Hahnemuehle "This connection is not private"

[Jeffrey Saldinger]

Wanting to download profiles for some Hahnemüehle papers, I entered their web address in my browser and got the attached notice. Has anyone else seen this recently? Is there anything to be done to get the profiles?

[Alan Goldhammer]

Wanting to download profiles for some Hahnemüele papers, I entered their web address in my browser and got the attached notice. Has anyone else seen this recently? Is there anything to be done to get the profiles?

I just Googled Hahnemuhle profiles and they directed me here:  https://www.hahnemuehle.com/en/digital-fineart/icc-profile.html   It was a locked secure site and I did not see any warning sign pop up.

[Jeffrey Saldinger]

Thank you Alan. I used your link in Firefox 70.0.1 and it worked fine, but when I used it in Safari 11.1.2 (my default browser), I got the same warning.

Now I’m wondering why Safari didn’t work. As background that may take this post in another direction (perhaps for a different board?), a website I occasionally need to visit recently announced I could no longer use Safari to access it. That was when I downloaded Firefox, which was one of the browsers that the website recommended. I’m wondering whether there’s any connection between that experience and the Safari warning about Hahnemüehle.

[Alan Goldhammer]

Thank you Alan. I used your link in Firefox 70.0.1 and it worked fine, but when I used it in Safari 11.1.2 (my default browser), I got the same warning.

Now I’m wondering why Safari didn’t work. As background that may take this post in another direction (perhaps for a different board?), a website I occasionally need to visit recently announced I could no longer use Safari to access it. That was when I downloaded Firefox, which was one of the browsers that the website recommended. I’m wondering whether there’s any connection between that experience and the Safari warning about Hahnemüehle.

I cannot help on that one.  Firefox is my default browser and as they update almost weekly I'm confident of its security.

[Jeffrey Saldinger]

Thanks for letting me know, Alan.

I spoke with someone at Apple who said, in what I feel is a fair summary, that the underlying security protocols of different browsers are different, and that a lock icon in one browser’s search field for a given site’s name may not mean the same thing in another in browser’s search field. That is, something Safari saw (or didn’t see) with Hahnemüehle didn’t bother Firefox.

[rdonson]

Jeffrey,

The most recent version of Safari on Mac is Version 13.0.3 (14608.3.10.10.1)

[Jeffrey Saldinger]

Thank you for the tip, Ron.

As it happens, I'm still using El Capitan and there are no updates for my version of Safari.

[FabienP]

Thank you for the tip, Ron.

As it happens, I'm still using El Capitan and there are no updates for my version of Safari.

Running an outdated browser on an outdated operating system is not recommended for browsing the web, as you certainly know. Beside the unsupported newer features of HTML5 and fixed vulnerabilities, I suspect there might be issues with SSL certificates, as hinted in the error message.

If you are unable to update the operating system, it would be at least good to permanently switch to a current browser.

Cheers,

Fabien

[Jeffrey Saldinger]

Thank you for mentioning this, Fabien.

As time has gone by without any more Safari updates, I have done some reading about security concerns with Safari. I have also on several occasions spoken with different Apple representatives. In these conversations, I was always left with the impression that as long as I used secure sites (with the lock icon in the search field); didn’t download anything from suspicious sites; and didn’t open attachments to unexpected/suspicious emails, I’d be fine.

Could you (or perhaps other respondents) provide (or provide links to) descriptions of what vulnerabilities I have that I’m not aware of?

[Doug Gray]

Thank you mentioning this, Fabien.

As time has gone by without any more Safari updates, I have done some reading about security concerns with Safari. I have also on several occasions spoken with different Apple representatives. In these conversations, I was always left with the impression that as long as I used secure sites (with the lock icon in the search field); didn’t download anything from suspicious sites; and didn’t open attachments to unexpected/suspicious emails, I’d be fine.

Could you (or perhaps other respondents) provide (or provide links to) descriptions of what vulnerabilities I have that I’m not aware of?

That's generally sufficient unless you are a higher profile person that might be a spear pfhishng target. These are usually COO's, CFO's, and execs with authority to transfer large amounts by wire. My broker's home email account was accessed by malware and I got an odd looking email that was posted from his account. I instrumented it and tracked it down to a IP in Turkey that redirected it to a Russian site. Appeared to be a commercial operation hawking cosmetics of all things and trying to grab credit card info.

