MacDailyNews - Where Mac news comes first

Apple Online Store

5 Day Most Commented

Opinion Archive

Current Headlines

Latest Joy of Tech

  • Latest Joy of Tech!

MacNN

AppleInsider

Macworld UK

TUAW

MacRumors

Yahoo! Finance AAPL

iTunes Top 10 Albums

Mac OS X Downloads

Sat, Aug 30, 2008 - 08:14 AM EDT  —  AAPL: 169.53 (-4.21, -2.42%)  |  NASDAQ: 2367.52 (-44.12, -1.83%)

And they wanted to block Safari: PayPal’s EV SSL page and its vaunted green URL vulnerable to attack
Saturday, May 17, 2008 - 09:49 AM EDT

"A serious scripting error has been discovered on PayPal that could enable attackers to create convincing spoof pages that steal users' authentication credentials," Dan Goodin reports for The Register.

"The cross-site scripting bug is made all the more critical because it resides on a page that uses an extended validation secure sockets layer certificate. The new-fangled SSL mechanism is designed to give users a higher degree of confidence that the page they're visiting is secure by turning their browser address bar green," Goodin reports.

"But Finnish researcher Harry Sintonen figured out a way to inject his own code into a supposedly protected PayPal page even as the green bar lulled visitors into believing it hadn't been tampered with," Goodin reports.

"The discovery is one more reason to remain skeptical of extended validation SSL, which has always struck us as a solution in search of a problem. Yes, we know it's supposed to close a loophole that's long existed in SSL by certifying, in this case for example, that it is eBay (the parent company of PayPal) that owns the SSL certificate for the specific PayPal page. But we've not yet heard of a single attack involving a forged certificate, so we're tempted to think the measure is more gimmick designed to generate revenue for VeriSign and its competitors than anything else," Goodin reports.

"eBay security pros seem to have drunk the EV SSL Kool Aid, however, having announced recently that browsers that don't support the new standard [includes Apple's Safari for Mac and WIndows] aren't welcome on the PayPal site," Goodin reports.

Full article here.

MacDailyNews Take: Dumbasses.

Here's what we wrote a month ago, in part: "Should Apple add EV SSL to Safari? Maybe, maybe not; regardless it's really no substitute for users' common sense. What's next, anyway, XL SSL? XXL? SuperSized? Puleeze... PayPal is not your mommy, users need to be responsible for themselves, and EV certificates are a scam designed to extract more money from website operators under the guise of more security."

  • Social Web
  • E-mail






Always -- Free ground shipping with orders over $50 at the Apple Store.

Reader Feedback: ( = registered)

May 17, 08 - 10:10 am Comment from: Rob

Ha, ha, ha...

May 17, 08 - 10:21 am Comment from: K

Sounds like Safari should block PayPal rather than the other way around.

May 17, 08 - 10:24 am Comment from: Nek Derk

A more expensive certificate does not a secure website make.

May 17, 08 - 10:25 am Comment from: Beryllium

I block PayPal. I'll never use them again.

May 17, 08 - 11:08 am Comment from: Galen Rhodes

The EVSSL is a crock. It's nothing more than a scam that Microsoft and VeriSign (owned by Network Solutions) cooked up so that VeriSign can charge a boat-load more money for SSL certificates.

May 17, 08 - 11:49 am Comment from: DLMeyer

Be NICE, guys and gals ... they are trying to do the right thing(s). It didn't work out, but the motivation showed their heart was in the right place. Unlike MS, where the question is is their heart a) black or b) missing?

Sure, we can laugh at them, but ... is there really any way to be 100% sure your web interaction is safe and secure? I don't think so. You do your best and pray.

May 17, 08 - 12:00 pm Comment from: Bush Tucker Man

That'd be right. I'm blocking PayPal, which means sorry, bye bye ebay. Which is nothing more than a world wide garage sale anyway.

May 17, 08 - 12:02 pm Comment from: D

I am finnished wink with PayPal.

