/>
X

Photos: Running Apple's Safari securely

Despite Apple's public claim that its engineers "designed Safari to be secure from day one," researchers have already found several dangerous flaws. Here are several steps you can take to disable various features in Safari to reduce the risk of hacker attacks.
zdnet-logo-large.png
By ZDNet Editors, Contributors on
photos-running-apples-safari-securely1.jpg
1 of 7 ZDNet Editors/ZDNet

These flaws can be used to launch drive-by malware downloads if a user is lured to a malicious Web site.

Here are several steps you can take to disable various features in Safari to reduce the risk of hacker attacks.

On Apple's Safari download site, Windows users have two choices -- Safari bundled with QuickTime or Safari as a standalone download.

If you wish to beta test the new browser, avoid the QuickTime bundle, which could potentially introduce additional security risks.

You can download the browser without giving your e-mail address to Apple.

photos-running-apples-safari-securely2.jpg
2 of 7 ZDNet Editors/ZDNet

During the Safari for Windows installation process, Apple gives you the option to install the Bonjour networking service and a software update utility that helps with the patching/updating process.

For security reasons, uncheck the Bonjour service installation. There have been serious code execution holes found in this service.

Install the Apple Software Update tool to ensure you receive fixes and security patches automatically.

photos-running-apples-safari-securely3.jpg
3 of 7 ZDNet Editors/ZDNet

This screen is taken from Safari on the Mac but it also applies to the Windows version.

On Safari for Windows, choose Edit and ensure that Block Pop-up Windows is checked.

The shortcut for this is Ctl+Shift+K.

This option will prevent sites from opening another window through the use of scripting, or active content.

You should be aware that while pop-up windows are often associated with advertisements, some sites may attempt to display content relevant to your usage of the site in a new window.

Therefore, setting this option may disable the functionality of some sites.

Source: CERT/CC (Computer Emergency Response Team Coordination Center).

photos-running-apples-safari-securely4.jpg
4 of 7 ZDNet Editors/ZDNet

On the Mac OS (screenshot), choose Safari > Preferences. On Safari for Windows, choose Edit > Preferences

In the General tab, you can set up many options such as Save downloaded files to: and Open "safe" files after downloading.

CERT/CC recommends that you save downloaded files to a temporary folder that you create for downloading files.

For security reasons, be sure to uncheck the Open "safe" files after downloading option.

photos-running-apples-safari-securely5.jpg
5 of 7 ZDNet Editors/ZDNet

Move next to the AutoFill tab to select what types of forms your browser will fill in automatically.

In general, CERT/CC recommends against using AutoFill features because if someone can gain access to your computer, or to the data files, then the AutoFill feature may permit them even easier access to other sites that they would not otherwise have the ability to access.

However, if used with appropriate protective measures, it may be acceptable to enable AutoFill.

On the Mac, use filesystem encryption software such as OS X FileVault to provide additional security for files that reside your home directory.

photos-running-apples-safari-securely6.jpg
6 of 7 ZDNet Editors/ZDNet

The Security tab includes the most important settings to help reduce the risk of drive-by downloads.

The Web Content section permits you to enable or disable various forms of scripting and active content. CERT/CC recommends disabling the first three options in this section, and only enabling them when you require the functionality of these features.

You should select the Block Pop-up Windows to prevent sites from opening another window through the use of scripting, or active content. However, be aware that while pop-up windows are often associated with advertisements, some sites may attempt to display content relevant to your usage of the site in a new window. Setting this option may therefore disable the functionality of some sites.

Use Safari without plug-ins and Java by disabling the options Enable plug-ins and Enable Java.

It is also safer to disable JavaScript. However, many web sites require JavaScript for proper operation.

You can also disable cookies and view or remove cookies that have been set.

CERT/CC recommends disabling cookies and enabling them only when you visit a site that requires their use. At this point, you should determine if the site is trustworthy (ie, contains no malicious content and is securely designed) and determine whether you want to allow cookies to access the site's content. After you are finished visiting the site, we recommend disabling cookies until you need to access a site that requires cookies.

You can limit cookies to the sites that you navigate to by selecting the option Only from sites you navigate to. This will permit sites that you visit to set cookies, but not third-party sites. Finally, we recommend selecting the Ask before sending a non-secure form to a secure website option. This will alert you when data is sent to a secure web site over an insecure channel.

Source: CERT/CC.

photos-running-apples-safari-securely7.jpg
7 of 7 ZDNet Editors/ZDNet

Safari (on Mac and Windows) offers a feature called Private Browsing.

You can turn this on via the Edit drop-down on Windows or from Safari on the Mac.

When Private browsing is turned on, Safari won't store your Google searches, your cookies, the history of sites you've visited, your download history, or information from online forms you've filled out.

If you've been browsing without private browsing turned on, just use Privacy Reset to empty your cache and clear Safari of your browsing, forms, and search history.

Related Galleries

Nomad Apple Watch 7 Sport Band review: in pictures
nomad-aw7-sport-band-8.jpg

Related Galleries

Nomad Apple Watch 7 Sport Band review: in pictures

8 Photos
Brydge 12.9 Max Plus keyboard review: in pictures
brydge-129-max-plus-keyboard-2.jpg

Related Galleries

Brydge 12.9 Max Plus keyboard review: in pictures

10 Photos
Nomad cases, cable, and adapter for the Apple iPad Pro: in pictures
nomad-ipad-129-pro-2.jpg

Related Galleries

Nomad cases, cable, and adapter for the Apple iPad Pro: in pictures

13 Photos
First look: Apple 'Peek Performance' event in pictures
peek-performance.jpg

Related Galleries

First look: Apple 'Peek Performance' event in pictures

35 Photos
Nomad iPhone 13 Pro Max case review: in pictures
nomad-iphone-13-pro-max-7.jpg

Related Galleries

Nomad iPhone 13 Pro Max case review: in pictures

12 Photos
Speck Apple iPhone 13 Pro Max gear: in pictures
speck-iphone-13-pro-max-2.jpg

Related Galleries

Speck Apple iPhone 13 Pro Max gear: in pictures

13 Photos
Arc Pulse case and screen protector for iPhone 13 Pro Max: in pics
arc-pulse-black-silver.jpg

Related Galleries

Arc Pulse case and screen protector for iPhone 13 Pro Max: in pics

15 Photos