Jeremiah Grossman has discovered and explained a potentially significant security flaw in Safari 4 and 5. In essence, if you have the AutoFill option "Using info from my Address Book card" enabled, a malicious Web site can extract your name, company, city, state, country, and email address without your knowledge. For the moment, we recommend turning off that option in Safari's AutoFill preference pane. Apple told the New York Times (though not Grossman, who reported the bug) that they are "aware of the issue and are working on a fix." follow link
Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the TidBITS Content Network for Apple consultants.
- ExtraBITS for 26 July 2010 (26 Jul 10)
Safari Reveals Personal Info Via Auto-Fill