Google finds security flaws in Apple's web browser: FT

[steven36]

(Reuters) - Google researchers have found multiple security flaws in Apple Inc’s Safari web browser that allowed the tracking of users’ browsing behavior, Financial Times reported on Wednesday, citing a soon-to-be published paper.

 

 

 

The vulnerabilities were found in a tool specifically designed to protect privacy and could have allowed third parties to obtain “sensitive” information about the browsing habits of users, the report added.

 

Google disclosed the flaws to Apple last August, according to the report.

 

 

Apple and Alphabet Inc’s Google did not immediately respond to Reuters’ requests for comment.

 

Source

[Guest]

Who would use Safari anyway, while there's a lot of alternatives better than that? Like Google Chrome, Brave, Opera or even newly released Microsoft Edge?

[steven36]

35 minutes ago, Edward Raja said:

Who would use Safari anyway, while there's a lot of alternatives better than that? Like Google Chrome, Brave, Opera or even newly released Microsoft Edge?

On IOS  there  is no real  Chromium engine or Gecko engine     All browsers on IOS use  the WebKit engine so there just Safari with a different skin.

 

You got to love it when  Desktop /Android users talk about browsers in the Apple ecosystem because most don't have a clue. The browsers you name are not even the same on IOS as they are on other platforms. Apple want allow Chromium on there mobile platform  and in some countries IOS is used more than Android and Windows. Apple also has were you can restrict data being harvested form 3rd party apps  but not  so much there own data harvesting is blocked.   Apple also want let  you set 3rd party browsers as default on IOS so stuff still going to open in it ,  also  even if they did  it would not be the same experience as using Chrome on Desktop or Android.

[steven36]

Google researchers discovered multiple security flaws in Apple's Safari web browser that let users' browsing habits be tracked despite Apple's Intelligent Tracking Prevention feature.

 

Google plans to publish details on the security flaws in the near future, and a preview of Google's discovery was seen by Financial Times, with the publication sharing information on the vulnerabilities this morning.

The security flaws were first found by Google in the summer of 2019, and were disclosed to Apple in August. There were five types of potential attacks that could allow third parties to learn "sensitive private information about the user's browsing habits."

Google researchers say that Safari left personal data exposed because the Intelligent Tracking Prevention List "implicitly stores information about the websites visited by the user." Malicious entities could use these flaws to create a "persistent fingerprint" that would follow a user around the web or see what individual users were searching for on search engine pages.

Intelligent Tracking Prevention, which Apple began implementing in 2017, is a privacy-focused feature meant to make it harder for sites to track users across the web, preventing browsing profiles and histories from being created.

Lukasz Olejnik, a security researcher who saw Google's paper, said that if exploited, the vulnerabilities "would allow unsanctioned and uncontrollable user tracking." Olejnik said that such privacy vulnerabilities are rare, and "issues in mechanisms designed to improve privacy are unexpected and highly counter-intuitive."

Apple appears to have addressed these Safari security flaws in a December update, based on a release update that thanked Google for its "responsible disclosure practice," though full security credit has not yet been provided by Apple so there's a chance that there's still some behind-the-scenes fixing to be done.

 

Source