: (Score:2, Insightful)

      by Loconut1389 ( 455297 )
      Good point- the types of people who would install/use another browser, probably already do check.

      • Re: (Score:3, Insightful)

        by teh moges ( 875080 )
        This used to be a valid point, but Safari ships with OSX and a lot of users get Firefox installed by their tech-savvy friends. Still, there is a very simple way of getting around these problems:
        1) No financial institution should ever ask for your email address. Ever. Not as a required field, not as an optional field. The person signing up should be informed that they are deliberately not being asked for this information either.
        2) The exception to this: Reminders. These are setup WHILE logged in to the sit

    • The Yahoo article has more information and reasoning. I link to it, quote it and give an alternate explanation here [slashdot.org]. Basically, Paypal is losing customers of all browsers but least of all from IE7 users. I think this is because IE7 users are sheep not people sharp enough to have noticed a new tool.

    • Uhm, no (Score:3, Interesting)

      by Bryansix ( 761547 )

      Honestly, I think that making sure your browser is secure is much more important then making sure your info isn't going to an incorrect site.

      This is most assuredly wrong. You see, the browser can be completely secure and if you are loging into a fake website your login will be stolen and your bank account emptied. Note that there are TWO ways to deal with this. One is anti-phishing features in browsers and the other is a stronger login mechanism like the one ING uses. ING just recently had the lowest repor

      • Re:Uhm, no (Score:4, Informative)

        by russotto ( 537200 ) on Monday March 03, 2008 @10:43PM (#22631178) Journal

        The reason is that ING allows the users to KNOW that they are on the correct website through the use of a custom image of their choice.
        Bank of America has the same system, so that fails to explain the difference in ID theft. Probably one reason is that ING Direct gets more savvy users than BoA.

  • OpenDNS to the rescue (Score:5, Informative)

    by bstadil ( 7110 ) on Monday March 03, 2008 @07:38PM (#22629608) Homepage
    Just change your DNS to OpenDNS [opendns.com] and you are covered. OpenDNS monitors Phising sites and will not let you resolve to it. You don't need to sign up just use their nameservers at 208.67.222.222 and 208.67.220.220. It's free. If you sign up you get some additional cool features like blocking selected domain types Like Pron if that's not your thing.

    • Re:OpenDNS to the rescue (Score:5, Insightful)

      by karmatic ( 776420 ) on Monday March 03, 2008 @07:59PM (#22629864)
      OpenDNS monitors Phising sites and will not let you resolve to it.
      That's assuming, of course, that it's using a unique DNS name. For pages hosted on SourceForge, Geocities, etc. it won't do anything at all, and may provide a false sense of security.

      Furthermore, it's really easy to create phishing pages that will only show their contents to humans, and not spiders.

      • Re: (Score:3, Insightful)

        by Peaker ( 72084 )

        Furthermore, it's really easy to create phishing pages that will only show their contents to humans, and not spiders.
        Isn't it equally easy to create spiders that look like humans?

        Does there phishing information originate from a spider, anyhow?

    • Re:OpenDNS to the rescue (Score:5, Funny)

      by fm6 ( 162816 ) on Monday March 03, 2008 @08:28PM (#22630156) Homepage Journal

      OpenDNS monitors Phising sites and will not let you resolve to it.
      OpenDNS monitors known phishing sites. Phishers really should update the database when they start a new site, but for some strange reason, they rarely bother.

  • What nonsense. (Score:5, Informative)

    by gnutoo ( 1154137 ) on Monday March 03, 2008 @07:38PM (#22629610) Journal

    IE over Safari? Really? I can understand wanting a good free browser like Firefox on OSX but IE? Do they even have IE 7 for OSX yet? The article Ars points to [yahoo.com] says that this is driven by IE7 users not quiting PayPal. The fishing stuff is pure speculation and not even Microsoft thinks IE7 fishing protection is effective:

    Last year, researchers at Microsoft and Stanford University published a study showing that, without training, people were unlikely to notice the green address-bar notification provided by EV certificates.

    Barrett says data compiled on PayPal's Web site show that the EV certificates are having an effect. He says IE 7 users are more likely to sign on to PayPal's Web site than users who don't have EV certificate technology, presumably because they're confident that they're visiting a legitimate site.

