A somewhat simple security question......

If a mac running macosx has two separate user accounts, lets say one admin and the other a standard user, or both admins or both standard users.....
Is it possible for a hacked/penetrated account on one of the users to affect or read any info from the other user on the same machine ?
What application is in question; Safari lets say.....

FLUIDNYC wrote:
So, disable all scripts and uninstall all plugins from the browser.
No java, No javascript, No plugins like flash, java, shockwave, quicktime, or adobe crap.
So, no functionality. What about that java applet I need to run 10 hours a day. Do you think I should go out of business over it? Or all my QT movies? Or, deprive myself of Flash, so I can't view the content of websites?
So, lets say you browse www.thissiteisinfected.com and have everything uninstalled (see above), and your smart enough to browse the web using a "STANDARD" user account and not the "ADMIN" user account.
Running from a standard user buys you nothing and adds additional steps. If you want to download an app, before you install, you will get a dialog warn you "XXXX is an application you downloaded from the internet..." So, you still have to authenticate. And what about *all the apps that need no authentication to install?*
You tell me how this website will inject crap into your MAC with the settings above???
There is no way to FORCE CODE into your browser if everything is disabled.
Tell me how it can "inject crap" into my "Mac" admin without my complicity.
I have bumped into a rouge antivirus website while on my macbook using safari.
All of a sudden a popup stated i had spyware, i could'nt close the box/window, I had to do a FORCE QUIT on SAFARI to get out of that page. It pretty much hijacked SAFARI.
This is nothing that can harm you. It is annoying having to force quit over it, but that is all.
My safari download settings place things on my desktop, sure enuff, there was a .EXE file sitting on my macbooks desktop.
Sure enough, your Mac can't do a thing with it.
NOTHING IS BULLETPROOF.
I agree but there are simpler ways to plant a rootkit you overlook, that have nothing to do admin accounts or ports. *The question is, who would want to?* Even if a black hat is randomly hunting for bank account numbers, social security numbers, credit card numbers, etc. he would pass up a UNIX based system with good protections in place for an easier target.
In short, in a home environment, I could never recommend running from a standard user. Especially if they are on a router and/or using OS X firewall. (The exception being if you have kids and want to use parental controls.) I have no idea how this mantra about using a non-admin account started, there is no place where Apple recommends this.
-mj

Similar Messages

A simple security question

I'm trying to write a simple self-signed applet that use a jca provider but thi exception "java.security.SecurityPermission putProviderProperty.BC" is thrown. if I use a policy file, it works fine but for a beginner user is not very useful intall a new policy file.
After this I tried to write a new self-signed applet that read a file and open a ServerSocket on port 21, and it work fine without a new policy file!
My question is this: why is needed a policy file to add a provider and not to open a ServerSoket or read/write a file???????
PS
if u have an idea to resolve my problem without a policy file, tell me pls!!! IT'S URGENT!!

An applet works out of a so-called sandbox. The security restrictions can be overcome in one of two ways that you have tried:
1) by the use of a policy file, or
2) by signing the applet
So, to answer your question:
My question is this: why is needed a policy file to add a provider and not to open a ServerSoket or read/write a file???????Since the applet is signed, there is no need for a policy file......if you tried to access the socket without signing the applet, you'll get the security exception!
;o)
V.V.

HT5312 why do i have to talk to someone all on the phone to answer a simple security question... im not very social and id rather find an answer by reading it on the website; after all that's what its for. Right?

frustrated

If you have a rescue email address on your account, as described on the HT5312 page that you posted from, then you can reset them via http://appleid.apple.com - follow steps 1 to 5 half-way down that page and you should give you a reset link.
If you don't have a rescue email address (you won't be able to add one until you can answer your questions) then you will need to contact Support in your country to get the questions reset - which is likely to be by phone as they need to confirm your id and that it's your account, which is more easily done by phone rather than having emails going back-and-forth.
Contacting Apple about account security : http://support.apple.com/kb/HT5699
When they've been reset (and if you don't already have a rescue email address) you can then use the steps half-way down the HT5312 page that you posted from to add a rescue email address for potential future use

Simple Security Questions

I have an AP 1100, and want to enable so encryption on the transmission. In the past I have used MAC address authentication, and want to augment the security. (Understanding that authentication and encryption security isn't the same thing)
With this, I have a few questions:
If I enable WEP (which I hear is not very secure) do I HAVE to statically map each WEP key to each device?
Why are there 4 fields for wep keys in the access points web admin page, and can I only submit transmit on only one key? Does the transmit function allow me to sent the wep key dynamically to the clients, without the need to statically assign the key to all the clients?
Can I use EAP or LEAP without a RADIUS server? What are other encyrption options without the use of a RADIUS server?
What does a RADIUS entail, is it software I can install on a NT SERVER?
Thanks!