It is possible for malware to be installed in devices such as printers. Virtually everything attached to a computer has microcode that can be compromised but most attacks are mass market attacks rather than specialized ones. If you are curious enough you can evaluate things by using a separate computer and logging all the internet conversations your system has with the outside using Wireshark. If really worried then use two factor authentication for any communications you do with any financial businesses.

[Jeffrey Saldinger]

Doug, it was good to read your first sentence. Thank you for the interesting extra context. I neglected to mention that I do use two-factor authentication.

[rdonson]

Thank you for mentioning this, Fabien.

As time has gone by without any more Safari updates, I have done some reading about security concerns with Safari. I have also on several occasions spoken with different Apple representatives. In these conversations, I was always left with the impression that as long as I used secure sites (with the lock icon in the search field); didn’t download anything from suspicious sites; and didn’t open attachments to unexpected/suspicious emails, I’d be fine.

Could you (or perhaps other respondents) provide (or provide links to) descriptions of what vulnerabilities I have that I’m not aware of?

Do you use an Ad blocker?

Do you run Malware Bytes periodically?

[Jeffrey Saldinger]

Thank you for these questions/tips, Ron.

Having generally felt secure in my cautious online and email habits, I’ve felt squeamish about downloading applications when I didn’t know what they might be doing under the hood.

Do you have a trusted resource for evaluating such applications, so that I can become better informed?

[rdonson]

Jeffrey,

I use 1Blocker with Safari.  It's available on the Mac App Store and reviewed by a lot of reputable sites.

Malware Bytes is available from their website as both a FREE and a PAY versions.  Both have been reviewed well by a number of reputable websites. 

I do like getting apps from the Mac App Store as Apple screens and vets the submissions.   

I'm a bit of a security/privacy nut.  I even use DNSCrypt to encrypt my DNS traffic as I don't trust my internet provider.  These days everyone is trying to sell our online habits and that doesn't count the NSA, etc..   

[Alan Goldhammer]

I'm a bit of a security/privacy nut.  I even use DNSCrypt to encrypt my DNS traffic as I don't trust my internet provider.  These days everyone is trying to sell our online habits and that doesn't count the NSA, etc..

Your participation on LuLa renders all your privacy attempts useless.

[Jeffrey Saldinger]

Jeffrey,

I use 1Blocker with Safari.  It's available on the Mac App Store and reviewed by a lot of reputable sites.

Malware Bytes is available from their website as both a FREE and a PAY versions.  Both have been reviewed well by a number of reputable websites. 

I do like getting apps from the Mac App Store as Apple screens and vets the submissions.   

I'm a bit of a security/privacy nut.  I even use DNSCrypt to encrypt my DNS traffic as I don't trust my internet provider.  These days everyone is trying to sell our online habits and that doesn't count the NSA, etc..

Doug, could you name one or two of sites you consult?

[Jeffrey Saldinger]

Your participation on LuLa renders all your privacy attempts useless.

Alan, why do you think/know this is the case? Is the emoji meant facetiously?

[Doug Gray]

Doug, could you name one or two of sites you consult?

I'm not OCD about malware. But I'm an engineer by profession specializing in embedded systems and wound up getting deep into printing/photography as a result of one of my business endeavors.

My main approach is to running untrusted but potentially useful apps in a virtual machine (VMware or Hyper V) to insulate it. I then instrument it if curious or a bit suspicious.

I don't run cracked software to avoid paying for it. Ever. That's a big source of malware.

Other than that I follow krebsonsecurity who specializes in tracking the largest cyberthreats. These are by far the biggest problems. He also had good advice for consumer users and business IT policies.

[Jeffrey Saldinger]

Doug, I really appreciate this contextualization and your pointing me to Brian Krebs. And I had never seen the expression "cracked software."

Thank you.

[Aram Hăvărneanu]

The worst thing one can do for their own security is running obsolete software. I sympathize with people who don't want to upgrade, but it's a very bad idea, especially if you are not an expert who can manage the tradeoffs involved.