Let me say that in Finnish.

PayPal on loppu minulle.

May 17, 08 - 01:42 pm Comment from: Gabriel

Rather than chasing after a new revenue stream, why don't these folks concentrate on actually making SSL more secure, so this kind of thing can't happen?

The fact that PayPal seemed so convinced that EVil SSL was more secure than it really is, has me concerned about where exactly their focus is: securing users' data, or making more money for the folks behind EVil SSL?

May 17, 08 - 01:46 pm Comment from: Me In LA

@ DLMeyer:

Indeed. I want to be here when the Mac - yes, WHEN - gets an exploit that hoses people.
You think any OS/platform is perfect?
If you do, you better be prepared for the 9/11 that will someday hit your smartasses.

We've been lucky.
It won't last forever.
Will you be so smug then?

"Dumbasses" is right - MDN and some of it's visitors

May 17, 08 - 01:48 pm Comment from: Me In LA

@ DLMeyer:

To clarify, the previous post was only geared towards you in the first sentence - looking now, it looks like I'm saying the other things to YOU, which I'm not.

May 17, 08 - 01:51 pm Comment from: what to do

PayPal is not your mommy, users need to be responsible for themselves

Fair enough. So how do you know if you're being spoofed (by a good spoofer, that is)? Not all of us have/use packet sniffers. raspberry

Where there's money, there's crime. Perhaps high-value targets like PayPal should consider dedicated client software, versus browser access? (Nothing against Safari, this has to do with SSL)

May 17, 08 - 02:18 pm Comment from: Eric

I'm sorry... Only a FOOL uses PayPal! Period.

May 17, 08 - 03:05 pm Comment from: Me In LA

@ Eric: Only a fool says something so blatantly stupid.

I've used it for years, and it's SAVED me twice with two bad transactions.

Moron.

May 17, 08 - 04:16 pm Comment from: Angel A

PayPal never said they wanted to block Safari you silly silly fools. MDN Get your facts straight before you post any more bile.

At least think before you make any comments. The 20 minute page load times on this site should give you plenty of opportunity to do that.

MDN the Dvorak of the Mac newsites.

May 17, 08 - 04:47 pm Comment from: jarrettdailynews

Hey, after I use MacTheRipper, how exactly do I get my media into iTunes? iTunes seems to block the ability to save the stripped media in it's folder....

Thanks

May 17, 08 - 05:06 pm Comment from: Jim - TIV

Jarrett... I just drag the media file over the movie or music list in the play list that I want it in. Itunes then copies it into it's library.

May 17, 08 - 05:26 pm Comment from: shen

"Indeed. I want to be here when the Mac - yes, WHEN - gets an exploit that hoses people.
You think any OS/platform is perfect?
If you do, you better be prepared for the 9/11 that will someday hit your smartasses.

We've been lucky.
It won't last forever."

no, most of us do not think there is a perfectly safe platform, but adding extra hoops to make you less safe seems, i don't know, stupid.

no, the Mac platform has not been lucky. it is UNIX based and built to be good. no, it isn't perfect, but it is designed with security in mind and not as an after thought.

the fact that you seem to not see the difference between luck and forethought tells me that it is in fact you are likely the moron.

to clarify, piss-off dumb-ass.

May 17, 08 - 10:37 pm Comment from: fed up

Man does the feedback here suck on weekends. :(

Seriously, are there any adults here? I've been on playgrounds more cultured than this.

Yeesh.

May 17, 08 - 11:40 pm Comment from: ElderNorm

WOW, so much anger today. :-( Must be that June 9 is so far away. grin Well hang in there.

Another topic.:

Will Apple stock tank before or after the June 6 event.???

Put another way, After June 6, will Apple stock surge down or jump up???

Just a thought.

en

May 17, 08 - 11:44 pm Comment from: iDon't

PayPal SUCKS!!!

May 18, 08 - 04:50 am Comment from: Petey

LOL - EAT CROW PAYPAL!