Before I answer your questions, I would like to clarify certain buzz words:
1. WEP - an encryption method for 802.11 networks
2. static WEP - the WEP keys are statically defined in the access point and the wireless clients
3. dynamic WEP - each wireless client uses a different WEP key. Usually, dynamic WEP works with 802.1x authentication or WPA-PSK. This creates a more secured environment.
If I enable WEP (which I hear is not very secure) do I HAVE to statically map each WEP key to each device?
Answer: Not really. You can implement 802.1x or WPA-PSK for dynamic WEP key. Please see the above and look at the difference between WEP, static WEP, and dynamic WEP.
Why are there 4 fields for wep keys in the access points web admin page?
Answer: You can configure other devices to use different WEP key as transmit key. This creates more keys. Thus, hackers have to sniffer more packets to hack the WEP key.
and can I only submit transmit on only one key?
Answer: Yes for Cisco AP.
Does the transmit function allow me to sent the wep key dynamically to the clients, without the need to statically assign the key to all the clients?
Answer: No
Can I use EAP or LEAP without a RADIUS server?
Answer: No. However, Cisco AP comes with a radius server. Thus, you do not need an external radius server. The radius server in the AP only supports LEAP.
What are other encyrption options without the use of a RADIUS server?
Answer: static WEP and WPA-PSK
What does a RADIUS entail, is it software I can install on a NT SERVER?
Answer: There is a radius server comes with Cisco AP. Cisco also have a radius server for Windows NT. It is called ACS. Microsoft's radius server is called IAS. Another commonly used radius server is Steel Belted radius server from Funk.

HT5312 Even after calling apple and providing the answers to the security questions they are unable to fix problem.

It's mindboggling that one must have two email accounts (original and rescue) just in case we don't have a record of the passwords or we use the right ones and Apple program is having a problem.
Our son set up his account and answered a simple security question of "Where did your parents meet?" It isn't a multiple answer question and Apple will no longer accept the correct answer. He had the answer to the other two questions and again, the Apple program has erred and has now locked him out.
A call to Apple was completely unsuccessful with correcting the situation.
We, 1) know the answers to the questions, 2) we have all the proof of purchases that for some reason Apple cannot link to our account which to me is just unbelievable, and 3) the original email used for the whole itune set up has never changed, is still valid and again not proof of who we are. This all leads me to believe that they can fix the problem but that they choose not too.
We can log into the account but can't get past the security questions even with the correct answers.
How can their purchase orders not be linked to the funds (and associated email) they are accessing to pay for the purchase?
Why is it that matching the payment account to the email is not a valid proof of who we are?
None of this makes any sense at all.

We are fellow users here on these forums.
Who did you call ? If you don't have a rescue email address on your account then you should be able to get them reset by contacting iTunes Support / Apple in your country : http://support.apple.com/kb/HT5699

Avoid answering security questions

APp store insists that answer security questions. I do not want this. How can I get around that window?

rbrylawski wrote:
Well good for you. How wonderful that you have a device you won't be able to use to it's full potential. You won't be able to download apps. You won't be able to have books, or music, or magazines, or productivity tools. Your stuborness yields a pretty worthless and expensive device which won't do much. But at least you didn't answer some simple security questions.
THanks for trolling through. It's too bad there isn't a "this is the antithesis of help" button that lowers your reputation.

I have no "Rescue email" contact in order to reset my security questions and I don't believe I ever answered any security questions when I created my Apple ID for Itunes. Someone kindly sent me Apple support link but to no avail! Please Help me!

I have no "Rescue email" contact in order to reset my security questions!! I've been trying now for 4 days to contact Apple/Itunes but I only get sent answers from a support team that say they cannot help me with my problem!!
The thing is that I can't ever remember answering any security questions and without a rescue email, I'm unable to reset them or even set them for the first time!!
I can't believe that no-one from Apple/Itunes can help me with this simple problem but unfortunately that is the case - Incredible, isn't it!!!
Would anyone know how I could solve this problem online??? Because each time I sign into Itunes, the same security questions reappear and reappear and reappear. In fact I've got to the point where I feel like uninstalling Itunes and downloading an alternative.
Many thanks

You need to ask Apple to reset your security questions; this can be done by clicking here and picking a method, or if your country isn't listed, filling out and submitting this form.
They wouldn't be security questions if they could be bypassed without Apple verifying your identity.
(111154)

How to add a new property security question in atg profile?

