Amazon.com Widgets
OS X Help Logo
Insanely simple tutorials for the first time Macintosh user
✭ Stay up to date... Don't forget to subscribe to our email newsletter in the Email Updates form. ✭
OS X 10.6 Snow Leopard ✭ The best $24.99 you will spend on your Mac!

Mastering Safari, understanding security

Written by: hexley on Tuesday February 26th 2008, 2:00 am

Filed under: Applications, OS X 10.4, OS X 10.5, Safari

Safari Box ImageWeb browsing can be a semi-hostile environment. I am sure most of you have heard at least one story where someone you know has been the victim of some online scam. In general, there are two core parts to online security.

First is whether the site you are connecting to is trustworthy. This can often be difficult to determine. Second is the data your browser collects as you browse the web. Safari has built in tools to help you keep your experience as safe as possible. With a little foresight and education, you can protect yourself from being taken advantage of.

Secure websites, SSL certificates, and the little lock
If you are performing any transaction online, where the data you are sending in is important to you, the website should be secure. I draw the line at bank data, credit card data, and social security numbers. If I am being asked that data, I insist the site is secure.

The simplest way to tell if a website is secured, is to look in the upper right corner of the browser, if you see a padlock, it is secure.

Screenshot of Safari Padlock

You can also look at the URL and see if it starts with “https“. Either of these identifiers, in most cases, will let you know the site is secure.

What does secure mean?
If you see the padlock icon, or the URL starts with “https”, the data you are transmitting can be considered encrypted. You can click on the padlock, and a sheet will pop down, showing you even more detailed data about the security of the site.

In all of my purchases on the web, I am yet to find a site claiming to be secure that is not. Spoofing, or tricking Safari into showing the padlock on a non-secure site is also a non-trivial task. Not to say there cannot be problems with the security, but you should be rather safe in knowing your data is being transmitted from your browser, to the remote website in a secure and encrypted method.

Security alerts
From time to time, you will visit a site that pops up a security alert in Safari. As you can see in the image below, this very alert pops up with an Amazon site.

Screenshot of Safari SSL Alert

What is important to know immediately, this does not mean the site I am about to visit lacks security. I will still be transmitting encrypted data. It simply means there is a problem in some way with the certificate that generates the encryption.

Two things can and will go wrong here.

In order to have a secure site, the website owner must purchase an SSL (Secure Socket Layer) certificate. Many companies sell these, but not all are known by Safari. These certificates come from what is called a CA, or Certificate Authority. In the case of the above example, if you click on “Show Certificate”, you can verify this.

Screenshot of Safari SSL Alert Expanded

As you can see, Safari tells me in red “The certificate was signed by an unknown authority”. In this case, I know to trust this site, so I can click continue. If I plan on coming back often, I can click off the checkbox to “Always trust” this site.

At other times, you will run into the same error, but Safari will tell you the certificate has expired. SSL certificates are valid for one year and onward. Sometimes they expire and the site webmaster has not had time to renew.

In either case, it is important to know, the data will be secure and encrypted, it is up to you to judge whether or not the site really is who they say they are.

Not all cases are safe
Seeing a padlock only means data is sent securely, it does not guarantee the site is who it says it is. In the image examples above, if the web address in the URL bar of Safari does not match that on the certificate, you know something is fishy.

A scammer will go to great lengths to make a website look like the real site you last remembered. They will even use URL’s such as e-b-a-y.com to try and confuse you. If you have any suspicions, ask someone before you proceed.

Personal security
Your computing environment will dictate how rigorous you need be with securing Safari.

Every page you visit in Safari is remembered for some period of time. You know this as your history. Small bits of data are stored in what are called cookies. Your entire past web browsing habits are being recorded by your browser, be it Safari, FireFox, or Internet Explorer.

Maybe you have a secret crush on Bill Gates. You of course want to keep this a secret. However, anyone who shares your computer with you could simply look in your history and trace the sites you visited. Possibly worse, you may have left yourself logged into your bank. This leaves you vulnerable to someone making changes to your bank account.

Safari has a very handy feature called “Private Browsing”. Everything from history, cookies, auto-fill entries, downloaded items, and even searches, are cleared from Safari as soon as you close the window, or quit Safari.

You enable this feature in the Safari menu, by selecting “Private Browsing”.

Screenshot of Safari Private Browsing Menu Item

A window will pop up that explains in detail, just what this feature is doing.

Screenshot of Safari Private Browsing Warning Box

This does not mean you should enable this feature all the time. I personally use it when I am at a friend’s house, borrowing their computer. Or perhaps on a laptop when in travels. I generally trust the people I live with, and feel it is not needed at all times.

Private browsing is a feature of tradeoffs. Turning it on will certainly slow down Safari by a small degree. I only notice this slowdown on older computers. It definitely will inconvenience you, as Safari will have a very short-term memory about what you have been doing.

Consider Private Browsing a feature to use in cases where you personally feel it is warranted. I would not consider turning it on at all times unless you have a very specific reason to.

