I'm not sure who these guys are over at ZDNet, but I think Mr. Dignan needs to take a couple of courses in internet security. In a recent article over at ZDNet, they are proposing that Apple should "call PayPal's bluff" and ignore a warning by PayPal to not allow the Safari browser to access PayPal's site.
Apple should call PayPal’s bluff | Zero Day | ZDNet.com:
"But is Apple really going to be pressured this way? Highly unlikely. PayPal seems to be hung-up on EV SSL certificates, but couldn’t Apple meet anti-phishing requirements another way? Why wouldn’t Apple just create lists of offending sites or warn users if a page is sketchy? Does Apple really have to buy into EV SSL?"
(Weblog of a "Switcher" added the bold emphasis)
I'm afraid I just can't let this article go by without some, admittedly just as inexperienced, insight into why the author really needs to take some courses in internet security. Let's take a look at their article, shall we?
According to Ryan Naraine, PayPal is about to launch a whitepaper that advocates blocking transactions from browsers that don’t have anti-phishing protection. This whitepaper is a thinly veiled attempt to get Apple to add EV SSL certificates to Safari.
First off, good for PayPal! PayPal is the most widely used payment method on the internet. Just about every small business allows PayPal transactions to pay for items. With all the PayPal Phishing attempts that I get sent to me via email, it's clear that PayPal is a favorite target of Phishers and they need to do something about it.
I'm not sure I understand Mr. Dignan's animosity of EV SSL. From what I read, it's clearly a stronger form of protection and security when communicating with a site that needs a secure connection. Would you want your Bank Account information being sent over the "tubes" without some level of protection? It just makes sense to me that putting a strong secure layer over any data being sent between PayPal and it's users is a good idea.
So what are the motives here? PayPal–a huge phishing target–obviously wants more protection. It obviously wants EV SSLs, but Apple won’t budge. The solution: Go public.
I seem to remember another such incident when Steve Jobs was getting all kinds of heat over having DRM in all it's iTunes tracks. So he "went public" and stated that he didn't want DRM in the tracks sold, but instead wanted all music sold on iTunes to be DRM free. The result of that letter (however thinly veiled it may have been) was that EMI records allowed their catalog to be sold without DRM. Next thing you know other record companies were allowing non-DRM's music to be sold at other online music stores.
So, yes, it's clear that "going public" has the ability to "get the job done". If, by publishing a White Paper detailing how PayPal plans to protect it's customers, will set a fire under Steve Jobs and Apple's butts and get them to add decent anti-phising code into Safari, I say go for it!
Why wouldn’t Apple just create lists of offending sites or warn users if a page is sketchy?
This is the part of the above first quote I bolded. I did so because of the pure idiocy of the statement. Why would Apple spend precious resources investigating all the millions if not billions of websites out there to make sure that they are valid sites and not phishing sites? Maybe Mr. Dignan is volunteering for the job?
There are several other browsers out there that are either making strong strides to become more secure or have actually already implemented such measures. Internet Explorer 7, Firefox 3.0 (currently in beta nearing it's release candidate cycle and will probably be out by end of 3rd quarter) and Opera 9.5 all have both implemented EV SSL. So what's holding up Apple?
Meanwhile, it’s unclear whether PayPal would actually follow through on a Safari ban. PayPal isn’t going to annoy Apple users. And it isn’t going to turn off transactions on the iPhone either. In this stand-off I’d say the advantage is all Apple.
Wow, Mr. Dignan seems to really think he has a good handle on what Apple is thinking and doing. First off, PayPal won't be losing all that much if they "annoy" Apple users. Apple currently has about an 8% market share of computers out there in the world. So, what does this mean if PayPal stops allowing Safari to create transactions on their service? They loose 8% of their business?
Nope, not really. Not every Mac user uses Safari as their browser. Sure it's the default browser on a Mac, but a lot of people switch from Windows to Macintosh. They are going to use a browser they are more familiar with. If they came from Windows and have any sense at all (which they must if they switched in the first place), they will probably be using either Firefox or Opera on Windows. So it's pretty easy to download the Macintosh equivalent and use it in OS X. So of that 8% market share, probably 50% are using Safari and that is being pretty generous. So PayPal isn't going to loose that much business by forcing a PayPal customer to use a different browser when using their service.
As far as the iPhone goes, the above statements hold ground here too. Apple just doesn't have a big enough market share compared to all the current smart phone usage. Sure, they are gaining market share, but until iPhone 2.0 ships and Enterprise users start buying the phone, the iPhone will still be just another smart phone in the vast sea of smart phones.
So I would have to say that, although Mr. Dignan is more than entitled to his opinion, he really should be "looking out for his readers" when he posts an article like this instead of allowing them to be the victim of a phishing attack.
written by Dave M.
\\ tags: anti-phishing, Apple, paypal, Safari