Hi All,
I want to add a new field in registration.jsp named as Security Questions; it has 3 questions and it should be ordered and cannot contain duplicate values.
For this I have created
1) a customUserProfile.xml under /MyModule/config/atg/userprofiling/customUserProfile.xml with the following content-
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
    <!DOCTYPE gsa-template PUBLIC "-//Art Technology Group, Inc.//DTD General SQL Adapter//EN"
        "http://www.atg.com/dtds/gsa/gsa_1.0.dtd">
<gsa-template>
    <header>
        <name>Registration</name>
        <author></author>
    </header>
    <item-descriptor name="securityquestions">
<table name="security_questions" id-column-names="securequestions_id">
    <property name="securityquestions" data-type="enumerated">
    <attribute name="useCodeForValue" value="false"/>
      <option value="what is your birth place" code="0"/>
<option value="what is your favourite colour" code="1"/>
<option value="what is your pet name" code="2"/>
    </property>
</table>
</item-descriptor>
2) a definition file under named as /MyModule/config/atg/userprofiling/customUserProfile.properties-
$class=atg.adapter.gsa.GSARepository
$scope=global
repositoryName=customUserProfile
# database access- for making repositry as versioned, use SwitchingDataSource else use JTDataSource
dataSource=/atg/dynamo/service/jdbc/SwitchingDataSource
transactionManager=/atg/dynamo/transaction/TransactionManager
# our XML definitionFile
definitionFiles=/atg/userprofiling/customUserProfile.xml
# XML parsing
XMLToolsFactory=/atg/dynamo/service/xml/XMLToolsFactory
# id generation
idGenerator=/atg/dynamo/service/IdGenerator
</gsa-template>
3) a droplet names as /MyModule/src/com/pa/SecurityQuestionLogin.java
4) a registration jsp with the following code snippet for security questions-
<dsp:droplet name="SecurityQuestionLogin">
<dsp:select bean="SecurityQuestionLogin.securityQuestions">
    <dsp:droplet name="PossibleValues">
      <dsp:param name="itemDescriptorName" value="securityquestions"/>
      <dsp:param name="propertyName" value="type"/>
      <dsp:oparam name="output">
        <dsp:droplet name="ForEach">
          <dsp:param name="array" param="values"/>
          <dsp:oparam name="output">
            <dsp:option param="element"/>
            <dsp:valueof param="element"/>
          </dsp:oparam>
        </dsp:droplet>
But I don't know what logic can I implement in java class for this requirement.
Is the above structure is right for this purpose,please help!
Regards,
Vikas

Hi Nitin,
extend ATG userProfile.xml and add properties there in user item-descriptor
I created userProfile.xml under C:\ATG\ATG10.0.3\MyModule\config\atg\userprofiling with following contents-
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE gsa-template
        PUBLIC "-//Art Technology Group, Inc.//DTD General SQL Adapter//EN"
        "http://www.atg.com/dtds/gsa/gsa_1.0.dtd">
<gsa-template>
<item-descriptor name="user" cache-mode="simple" xml-combine="append">
<table name="security_questions" type="auxiliary" id-column-name="securequestions_id">
<property name="securityquestions" column-name="securityquestions" data-type="enumerated">
<attribute name="useCodeForValue" value="false"/>
      <option value="what is your birth place" code="0"/>
<option value="what is your favourite colour" code="1"/>
<option value="what is your pet name" code="2"/>
</property>
</table>
</item-descriptor>
</gsa-template>
and created userProfile.properties file with following content-
$class=atg.adapter.gsa.GSARepository
$scope=global
repositoryName=userProfile
# database access- for making repositry as versioned, use SwitchingDataSource else use JTDataSource
dataSource=/atg/dynamo/service/jdbc/SwitchingDataSource
transactionManager=/atg/dynamo/transaction/TransactionManager
# our XML definitionFile
definitionFiles=/atg/userprofiling/userProfile.xml
# XML parsing
XMLToolsFactory=/atg/dynamo/service/xml/XMLToolsFactory
# id generation
idGenerator=/atg/dynamo/service/IdGenerator
and change the jsp code as-
<dsp:select bean="/atg/userProfiling/Profile.securityQuestions">
    <dsp:droplet name="PossibleValues">
      <dsp:param name="itemDescriptorName" value="securityquestions"/>
      <dsp:param name="propertyName" value="type"/>
      <dsp:oparam name="output">
        <dsp:droplet name="ForEach">
          <dsp:param name="array" param="values"/>
          <dsp:oparam name="output">
            <dsp:option param="element"/>
            <dsp:valueof param="element"/>
          </dsp:oparam>
        </dsp:droplet>
      </dsp:oparam>
    </dsp:droplet>
</dsp:select>
</dsp:droplet>
Have I done right?
And what else I need to do,should I run the startsqlrepository script to create the table structure for this property?
Thanks & Regards,
Vikas