How's it feel to to look like total fucking idiots all over the world!

Paypal is soooooooooo secure - NOT.

They should close paypal down and get Steve Jobs and Apple to create a truely secure site for inline payments - not some jumped up 16yr old who think he knows how to code.

May 18, 08 - 06:12 am Comment from: spyinthesky

It certainly comes to something when morons start to call other people morons after inventing supposed arguments that no one else has actually made until that moment.

May 18, 08 - 09:01 am Comment from: Max

Sorry guys, OS X is NOT Unix-based. That was the situation up to Tiger.

Mac OS X Leopard has been CERTIFIED UNIX. So it is *just* Unix, not Unix-based.
It is also the reason why it now grows even more in academic sector: you may develop in Mac OS X Leopard and compile in any other certified Unix platform and viceversa. Source that compile in one platform can then be compiled AND RUN without changes to the source code in any other Unix certified OS: in Leopard gone are the #ifdef #elif #else pre-processor statements in your code.

May 18, 08 - 10:37 am Comment from: cb

I use paypal - seems to work for me. I never buy anything on Safari - I always use Firefox.

Who cares - let Safari and Paypal block each other. Sip the Kool Aid - dont gulp.

May 18, 08 - 11:54 am Comment from: mike

Pay Pal su**s. They screw so many people. Mainly the sellers by freezing their accounts for no good reason. People out thousands of $$ for 180 days and no way to appeal.

May 18, 08 - 12:04 pm Comment from: fenman

Paypal did not block Safari and MDN has even published that fact. Get the headlines correct or you will become nothing more than another site that trolls for hits with inflammatory headlines.

Other than that, don't kick Paypal for trying to do the right thing and getting it wrong. Rather hammer those who aren't bothered in the first place.

May 18, 08 - 12:37 pm Comment from: gorgalor

@ Me in LA:

The faithful here at MDN likes to bash anyone that derides a mac product. It could be a Mac user that has a complaint, or an outsider. It makes no difference. It's the, "I didn't have any problems, so everything is perfect, so you must be an evil/bad/ne'er do well traitor" philosophy. So, where you are wrong is that:

- No mac user has a problem with security
- Only stupid people have security problems

The MDN sheep can't really think well enough for themselves to go peek out over the next hill and wonder what the future holds (unless it's a new iPhone). Their SWOT analysis only consists of looking at Strengths and Opportunities, not Weaknesses or Threats. They are content grazing in their little pasture, calling everyone, "Dumbasses" whenever any negative blurb gets around. They need to constantly justify, and justify, and justify the Strengths and Opportunities.

It just gets really old after awhile. I love my mac, but I can't stand the sheep.

May 18, 08 - 12:48 pm Comment from: Cubert

You mean PayPal didn't really need all my personal information in that email they sent me?

May 18, 08 - 03:37 pm Comment from: Mad Mac Maniac

Love Mac's, hate the "cult", PayPal disqusts me.

May 18, 08 - 10:40 pm Comment from: @gorgalor

It's not really their fault. There's only so many times you can be laughed at for having a Mac before you crack and start posting on MDN.

May 18, 08 - 11:44 pm Comment from: cb

Uncanny resemblance between MDN mac cultists and rush limbaugh fans.

Rarely can either think for themselves.

May 19, 08 - 01:33 am Comment from: gvgnumber1

Safari puts a lock symbol at the top right of the browser window, that was the kicker when I received an e-mail asking me to verify something and login it wasn't there. I agree with MDN that there is no substitute for common sense.

Now to use Paypal to pay for my pre-order of the Gun Metal Grey PS3 marking the MGS4 release.

Reader feedback page 1 of 1 pages:

Always -- Free ground shipping with orders over $50 at the Apple Store.

Add Your Feedback:

Register or Login

Name:

Email: (optional)

Emoticons | Allowed HTML Tags

Remember my personal information   Notify me of follow-up comments?

Please enter the "MDN Magic Word" you see in the image below: