Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

tom vilsack

macrumors 68000
Original poster
Nov 20, 2010
1,880
63
ladner cdn
Was wondering if it's safe to Bank online using a ppc with leopard 10.5.8 (all updates) and using stock safari browser?

Would only use safari for banking and no other web browsing and computer would also just be used for this purpose.

Any suggestion's? (perhaps remove flash ect)
 
Was wondering if it's safe to Bank online using a ppc with leopard 10.5.8 (all updates) and using stock safari browser?

Would only use safari for banking and no other web browsing and computer would also just be used for this purpose.

Any suggestion's? (perhaps remove flash ect)

Just out of curiosity--is there any particular reason you'd be sticking with stock Safari rather than Webkit or TFF?
 
I'll be interested in how people respond to this thread. I do some banking online using PowerPC occasionally myself and have wondered if there is any real danger in doing so.
 
I can't say for sure, but I would imagine that TFF which is reputed to being kept up to date would be a better choice.
Please someone correct me if my supposition is incorrect.
 
I would feel safe(and do feel safe) using TFF for online banking and any other "secure" stuff.

I use Webkit for general browsing. It's more up to date than stock Safari, but I still don't feel safe using it for secure stuff.

So-the short answer-use TFF if you must.

In all honesty, most of the time for online banking, Paypal, and the like I use an Intel laptop running 10.9 or(grudgingly) 10.10, or even my iPhone. I feel perfectly safe in TFF, but can never remember my bank password :) and I can't get TFF to store it.
 
I use both Safari and T4Fx.

It's not that I don't care about security, but I bank with the same very specific websites monthly and while I won't pretend that I'm smart enough to spot a scam site when I see one, I very rarely make purchases directly outside my own personal orbit.

The fact that all of my Macs (with some exceptions) happen to be on Leopard is circumstantial.

It's never overly concerned me.
 
It still has some flaws, but not as nearly as bad as that in its PowerPC counterparts.

Intell,

What do you suggest as the most secure browser in general?

I've been using Firefox almost exclusively for at least ten years-back when I was still a Windows user. When I transitioned to Macs, I continued using it, although obviously on PPC Macs I now use Webkit or TFF. All of my Intel Macs are running the most current version of Firefox.
 
They all have weaknesses. It's much too difficult to simply state which is the most secure when none of them ultimately insecure to begin with. But if I had to choose one, it would be one that is extremely simple where all it does is basic HTML rendering and nothing else. Such browsers are no longer functional on the modern internet, but that is the price one would pay to have the most secure browser.
 
They all have weaknesses. It's much too difficult to simply state which is the most secure when none of them ultimately insecure to begin with. But if I had to choose one, it would be one that is extremely simple where all it does is basic HTML rendering and nothing else. Such browsers are no longer functional on the modern internet, but that is the price one would pay to have the most secure browser.

The encryption standards used by such browsers are also severely outdated.
 
Just out of curiosity--is there any particular reason you'd be sticking with stock Safari rather than Webkit or TFF?

Just was wondering about a clean install with no third party software.

With both TFF and Webkit,how are we to know that some rouge key tracing code isn't written in? How can we be assured of the security of either of these browsers? In the Intel world people can rest assured that major companies like Firefox and Google are securing there browsers. What assurance do we really get with TFF and Webkit? (another reason i asked about using just stock safari)

Right now I bank online using a window's laptop and legit windows 7. Was thinking if I could use one of my PowerBook G4's to online bank,I could rid myself completely of my last pc.

ps: I guess I could always run a ppc version of linux on one of my pb.
 
Safari on Leopard by itself is still safe enough for online banking. Just don't install 3rd party software/plugins/extensions which may hijack your data.
 
Right now I bank online using a window's laptop and legit windows 7. Was thinking if I could use one of my PowerBook G4's to online bank,I could rid myself completely of my last pc.

I feel like PPC machines are pretty secure for web browsing due to the fact that modern malware and viruses are incompatible with the architecture, but I could be totally wrong.
 
  • Like
Reactions: Project Alice
Just was wondering about a clean install with no third party software.

With both TFF and Webkit,how are we to know that some rouge key tracing code isn't written in? How can we be assured of the security of either of these browsers? In the Intel world people can rest assured that major companies like Firefox and Google are securing there browsers. What assurance do we really get with TFF and Webkit? (another reason i asked about using just stock safari)

Right now I bank online using a window's laptop and legit windows 7. Was thinking if I could use one of my PowerBook G4's to online bank,I could rid myself completely of my last pc.

ps: I guess I could always run a ppc version of linux on one of my pb.

TFF would include the same security patches that its equivalent Firefox version does. As far as browser security, that might be your best bet on a PPC aside from Lynx, which is probably much more secure than any full featured browser despite having some insecure code in it.

However, there are still problems. Leopard doesn't have a very good version of ASLR as it was Apple's first real attempt. Not all memory addresses are randomized. Some libraries, such as the loader will still load at a fixed address. Also, due to prebinding, libraries are randomized once upon prebinding and that's it until the library is upgraded, allowing an attacker time to guess where in RAM it is loaded. ASLR is still much better than no ASLR, so Leopard is more secure in that sense than any OS X before it, but its design in Leopard means a buffer overflow is much more exploitable on than on more modern OS X versions or other operating systems.

Then you have the problem of many unpatched vulnerabilities from years of abandonment by Apple. Using a 3rd party browser like TFF at least gets you updates to your browser, but Safari would be full of holes. If you're going to bank using OS X, I would make a separate, unprivileged user just for that purpose and prevent that user from seeing any other directory than his own. This doesn't stop you from being exploited; it just helps contain the damage should it happen (and may not even do that depending on the attack).
 
With both TFF and Webkit,how are we to know that some rouge key tracing code isn't written in? How can we be assured of the security of either of these browsers? In the Intel world people can rest assured that major companies like Firefox and Google are securing there browsers. What assurance do we really get with TFF and Webkit? (another reason i asked about using just stock safari)

TenFourFox and Leopard WebKit are some what opensource. They are both based off of open source code and have published changesets. One of the key natures of open source code is that developers all audit each others code and fix problems where they arise. This isn't always the case, rarely a large flaw will be missed for months or years at a time, most notably the heartbleed flaw in OpenSSL.
 
Just was wondering about a clean install with no third party software.

With both TFF and Webkit,how are we to know that some rouge key tracing code isn't written in? How can we be assured of the security of either of these browsers? In the Intel world people can rest assured that major companies like Firefox and Google are securing there browsers. What assurance do we really get with TFF and Webkit? (another reason i asked about using just stock safari)

Right now I bank online using a window's laptop and legit windows 7. Was thinking if I could use one of my PowerBook G4's to online bank,I could rid myself completely of my last pc.

ps: I guess I could always run a ppc version of linux on one of my pb.
It is a fallacy to think you are safe using what you use now.

No one is ever truly safe. There is no 100% secure browser.

Is what you use more secure than PowerPC ad Safari or TenFourFox. Yes. But, 100% foolproof? No.

People get wrapped around an axle on this. I get it. It's your money and you don't want to be robbed. But the best you can do is take measured precautions.

If the lack of security on the PowerPC platform is that much of a concern, then stick with what you have. TenFourFox is a good browser security wise, but the OS it runs on will never receive another security update and T4Fx itself is just as vulnerable as Mozilla Firefox because it uses much of the same code.
 
I feel like PPC machines are pretty secure for web browsing due to the fact that modern malware and viruses are incompatible with the architecture, but I could be totally wrong.
It's been shown by Cameron Kaiser, the creator of TenFourFox, that malicious code can be run through the browser on PowerPC Macs.

The proof that he showed was for malicious code written in Java, which T4Fx and every other browser can run. The payload of that particular malicious code was written for Intel Macs however so would not run on PowerPC. But the actual delivery did execute on PowerPC because it was written in Java.

So, the danger is indeed there. But you are correct in that a big part of our security is our dwindling market share.
 
I would personally say that your Windows 7 computer is a better and safer Internet citizen in general than your old PowerPC Mac, still running 10.4 or 10.8.

The danger with old, unpatched systems is rarely in somebody hacking in and getting your data. The danger is with somebody hacking in and using your resources for their particular nefarious purposes, which usually involve sending spam or phishing message. These days, there are automated tools that can break into Linux and BSD systems. Given that Mac OS X is "just" a BSD system with a special display layer and windowing manager, it's not too crazy to believe that a Mac could be susceptible to these kinds of tools.

In addition, not only is it possible to execute malicious code on a Mac through Java or Flash (which you should try to avoid on Windows and on modern Macs as well) but it's possible to get malware onto a Mac by having a program just literally ask for permission. Most of this malware targets pretty new versions of Mac OS X, but there's no reason it couldn't target 10.6, 10.5, or 10.4. (This isn't just a "PowerPC" issue -- 10.5, 10.6, and 10.7 on Intel-based Macs are also insecure at this point.)

And, none of that talks to what everybody else in this thread did, which is that the built-in, "period" browsers for Mac OS X 10.4 and 10.5 on PowerPC are woefully deficient by today's encryption standards, so if you're say, using a PowerBook in your local Starbucks (which is probably possible, Apple has built good batteries for a really long time) it's possible that somebody will sniff your wifi traffic and capture the login sequence with your financial institution (or your school or work or whatever.)

There's stuff you can do even on old PPC Macs to mitigate part of that risk a little bit (such as using a VPN service or tunneling all of your web traffic over an SSH connection to your home system) but at that point you'd almost be doing as well to just run Firefox on X11 over SSH instead of running anything on your local Mac at all.

Other things to consider, just as general notes: Mac OS X has had IPv6 included and enabled by default for a really long time, and by default (to this day) the firewall is not enabled for IPv4 or IPv6 by default, so that will be a thing you'd want to look at.

For web browsing, using TenFourFox will help with the encryption cipher thing, but if your system's compromised somehow, all bets are off, and for as often as new vulnerabilities that affect Linux and UNIX these days show up, it's probably just best not to connect a PPC Mac running OS X to the Internet at all.

If you only want to have PPC Mac hardware, and your mail goal is to be able to securely use the Internet, your best bet is to put something like a current Linux or BSD on it. There's malware for those systems, but since they're still actively being patched, that problem is likely to be fixed sooner rather than later. (or, you know, "at all.")
 
banks usually don't try to infect clients with viruses. I'm guessing very few does that. :p:p Porn sites and other shady sites? sure, I'd think so, but banks?

You should be ok. Also here in Sweden we have signature codes which are generated by a tiny external device.(like a calculator) So you can't do anything banking wise without that generator. My wells fargo US account isn't like that though... safety depends on the country/bank.

I personally don't care what device I use...
 
You should be ok. Also here in Sweden we have signature codes which are generated by a tiny external device.(like a calculator) So you can't do anything banking wise without that generator. My wells fargo US account isn't like that though... safety depends on the country/bank.

I had one of those for Paypal for a while. If I remember correctly, I had to push a button on it every time I logged onto Paypal and enter the 4 digit number it generated. The numbers had a finite lifetime-I think about 30 seconds-as their random number generator was synced with the one Paypal had for my account. I know that the first time I set it up, I had to enter about 5 separate codes in series to get everything synced correctly.

Mine was on my keychain, and unfortunately met an untimely death when my keys went through the washing machine. For a while after that, I had to enter my mother's maiden name and the last four digits of my SSN every time I logged in, although I finally managed to get it turned off. I'm not sure if Paypal even offers them anymore.
 
I had one of those for Paypal for a while. If I remember correctly, I had to push a button on it every time I logged onto Paypal and enter the 4 digit number it generated. The numbers had a finite lifetime-I think about 30 seconds-as their random number generator was synced with the one Paypal had for my account. I know that the first time I set it up, I had to enter about 5 separate codes in series to get everything synced correctly.

Mine was on my keychain, and unfortunately met an untimely death when my keys went through the washing machine. For a while after that, I had to enter my mother's maiden name and the last four digits of my SSN every time I logged in, although I finally managed to get it turned off. I'm not sure if Paypal even offers them anymore.
Wow. Something I've never heard of.

I linked Paypal to my bank account some time in early 2002-2003. I've never had to do anything as you've described. That's nuts!
 
Wow. Something I've never heard of.

I linked Paypal to my bank account some time in early 2002-2003. I've never had to do anything as you've described. That's nuts!

it's a hassle.... but rather safe! :cool:

bankdosor.jpg
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.