The web has all sorts of nasty back alleys. About the best advice I can give, is if you are at all suspicious, stop what you are doing, and ask around. You can come back here, ask in the comments, ask a more experienced friend, or do some online research. I assure you, nothing you are trying to do online, or purchase online, is worth the trouble of fixing a stolen identity.

Want to be reminded when there are new posts?
Get post updates in your email or subscribe via RSS.
23 Comments so farLeave a comment

If I had private browsing on and have forgotten a login and password, is there any possible way to dig that back out of my computer or is it gone forever?

Comment by Nathan 02.28.08 @ 9:35 am

Is “Private Browsing” to be used basically any time you are doing a bank card payment or checking on your bank or investment accounts? Can you think of any other times it would be appropriate? Thank you for all these helpful tips.

Comment by Julius Hjulian 02.28.08 @ 2:32 pm

@Nathan, if private browsing was on, you indeed will not have access to your password. Even were it not, you still may not be able to get to it.

Every site I am aware of, allows you to get your password, either by email, or by answering a set of questions. If you want to reply back here with the web address (URL) of the site, I can certainly see what I can do to help you out.

Comment by Scott Haneda 02.28.08 @ 7:09 pm

@Julius, I do not use private browsing even when on my banking site. Banking sites tend to be rather protective, and will even auto log you out after a certain period of browser inactivity.

That being said, I have never seen one harmed by being overly cautious on the web.

Private browsing is more an issue of personal security. It will not help you keep your data secure from someone remotely hacking your bank site, or anyone doing anything remote.

Private browsing will prevent those with physical access to your computer, from being able to snoop around and find where and what you have been up to.

Comment by Scott Haneda 02.28.08 @ 7:12 pm

Private Browsing is for erasing your trails and covering your tracks. This is primarily used for making you feel more secure about what browsing remnants are left on your system.
Also, very handy if you have multiple users on the machine (using the same log-in).
Not a feature I use personally as you have to reenter your user ID and passwords on all your sites every time you log in again.

Comment by Nex 03.05.08 @ 7:09 am

I use it so that people dont know that I watch Flavor of Love!

Comment by Boston 03.31.08 @ 8:54 pm

@Boston, shame on you, then again, I guess I am one to talk with looking forward to this Paris Hilton BFF show :-)

Comment by Scott Haneda 04.01.08 @ 2:10 pm

Why is Google cookie get thru when Safari:Security is set ot “Never” ??

Comment by Hmmdude 11.29.08 @ 3:55 pm

@Hmmdude, what are you trying to accomplish my forcing cookies to not be allowed? I would estimate you can not login to almost all websites out there. I am curious what risks you will be mitigating by the turning off of accepting cookies.

I suspect, in your case, you will need to quit and restart safari, for the changes to take full effect of sites you have already navigated to.

Comment by Scott Haneda 11.29.08 @ 4:09 pm

Thanks for the quick response.

Restart didn’t work. Other ideas please.

Comment by Hmmdude 11.29.08 @ 5:50 pm

Can u use private browsing when your on ebay paying for something on paypal?

Comment by Misato 12.06.08 @ 12:24 pm

@Misato, yes, while in private browsing, Safari will work as a normal non private session. Everything will be the same, it will save cookies, allow you to login to sites, and in your case, even allow you to use paypal.

In essence, there is no difference with private browsing, as normal browsing. The only change happens when you disable private browsing. At that point, Safari will delete whatever data it has collected about you during your private browsing.

Comment by Scott Haneda 12.06.08 @ 2:41 pm

I am an IT Manager at a primary school, one of my colleagues was suspected to have been on inappropriate sites, etc, at home on their school MacBook, they have (from what I can see) done a “Erase Free Space” and cleared all their cache and reset safari (as they knew we were onto them) – is there any way I can retrieve the data, or any program I can get to examine their hard drive?

Thanks

Comment by Evan 09.09.09 @ 2:57 am

@Evan If the user deleted the data, and then erased the free space, the chances of getting that data that was erased are slim.

I would suggest that all use of this computer be stopped. The only chances you have of recovering any data will be dependent on no new data having the chance of sitting on top of the spots in which the old data was located at.

You will need to either connect the machine in FireWire target mode, so you can access the drive as a remove volume, or pull the drive out and put it in another machine in the event it does not have firewire.

Were backups made? Perhaps you can look at that backup data?

From there, you would look into the preference and cache files area for all browsers you suspect were used. You may find cookie files, favicon files, or other data that is often overlooked when clearing a cache.

More than likely, the favicon files, and possibly even the top sites previews if a new version of Safari, still exist. While a favicon is very small in size, you can compare its md5 to that of the suspected sites, and be confident that site was visited.

If you would like, you can email me directly, and I can possibly work out a way in which to help you. At this point, the best suggestion I can make it to turn off the machine, and not turn it on for any reason until you have a plan for accessing the data remotely.

Comment by Scott Haneda 09.09.09 @ 2:36 pm

any way to require a password to be entered when enabling PB?

Comment by Troy 09.23.09 @ 9:24 am

@Troy, what is PB? Popup Blocker? No, there is no way to require a password when enabling it. What is your line of thinking here, why would you want to require a password to enable a feature that is more or less mandatory to use the web these days?

Comment by Scott Haneda 09.23.09 @ 12:10 pm

No, I was referring to Private Browsing (PB). I want to create a situation where if you click on PB, it will ask you for a password BEFORE enabling it.

Info: Running OX X 10.6.1.

Comment by Troy 09.23.09 @ 4:04 pm

@troy, I am not aware of any way to set a password for Private Browsing.

Comment by Scott Haneda 09.23.09 @ 5:03 pm

I am considering giving my laptop to a family member, and I know about the empty securely feature in the trash bin, and I am also aware of erasing any free space on the hard drive through disk utility. While I am not doing anything illegal, I like having piece of mind when my financial investments and medical history is at stake. I would like to do a seven pass erase on my browser history before giving it to my relative. Is there an easy way of doing this?

Also as a side note, when i remove cookies, it seems like even when I do not go back to those sites, they may appear again, am I just being forgetful, or are they reappearing after I have removed them?

Comment by William 01.15.10 @ 4:09 pm

William,
I would probably approach this different. The 7 pass erase is really not needed. I can not find the link at this time, but there has been a long running contest where a drive was given a few text files, then simply reformatted. The idea is, you win a prize if you can recover the files. To date, and it has been years, no one has.

Erase free space will be more than enough, in my strong opinion, to keep you safe.

However, what you are not considering, is all the places you have data and preferences that you may not be aware of.

There are two ways to pass a computer off to someone, in order of quality:

1) Use the original DVD that came with the computer, reformat the drive, and install the OS clean and new.

2) Create a new account, as an admin account, login to that account, and delete your old account. This will delete all the files that you had no matter where they are hidden. From there, you can do the erase free space if you feel you need to, though the reality is, it probably is not that needed. Certainly is not going to hurt, other than you time to wait on it to finish erasing.

For the cookies, it could be that you have some bookmarks that are RSS driven, those poll the site very 15 minutes or so, depending on your RSS preferences. When that happens, a number of cookies will generally be set.

Comment by Scott Haneda 01.15.10 @ 4:21 pm

Thank you for the speed at which you answered. Your response was very helpful. I will take one of those routes, and I will sleep soundly knowing my nephew who wants to work in programming isn’t getting his hands where they shouldn’t be.

Comment by William 01.15.10 @ 4:26 pm

Hi there, I have had tradesmen working in the house for the last few days. My computer has been left out when I go to work, not turned off but closed down and in its case. So if someone opens it it will turn straight on and not need a password to open up. I got home last night and the computer lead had been unplugged at the wall, and the case was closed differently to how i left it. I went to the browser history and it had been cleared. Now because I had tradesmen in the house during the day, I had left my computer on private Browsing, because I had been doing confidential financial work at home in the evenings these last few days. Here’s my query – am I being paranoid that someone has been using y computer? Is it possible for Safari to clear the browserhistroy itself if it is left in private Mode for a few days? I suspect that someone has taken it out, used it for purposes that they shouldn’t, and cleared the browser histroy to cover that up.. Whereas all they have done is shown that someone has gone into my computer? Also they have deleted my browser history which I like to refer to from time to time. Would value your opinion on this

many thanks

Paul

Comment by Paul Julian 08.27.10 @ 3:05 am

@Paul, Yes, Safari can and will clear a browser history, but not all of it. It is set to expire history items after a certain date. So perhaps expire after 1 week, but that only shaves off the items that are older than one week, leaving all the most recent ones for you.

The nice thing is, just clearing the history does not always clear everything. Though being in private browsing mode may make this behave different.

There is a cookies file, favicon file, top sites, page preview, cache, and local database storage, that will all hold traces of where the browser has been. These generally do not get cleared unless you hit the “Reset Safari” menu item.

My gut says, that if the computer was in a different position, that could have happened by nature of people working in your home, nothing too out of the ordinary there. However, the history clearing is very suspect.

Then again, keep in mind, there are conditions in which the history can possibly clear itself in full, it just depends on how much time has gone by and how much of that time the browser was not in use.

Through some investigation you could find the files and see where the browser has been, just depends how much time you want to invest in this. I may be inclined to set up Safari so it is in a slightly off screen position so if someone were to use it, they would move the window to be on screen. I doubt they would remember to put it back.

Do you happen to have Time Machine backups? If you do, there is a chance that the files that were cleared were backed up before they were cleared, and you could restore them, seeing where the browser has been.

Comment by hexley 08.29.10 @ 9:20 pm



Leave a comment:
Line and paragraph breaks automatic, e-mail address never displayed, HTML allowed. Name (required)
E-mail (required), never ever shared
URI
Your Comment:

The New MacBook
The New MacBook Air
New iPod shuffle in five brilliant colors!

Email Updates

RSS Feed

Search:

Categories

Applications (17)
Finder (17)
Hardware (4)
iTunes (1)
Little Smokies (7)
Misc (11)
OS X 10.4 (9)
OS X 10.5 (31)
OS X 10.6 (1)
Safari (11)

Archives

Contact

Friends