« Do We Need More Studies on Reused Passwords? | Main | The Problem With EV SSL »
April 18, 2008
Safari in PayPal's Crosshairs?
Some followup from PayPal’s February rumblings about Safari:
“‘In our view, letting users view the PayPal site on one of these browsers is equal to a car manufacturer allowing drivers to buy one of their vehicles without seat belts,’ said PayPal Chief Information Security Officer Michael Barrett.
“In a white paper that outlines a five-pronged action plan aimed at slowing the phishing epidemic, Barrett said there’s a ‘significant set of [PayPal customers] who use very old and vulnerable browsers’ and made it clear that any browser that falls into the ‘unsafe’ category will be banned.
“‘At PayPal, we are in the process of reimplementing controls which will first warn our customers when logging in to PayPal of those browsers that we consider unsafe. Later, we plan on blocking customers from accessing the site from the most unsafe—usually the oldest—browsers,’ he declared.
“Barrett only mentioned old, out-of-support versions of Microsoft’s Internet Explorer among this group of ‘unsafe browsers,’ but it’s clear his warning extends to Apple’s Safari browser, which offers no anti-phishing protection and does not support the use of EV SSL certificates.”
(Link)
Larry Dignan says PayPal will lose this confrontation:
“So what are the motives here? PayPal–a huge phishing target–obviously wants more protection. It obviously wants EV SSLs, but Apple won’t budge. The solution: Go public.
“But is Apple really going to be pressured this way? Highly unlikely. PayPal seems to be hung-up on EV SSL certificates, but couldn’t Apple meet anti-phishing requirements another way? Why wouldn’t Apple just create lists of offending sites or warn users if a page is sketchy? Does Apple really have to buy into EV SSL?
“Meanwhile, it’s unclear whether PayPal would actually follow through on a Safari ban. PayPal isn’t going to annoy Apple users. And it isn’t going to turn off transactions on the iPhone either. In this stand-off I’d say the advantage is all Apple.”
Posted by mhall at 4:17 PM | Add Comment
Leave a comment