    Over the past few months, IE 7 users have been less likely to drop out and abandon the process of signing on to PayPal, he said. "It's a several percentage-point drop in abandonment rates," he said. "That number is... measurably lower for IE 7 users."

    Rather than percieved security, I think the reason they see more IE7 users still logging in is because IE7 users are the kind of sheep that move along when prodded. They are using Windows, right? Like sheep to the slaughter, every day.

    I've got a paypal account. I don't use it much because I don't use Ebay much. I would never use an emailed link to visit the site because it's just as easy to find the right page through Paypal itself. If they make it hard, they don't deserve my business.

  • here phishie phishie (Score:3, Insightful)

    by themushroom ( 197365 ) on Monday March 03, 2008 @07:38PM (#22629612) Homepage
    Look, if you're not checking what's in the URL of your browser, or are in the habit of clicking on links in email blindly, you get the phishing you deserve. The best protection mechanism in any browser against phishing is your eyes, looking at the address bar.

    snark: And Safari users are advised to stop using PayPal.

    • Re:here phishie phishie (Score:5, Insightful)

      by Niten ( 201835 ) on Monday March 03, 2008 @07:55PM (#22629802)

      Look, if you're not checking what's in the URL of your browser, or are in the habit of clicking on links in email blindly, you get the phishing you deserve.

      I'm all for exercising personal responsibility, but I'd never argue that anybody 'deserves' to fall victim to a phishing scam.

      The fact of the matter is that there are some people (my grandparents, for example) who like to use the Web, but who are perhaps just a little bit senile and might one day fall for this sort of thing. If even an Ars Technica writer can fall for it, how can we expect an 80+ year-old to constantly exercise due vigilance?

      I'm actually quite OK with this PayPal advisory: the kind of people who will act upon it -- computing amateurs, basically -- probably should be using a browser that raises a big fat red flag when it hits a known scam site, and I'd recommend that such people use Firefox, Opera, or even IE 7 rather than Safari. The rest of us, those who are clueful enough to know how to protect themselves, aren't really the ones that PayPal is addressing here.

    • Re: (Score:3, Interesting)

      by 99BottlesOfBeerInMyF ( 813746 )

      Look, if you're not checking what's in the URL of your browser, or are in the habit of clicking on links in email blindly, you get the phishing you deserve.

      On this I must disagree. Right now the best solution probably is double checking URLs, but that is realistically not a good solution for the majority of people. Apple (and every other browser developer) should be working on a a URL whitelist/greylist/blacklist detection and warning technology. I'm not sure, however, that they should rush to deploy such technology. It might be better to wait until it is reliable enough to provide real benefit without providing a false sense of security. Right not IE has su

    • I remember a well publicized phishing site with the name paypa1.com

      Yes, that last letter was the numeral 1. pretty hard to tell, huh? Especially if the font wasn't serifed.

      How about those sites which used the multilingual capabilities of certain browsers like firefox to list non-anglo-roman characters into the address bar which looked similar or identical to the literal versions of those letters?

      The fact is, the phishers are crafty, generally more crafty then your Average Joe when it comes to internet tri

      • Re: (Score:2)

        by sqlrob ( 173498 )
        And all are defeated by "don't click financial links in an e-mail". No need to check the links, just don't do it, period.

  • Phishing protection? Really? (Score:5, Insightful)

    by SanityInAnarchy ( 655584 ) <ninja@slaphack.com> on Monday March 03, 2008 @07:39PM (#22629634) Journal
    The kinds of people who fall for phishing scams aren't likely to pay attention to what PayPal advises them to do.

    So why not cut the middleman and just advise them to not fall for phishing scams -- that is, to always verify https://www.paypal.com/ [paypal.com] in the URL?

  • Every browser has and anti-phishing mechanism (Score:5, Interesting)

    by edalytical ( 671270 ) on Monday March 03, 2008 @07:43PM (#22629666)
    It's called the address bar. It's very easy to use, just type where you want to go and press return. Before entering sensitive information into a browser window check the address bar and make sure you are where you think you are. I know your mom and my mom might not fully understand the address bar, but I think it would be easier for them to learn about it than installing a new browser.
    • And just hope and pray that http://en.wikipedia.org/wiki/DNS_cache_poisoning [wikipedia.org] hasn't happened, or your simple little fix is worthless

    • Of course, in the case of a really neat phishing where the address is really close, this may not work all the time. Do you actually check every link you follow to make sure it's correct? maybe, say, if it was e-mailed from a personal friend or something?