How do I change my password if I can't answer one of the security questions. iCloud does not give me a reset option of questions or email to my account to start over

I want to change password of my ICould. It keeps asking me security questions which I never remember setting up and thus can't answer them correctly. There is no option to reset questions or for email to my account for reset. Any help?

I found it, but only on the "outside"...before you sign in. Once you are signed in, it is not there. (Now, I might be overlooking it or be crazy, but I can't find it)
I know many people love all the bells and whistles of modern computing...but I want it as simple as I can have it, and more and more I find these this simple task becoming more difficult.
Oh well, thanks for your kind response.

How to call German Support from Asia to reset security question?

Dear Apple Support,
my dealer for my very first MAC computer tried to install software and update OS to prepare notebook for "reday to use"status.
It turned out that Apple has no service access to allow dealer to install and register software on customer behalf.
So I needed to give him full access to my account.
Since I'm new in this Apple things I was scared because with other OS I never ever had that requierement.
But I already confirmed my MAC order so I could not cancle and step away from Apple.
So I tried to process this request as save as possible. I removed all credit from account and gave a temporary password.
I also tried to set security question to temporary values for my dealers access.
But here something went wrong. So I ended up with obiviously unknow security question answers what blocks the access.
The instructions on the screen and some screenshots in the change settings iinstruction show different (outdated) forms.
Also the alternative approach with alternative email was not working.
Why is it not possibel to forward user request for this reset request automatically to relevant support?
I found also that the German support can't be called from abroad.
Why is this not mentioned in list of international phone numbers?
For some areas there is such a note but not for the German number!
Finally I raised a case request to call back under my number, but Apple does not allow to change the country code.
Because that way I had no chance, I ask my dealer to assist and he called Apple support in Germany, but as they found out that he was acting on my behalf they kicked him out too times without further help.
That was the moment I really regret that I spend now so much money for buying an Apple thing.
I immediately cancle the Apple Care policy. Why should I pay for somthing if not even basic support is reliable.
Apples does really good marketing, but in reality on second view when in real touch with Apple service it looks very poor.
From user interface over usability of support process and dealer service all is so weak.
Since Apple support kicked out the dealer, I called in next attempt a German person to relay my telephone request while being on Skype session.
But what we there experienced was far more unfriendly.
We picked up the call after 2-3 ring and a computer voice wellcomed us and told us that Apple was not able to reach us.
Furthermore they announced to call agian 10minutes later (10:21am MET +10min) we waited in Skype session over half an hour but no call back.
I tried than to request again a call with clear indication that they pleas have to use my abroad number.
But this results in an email answer from Apple support that they can't reach me although the number they confirmed to are correct!
My umber is also given in my data records in Apple-ID. So why is Apple support not able to escalate to second support level if something goes obviously goes wrong?
May be too much automated system administration?
After 1,5 days and many many emails, calls and endless frustration on my site and on authorized dealer side I need to escalate my simple request now over all channels I can find within the Apple universum.
ontact details are all known to you and many request emails in your inbox refer to this case. My dealer contacts I already forwarded to Apple support email.
Hey guys, I need just to get my security questions reseted! Can anybody assist please?
Please inform we when done or call me under my:
1. day number
2. evening number
3. Mobile number.
4. Apple-ID email
5. ooptional email
6. or contact my relay in Germany under the number I send to you.
PPLLLEEAASSEEEEE!

Thanks roaminggnome for reminding me on this reference,
that was one of the confusing webpages I found for this problem while using a simple search :-)
But in my case the screen looked different and the procdure even more different than described in this easy to search posting.
But don't worry Appel support also approached it in same way.
The solution for this problem was much different.
The scaring story with all this is that I had to give full account access and security question answers to a third party person helping as a relay to comunicate to Apple support.
A simple search in free forums showed me that I'm not the only one having trouble with this Apple security strategy.
Many thanks again!
Ramamara,
Send from my Motion Computing Tablet WinXP

If you have forgotten your security question how can you change them?

