How Sound Is Consumer Reports' Safari Advice?

Consumer Reports has published its annual State of the Net survey in the September issue of the consumer advocacy magazine...

Consumer Reports has published its annual State of the Net survey in the September issue of the consumer advocacy magazine. And an article accompanying the review of assorted online threats titled Seven Online Blunders offered this morsel as Blunder No. Five:

According to this year's State of the Net survey, Mac users fall prey to phishing scams at about the same rate as Windows users, yet far fewer of them protect themselves with an anti-phishing toolbar. To make matters worse, the browser of choice for most Mac users, Apple's Safari, has no phishing protection. We think it should.

What you can do: Until Apple beefs up Safari, use a browser with phishing protection, such as the latest version of Firefox or Opera. Also try a free anti-phishing toolbar such as McAfee Site Advisor or FirePhish.

That's some pretty strong advice there, telling Mac users to switch away from Safari, the browser of choice on the Mac platform by a wide margin. (It mirrors similar advice offered by payment processor PayPal earlier this year.) But is it good advice?

In a macro sense, sure it is--it's always good to use tools that offer the most protection for the user. So if you want to switch to Firefox or Opera, then by all means, go ahead.

But if you want to continue using Safari, I think that's also a perfectly acceptable alternative--as long as you understand the risks, and take some simple steps to minimize those risks.

All about phishing

Just what are those risks? Phishing is, according to Wikipedia, "the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details, by masquerading as a trustworthy entity in an electronic communication." Putting a different name on it, phishing is lying, and typically this lying is done via e-mail or instant messaging. As an example, here's an actual phishing e-mail I received this morning, though I've modified it enough to remove any phishing threats.

Dear Advertiser,

We were unable to process your payment. Your ads will be suspended soon unless we can process your payment. To prevent your ads from being suspended, please update your payment information.

Please sign in to your account at http://adwords.google.com/select/login, and update your payment information. We look forward to providing you with the most effective advertising available. Thank you for advertising with Google AdWords.

Now, this is a grossly oversimplified example, but if you click the above link, you'll find you wind up on Apple's website, instead of what the link appears to show, which is Google's AdWords login page. That's because a hyperlink can have any text associated with it you like--in this case, I associated the AdWords login page URL with a hyperlink to apple.com.