The Unofficial Apple Weblog (TUAW)

+++

I don't know why anyone would put the more intrusive stuff from McAffery or Norton on their systems. I run it occasionally at night on my Mac. I've never found anything.

↓↑report

I'm not saying it's all FUD. I guess you need to make your own decision as to when the level/number of threats reaches a point that you need to invest in such a product. As was mentioned in a comment above, "So this would search for like, two trojans", realistically what is our risk exposure? Is your increased because you willy-nilly click on any old thing downloaded from the Internet? If so, that's not a problem to be solved in software necessarily, but it's an issue with the user. Maybe I'm a bit more paranoid, but then again I'm the one writing security policy and procedures for a living.

I'll read your paper, and post back.

↓↑report

I think you made most of you point with #1 "Does it need to come with you?"

As for the rest I have mixed feelings about them. Having physical access to a *any machine allows for near complete compromise outside of encrypted volumes (every time).

Quite frankly finding a Mac with File Vault turned on would surprise me (it causes more problems than it fixes, just read the Mac support articles related to it on any user group). The issue is similar to that of a hydra, there are more heads than one can honestly deal with. Very few users understand basic security and the ones that do often just become annoyed with it. Notebooks like Wireless are one of those evils in the world you're just stuck with. Wireless is impossible to secure as are their wirelessly equipped notebook companions.

If this wasn't bad enough with the recent display of "ram freezing" to recover passwords on PC's we have to contend with. There are "forensic" solutions available for Macs that make nearly any security null and void. Just check out some of the offerings at SubRosaSoft's store for a better explanation. It's so easy on a Mac all you need is a free USB port (MacLockPick). And if you think the law enforcement label on the box will stop your average thief just check out the availability on a Torrent Tracker.

I don't want to turn this into a diatribe, but in the end physical security will always be the best defense against stolen or compromised data.

↓↑report

@ekinnee: yes, each user (or company, or whatever) needs to weigh the balance and decide whether the outlay justifies the results. And yes a lot of responsibility rests with the user, but while one way to deal with that responsibility is to carefully consider security while surfing, another way is to setup some software which can improve their confidence that mistakes won't cost as much. That can all factor into the decision described above. I don't like the idea that security problems can be addressed simply by educating the users, I believe that everyone is intelligent enough to understand the issues but also that they've mainly got better things to be thinking about :-)

@Chris: point 1 is indeed the strongest, but with respect to the above paragraph does fall into the "you can't do what you want because of unexpected side-effects" problem. With regard to FileVault though, it's been my experience that 10.5's switch to sparse bundle format has made backing up the encrypted store much easier, and that 10.5.4 finally addressed the (edge-case) stability problems I'd seen. I don't think there's any need to be worried about filevault by default, though I do still have an unencrypted backup of my data. Isn't that defeating the point? Not really, because the backup doesn't do all the travelling and roaming that the encrypted original needs to ;-)

↓↑report