Have not had to use this option so I really have forgot all about setting this up till the other day.. But when this come up that I did have to use I found out I forgot what I had use.. Stupid me.. Any way I did get my password rest and thought changing this would be simple inside my account.. Wrong... Appears you have also know your old one to change it.. Now this is so stupid.. I don't want to have to pay for support to have apple to reset this option.. Does any one know if Apple has a Email support to help with issue like this.. I may never need this option again but really it was a pain to get around it.
Thanks Everyone

Contact Apple, they can reset the security question infomation and you shouldn't need to pay for support on this. There is no troubleshooting your paying for, you're just having assistance for account security

How do you change your security question answers if you totally forgot them?

Please make it as simple as possible because as my user name implies I am not very good nor like technology.

You need to ask Apple to reset your security questions; ways of contacting them include phoning AppleCare and asking for the Account Security team, clicking here and picking a method for your country, and filling out and submitting this form.
They wouldn't be security questions if they could be bypassed without Apple verifying your identity.
(104495)

I need help with Changing my Security Questions, I have forgotten them.

Its simple, I tried buying a Gym Buddy Application and I had to answer my security questions... Which I have forgotten I made this a while ago so I probably entered something stupid and fast to make I really regert it now. When i'm coming to this...

Hello Adrian,
The steps in the articles below will guide you in setting up your rescue email address and resetting your security questions:
Rescue email address and how to reset Apple ID security questions
http://support.apple.com/kb/HT5312
Apple ID: All about Apple ID security questions
http://support.apple.com/kb/HT5665
If you continue to have issues, please contact our Account Security Team as outlined in this article for assistance with resetting the security questions:
Apple ID: Contacting Apple for help with Apple ID account security
http://support.apple.com/kb/HT5699
Thank you for using Apple Support Communities.
Best,
Sheila M.

HT5312 how to reset my security question as I cannot remember any ?

Hi,
I want to change my security question as I cannot recall them but when I am log in I cannot reset them unless I know them !!!!!!!!!!!
how can I do reset them in a simple way ?
Thanks
David

If you mean that you aren't getting the reset link on your account, as described on the HT5312 page th that you posted from, then that will only show if you have a rescue email address on your account
Note: The option to send an email to reset your security questions and answers will not be available if a rescue email address is not provided. You will need to contact iTunes Store support in order to do so.
Contacting Apple about account security : http://support.apple.com/kb/HT5699
When they've been reset you can then use the steps half-way down the HT5312 page that you posted from to add a rescue email address for potential future use

Skipping security questions and answers

Since recently, my iPad (but also iTunes on my mac) asks me for security questions and answers when I try to download an app. How can I download apps without providing these questions and answers?

Thanks Michael, so it is possible without security questions. Unfortunately, I find the 2-stage verification even more worrying. I've accepted the situation as is and have picked three questions and have entered random data as answers to them.
To clarify my objections to these security questions:
These questions provide no additional benefit. I can pick a question and answer truthfully, but these are generally things others could find out (especially in targetted attacks, where the attacker tends to already know a bit about the victim - does anyone remember how Paris Hilton's T-Mobile account got accessed by attackers who knew her dog's name? (yes, that is an especially stupid example, but it shows the problem with these kinds of "security measures"))
Entering random data is already a lot better, however iTunes will simply show your (random) answer on screen instead of the regular dots you see when entering your password. Apple tells us to keep your passwords private and not share them with anyone (including family). If family is sitting next to you while you type your random data, they can easily read along.
As it stands, these security questions impose another hurdle for the user, not the attacker. Hence my attempt to circumvent this approach. I have a strong password and I have implemented safeguards to prevent forgetting it. The security questions do not improve my situation, they are an attempt at improving the situation of people that take security less seriously. These are the same people that provide all the answers to these security questions on their facebook (or whatnot) for all the world to see. Pointless.
(Note that the 2-stage verification is a better approach that solves the problems mentioned above. However, it comes with new downsides that I won't detail here as this is already way too long).
Anyway, thanks to all that responded. I have to say, suggestions of moving to another vendor seem somewhat ridiculous. That also means purchasing new devices when all I want to do is use my device (the device I've grown used to) as I have for quite some time. And there is no guarantee that such a new environment does not have similar stupid security measures in place.

A somewhat simple security question......

Similar Messages

Maybe you are looking for