Apple gives identity thieves a way in

[wdlove]

Reading this article was a little scary to me. My first thought was, glad that I'm not currently running Tiger.

There seems to be a security problem with Dashboard. Steven Meyers called it cool. He was able to write a program/widget that Tiger would automatically install on the hard drive. What are your thoughts?

http://www.boston.com/business/personaltech/articles/2005/05/16/apple_gives_identity_thieves_a_way_in/

 

[emw]

You still have to run the widget, even after it's installed. This has been discussed at length in this thread.

I can see why people would be concerned, however.

 

[rainman::|:|]

i think you should have searched first, what are the odds something this significant isn't already being discussed.

 

[wdlove]

i think you should have searched first, what are the odds something this significant isn't already being discussed.

Sorry, just happened to get caught on this one. Very happy to read that Apple is on top of the auto download function and has the fix with 10.4.1. The article just gives another perspective. Hopefully Hiawatha Bray will update his story now that the fix exists.

 

[StarbucksSam]

Glad to hear that they fixed this in 10.4.1!

 

[Sedulous]

Maybe I am a screwball but before 10.4.1 I couldn't get widgets to run automatically. Was there something wrong with what I was doing? The only way I could get widgets to run was to put them into my Library... or is that the normal way?

 

[Fukui]

Maybe I am a screwball but before 10.4.1 I couldn't get widgets to run automatically. Was there something wrong with what I was doing? The only way I could get widgets to run was to put them into my Library... or is that the normal way?

They could NEVER run automatically, they were able to install automatically, which is almost as bad...

 

[Applespider]

Maybe I am a screwball but before 10.4.1 I couldn't get widgets to run automatically. Was there something wrong with what I was doing? The only way I could get widgets to run was to put them into my Library... or is that the normal way?

That's the normal way and as said above, you still had to drag them out.

The problem was that if you'd left Safari to automatically open 'safe' files, it could install a widget without telling you it had done so which mean the first the user would know was when they went to Dashboard and saw the shiny new widget icon (or shiny old icon since it could mimic an Apple widget).

If you'd turned off the 'automatic open' message, then chances are they were just downloading to your desktop for you to install yourself