      I'm sure a lot of doctors would say that if people just washed their hands more, you wouldn't get as sick... but if you DO get sick, they don't just tell you "Pft, too bad, you should have washed your hands. Next."

      Besides... if it's possible for a brows

    • Yes, but some addresses look like legit ones. Some might use some Unicode characters, others might use a domain that looks resonable, and other can play with .com .org .edu part of the domain, remember whitehouse.com?

    • Re: (Score:2)

      by kindbud ( 90044 )
      It's called the address bar.

      Yes of course! Why didn't they realize that DNS has been an absolutely reliable indicator of the authenticity of a site, ever since DNSSEC was implemented way back in 1997.

      I'll tell you why: because that happened in an alternate reality, not this one!

    • Re: (Score:2)

      by kindbud ( 90044 )
      Before entering sensitive information into a browser window check the address bar and make sure you are where you think you are.

      Oh, and I almost forgot about iframes. You know, that feature that lets you put another site inside your site, without changing the address bar or showing an obvious frame border? Yeah.

      By the way, chances are I am not behind a firewall or proxy, can we get that stupid condescending message changed to just "Slow down Cowboy, do you think this is a discussion forum?"
      • I think a lot of replies are bringing up valid points, but I also think the address bar is your first line of defense when it comes to phising. For the most part avoiding scams is a matter of detecting the scam. Informed users are a far cry better than a browser features users wont understand in the first place.

  • i've gotten those scam e-mails before... (Score:3, Interesting)

    by kesuki ( 321456 ) on Monday March 03, 2008 @07:49PM (#22629744) Journal
    http://www.fightidentitytheft.com/paypal_scam.html [fightidentitytheft.com]

    mine was similar, only it claimed they were doing a fraud investigation about fraudulent use to my account.

    they use the images and everything it looks exactly like a paypal e-mail, only the hyper link when you hover over it says a different website than in the email message. (they're doing a simple html trick, which is always the first thing i look for)

    I've seen them do the same thing with say, yahoo mail login sites, etc. one of my less savvy friends got her IM name stolen for use sending IM spam.

    safari is bass acwards to not show the real url on a tool bar! i couldn't live a day without that feature.
    • I'm confused, Safari does show the REAL url on the toolbar.

      Maybe you're the confused one.

    • Re: (Score:2, Insightful)

      by Gewalt ( 1200451 )
      You mean the status bar, and safari hides that by default because it can be erronously updated with javascript. In other words, if you're relying on the status bar, you're your own worst enemy.

      • Re: (Score:2)

        by kesuki ( 321456 )
        ahh well, i also have a firewall that blocks all the badies, i didn't say i relied on it, i said i couldn't live without it. people on slashdot often times have very long urls that hide say goatse links. and last i checked, yahoo mail doesn't run javascript. they also (optionally) block the loading of say 1x1 pixels in e-mails, or all loading of pictures from urls etc.

  • Browsers cannot help (Score:2, Insightful)

    by wardk ( 3037 )
    those too ignorant to leave URL's in emails ALONE

    the headline could have also just said "Paypal tells idiots to stop clicking on paypal emails"

    but that would potentially stop the 1 in 1000000 clicks that are legit and paypal would not want that transaction to not happen, so it's message to us is to stop using Safari.

    isn't anything going on worth reporting? this is filler...

  • They've had it too good for too long... (Score:5, Funny)

    by SterlingSylver ( 1122973 ) on Monday March 03, 2008 @07:53PM (#22629796)
    Well, if there's group of users that has been told repeatedly that their computer is safe from viruses, that it "just works," and that they don't need to be concerned with computer threats of any kind...it's Apple users. Sitting in their offices, wearing their turtlenecks and sipping their lattes, the only thing about phishing they've heard about is that it happens to other people. Uglier people. They're not used to having to defend themselves, not like Windows users. Windows users have a battle-scarred paranoia...they've seen worms that can rewrite their BIOS, steal their credit cards, and kidnap their firstborn. Their 50 yard stares have been earned by fixing their mom's computer for the eighth time this month, and damnit if they're going to lose another computer to some Ethiopian scammer...not after the last time. Their nightmares are the stuff of Steven King novels, the earlier stuff with lovecraftian clowns and superplagues that are the start of apocalyptic battles between good and evil. Their best days on the internet involve life and death struggles against the next pop-up, because it might be their last. Ironically, Mac users have never had to live with the terror that clicking on that "win a free iPod" might just cause their computer to explode, spamming their grandmother with anal tranny porn on its way out. Maybe it's time they should... ...wait, what the hell was I talking about?

