A Little .Mac Security Flaw

deleuth writes "The de facto online connectivity software sold along with many Apple computers, .Mac, has a Web interface through which users can check their 'iDisk' while away from their own computer. However, there is no Log-Out button in this Web interface, so most users just close the browser and walk away... not realizing that their iDisk has been cached by the browser and that anyone who wants to can open up the browser, go back to the link in History, and get into their iDisk completely logged in. From here, files can be downloaded and/or deleted. This seems like a minor security flaw via bad interface design, and podcaster Klaatu (of thebadapples.info) posted this on the discussion.apple.com site, only to have his post removed by Apple. Furthermore, feedback at apple.com/feedback has gone unanswered. The problem remains: there is no way for the average computer user to log-out of their iDisk on public computers. A quick review of any public terminal's browser history could bring up all kinds of interesting things."

Re:Apple's response?

[mboverload]

> Am I the only one that notices that Apple's response to every problem is a swift "let's delete this topic and pretend the problem doesn't exist"? .. Seems like bad business practise to me.

0H N0ES U DIDNT APPLE IS TEH PERFECT

Security Through Obscurity

[ookabooka]

podcaster Klaatu (of thebadapples.info) posted this on the discussion.apple.com site, only to have his post removed by Apple.

Ah, well, see, so long as Apple makes sure no knows about this, it won't be a problem. Surly everyone on Slashdot sees the validity of this strategy. (God I love my sig)

In other news...

[Dieppe]

Slashdot editor kdawson and Slashdot submitter deleuth mysteriously disappear...

You are a heretic, sir!

[Quiet_Desperation]

Anyone can slip up.

Ah, but this is Slashdot, where corporations are composed of primordial evil and capitalism is the beefy fart of the Devil. Every slip up is cause for running to the hills to prepare revolutionary strikes, and then run to the other hills and plan counter-revolutionary terror, and we all run around like decapitated chickens shouting comforting mantras like "Information wants to be free!" and "It am teh suk!"

Re:A minor flaw? Tosh.

[Colin Smith]

Indeed; I'm somewhat amused that this is described as a "minor" security flaw in the summary and blamed on the user interface. If it was a Microsoft web site it would be described as a major flaw and the foaming at the mouth would begin.

Macs make up about 3% of the computer using population. This means all flaws are minor.

 

Re:In other news...

[ColdWetDog]

Slashdot editor kdawson and Slashdot submitter deleuth mysteriously disappear...

I don't know about M. deleuth, but if Apple's Reality Distortion Field(R) can make kdsawson disappear, I'm buying another Mac. Maybe two.

Re:A minor flaw? Tosh.

[kestasjk]

But that 3% is the most important group; the 3% containing Einstein and Picasso and Vivaldi, Mac evangelists one and all.

Basically if you see Einstein, Picasso, or Vivaldi, or even Gauss or Heisenberg, using a public computer then Apple will treat this vulnerability as serious.
Last I checked scientists, power-managers and artists don't use computers other than their own, so why should Apple care about this "vulnerability"?

Re:A minor flaw? Tosh.

[vtcodger]

***It's not just the title, but to the article summary as well. And this is slashdot, when was the last professional Microsoft article here? 1993?***

I dunno. When was the last time Microsoft did anything professional?

I agree that Microsoft would get a lot of abuse in this venue even when they did things well/right. But if you ask me, Microsoft doing things well/right hasn't been much of an issue for quite some years.

Re:In other news...

[Pop69]

I'd buy a truckload if they could make Zonk go as well !

Re:A minor flaw? Tosh.

[stuboogie]

"What's the point? It's the equivalent of when people had CompuServe in the early-to-mid 90s. They'd pay through the nose to use a proprietary web browser and get access to groups that only other CIS users could use. It's the internet for people that don't know what's out there for nowt, a gated net community."

hmmm...sounds familiar...what was the name of that?

Ah, Oh weLl.

I can't remember right now.

Re:A minor flaw? Tosh.

[Dephex Twin]

Do I ask myself questions and then immediately answer them? Yes.