A Little .Mac Security Flaw 328
deleuth writes "The de facto online connectivity software sold along with many Apple computers, .Mac, has a Web interface through which users can check their 'iDisk' while away from their own computer. However, there is no Log-Out button in this Web interface, so most users just close the browser and walk away... not realizing that their iDisk has been cached by the browser and that anyone who wants to can open up the browser, go back to the link in History, and get into their iDisk completely logged in. From here, files can be downloaded and/or deleted. This seems like a minor security flaw via bad interface design, and podcaster Klaatu (of thebadapples.info) posted this on the discussion.apple.com site, only to have his post removed by Apple. Furthermore, feedback at apple.com/feedback has gone unanswered. The problem remains: there is no way for the average computer user to log-out of their iDisk on public computers. A quick review of any public terminal's browser history could bring up all kinds of interesting things."
Clear private data (Score:3, Interesting)
Not having a log out button is bad design but many people forget to click them, you need a decent timeout to reduce the risk for those that don't log out.
Does this system keep you logged in (via cookies) if you close the browser and restart it? If so that's a very bad design.
another security aspect (Score:2, Interesting)
This sounds like a job that some sort of graphical SSH frontend could do better. (since OS X has ssh support built in)
That's interesting (Score:4, Interesting)
In real experience terms, this isn't going to be much of an issue until it's fixed, but does put a small stain on the portability of the service. Which is one of Apples main advertising points for it. Gotta remember though, Apple, like all other companies is filled with a lot of people. There are moderators on Apple forums, for all we know one of them removed it then notified management of the problem and it's working it's way up the command. It's not like Steve Jobs read it and said, "OMGWTFBBQ!?!?! PULL THAT NOW!".
Though, the extra publicity will help.
Re:Huh? (Score:2, Interesting)
Re:How many people actually use iDisk? (Score:4, Interesting)
Wait, what?? (Score:5, Interesting)
Re:When Will Apple Learn (Score:3, Interesting)
And Apple does more than just pick components to cram into a laptop. The MacBook Pro, for example, was designed from the ground up by Apple, and does feature custom designed internals - yes, obviously some components are standard (the CPU, GPU, etc.) but the motherboard, etc. is original.
If the MacBook Pro was just a bunch of off the shelf components, there would be a lot more 1" thick 5.4 pound laptops out there.
Re:No, incident does prove Apple is lacking ... (Score:3, Interesting)
This has been my experience as well. I've submitted several bugs. The first one was responded to by the next day and that was to ask for more information. It was followed up after a couple of days with a patch emailed to me. They asked me to test it to see if it fixed the issue - it did and was included in the next roll-up patch. The others received answers along the lines of "Thanks, someone else has already reported this, we are working on it, if you have any new information please reference xyz ticket." I even received a phone call once.
Apple has always been rather prickly when proper procedures aren't followed with bug reporting. A public forum is a good place to ask a question but is definitely *not* the place to submit a security-related report - they were well within their rights to remove it. Although I would have replaced the message with a "Post removed: submit security issues to product-security@apple.com" . My only complaint though, is that if you aren't already familiar with the reporting procedures it's not easy to find where to report bugs. Of course, a little googling or searching on Apple's site give you the answer, but the average noob won't do that. Of course they also don't know how to properly articulate the issue most of the time either.
Re:When Will Apple Learn (Score:3, Interesting)
Actual thing is http://bugreporter.apple.com/ [apple.com] , "New Problem" "Security" from drop down menu.
He seems as an advanced user/developer and yet uses the "Feedback" form. Than posts to public forums ignoring their policies punishing those non techie
Here is the complete open Mozilla project security issue reporting guideline
"IMPORTANT: Anyone who believes they have found a Mozilla-related security vulnerability can and should report it by sending email to the address (removed) @mozilla.org. For more information read the rest of this document."
It doesn't say "Post it using feedback form, if you don't get any response, use mozillazine forums to post it to public and when it is deleted, post it to slashdot"