    • Re: (Score:2, Funny)

      by sharkey ( 16670 )

      Windows users have a battle-scarred paranoia...they've seen worms that can rewrite their BIOS, steal their credit cards, and kidnap their firstborn.

      And the fuckers STILL just click every YES button that pops up.

  • Use IE? One problem... (Score:4, Insightful)

    by Myrkridian42 ( 840659 ) on Monday March 03, 2008 @08:03PM (#22629906)
    There is *NO* Internet Explorer for Mac!

    Microsoft stopped making (and supporting) IE for Mac in 2003. See for yourself [wikipedia.org].

  • ummm...doesn't paypal's parent company eBay advise users not to click on links in email? And that they should manually type in the address (www.ebay.com) then go about their business? (eBay's security tip about email [ebay.com])

  • Fish all you want... (Score:5, Informative)

    by cybereal ( 621599 ) on Monday March 03, 2008 @08:15PM (#22630026) Homepage
    I bought the $5 keyfob for paypal and ebay, (plus it works on my verisign openid provider) and this phishing problem is no longer an issue for me.

    They can get my paypal username and password, but they still need the electronic key that only *I* have. I suggest anyone who actually uses paypal get one of these, they are trivial to use and paypal is selling them incredibly cheaply.

  • EASILY fixed - never click on email links (Score:5, Informative)

    by grrrl ( 110084 ) on Monday March 03, 2008 @09:24PM (#22630630)
    I'm with those who think this is simply avoided by NEVER clicking on a link in an email.

    Paypal will NEVER require you to click on a link in an email. All ebay functions can be accessed from my.ebay.com. My bank specifically states 'we will never send you links in an email, ALWAYS type in our website address yourself'.

    Follow that advice and you have no problems. PERIOD.

    If you think the email is legit, log into the site you type in yourself and see if there is an alert. Or ring them yourself. (On a side note I once had a credit card company ring ME and refuse to say who they were until I confirmed who I was by giving my DOB. I rang them back on the proper number and went off at them.)

    Case closed yadda yadda.

    • Re: (Score:3, Informative)

      by josath ( 460165 )

      I once had a credit card company ring ME and refuse to say who they were until I confirmed who I was by giving my DOB. I rang them back on the proper number and went off at them.

      Happened to me once, with a Wells Fargo credit card. Except it wasn't a person, it was a computer! (ie, voice prompts). And it wanted me to enter not my DOB, but my SSN!! At first I was sure it was a scam, that there was no way my bank would do something so stupid. But after hanging up & calling them back directly, I found out i

  • Questionable Motives (Score:4, Insightful)

    by sofla ( 969715 ) on Monday March 03, 2008 @10:19PM (#22631032)
    I have my doubts about this whole story. I question Barrett's motives. For the simple reason that the only way to find out that Paypal doesn't like Safari is to read the InfoWorld article and his quote. If you login to Paypal using Safari... nothing. Not a peep. No mail in your inbox, either. Seems to me that if Paypal really felt strongly about Safari they'd do a little more than that. But they don't. All we have is Barrett's quote. Which makes me wonder he's really after. And to me, the most plausible thing, is that as an EV early adopter, he's evangelizing how great EV is. Or maybe he has MSFT stock. Dunno. At any rate, if the user isn't looking at the URL bar in the first place, I don't know what difference it would make if it was green or not.

    And don't even get me started on how effective I think the whole "keep a list of the bad guys" approach is.

  • Solution is simple (Score:4, Informative)

    by naasking ( 94116 ) <naasking@gmail. c o m> on Tuesday March 04, 2008 @12:02AM (#22631724) Homepage
    Just provide a Petname toolbar [mozdev.org]. All the anti-phishing you'll ever need, and it doesn't submit your URLs or browsing info to third-party servers, like the Google toolbar and Microsoft's "anti-phishing" extensions do (a technique which will ultimately prove ineffectual IMO).

Slashdot Top Deals

Save yourself! Reboot in 5 seconds!

Close