Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 3 down vote favorite

In Little Snitch, I allowed port 80 when a "google.com" popup appeared on my screen. I'm wondering if that was a good idea.

If a hacker installed a program on my Mac, and that program sent information to a server, would it go through "internet" and port 80? Considering this, is it safe to permanently allow port 80 traffic?

On the other hand, if I only accept "google.com on port 80" (instead of all sites on port 80) I get ten or 15 alert dialogs for each advertisement and service, on each website.

share|improve this question

3 Answers

up vote 3 down vote accepted

No.

If, for all processes.

Pretty much yes.

If, only for web browsing.

As @StuWilson has pointed out, port 80 is for http traffic and port 443 is for https traffic. (http with TLS/SSL encryption).

It's not necessary to allow all traffic of all processes on port 80. But - for the sake of comfortable browsing - I strongly recommend enabling those ports for all traffic of webbrowsers like Safari or Chrome.

For comparison, this is my setup of Chrome in HandsOff!:

  • Basic communication

    • Allow all outgoing network connections on port 443 (https)
    • Allow all outgoing network connections on port 80 (http)
    • Allow all domain resolving

  • Sync

    • Allow all outgoing network connections to talk.google.com on port 5222

  • Other (e.g. media)

    • Allow all outgoing network connections to atracktive.collegehumor.com on port 9090 (websm)
    • ...

Setting up a firewall can be quite a hassle. Generally - when I've expected a certain connection to build up, and know what it's for, I allow it. But you should only interfere network connections when you know what you're doing.

Many system processses regulary build up (local) network connections that are certainly valid. If you don't know how to guard a firewall, you become the first security risk for your own computer. Make sure to educate yourself on network protocols when building your own firewall.

share|improve this answer
thanks, and do you get 15 dialogs for each website with your settings? and know what it's for most of the time it's for an advert or anything like that... – Paul Mar 5 '12 at 17:49
@Paul I almost never get dialogs when browsing because I allow all outgoing connections on the ports 80 and 443 for Chrome. If I do get prompted, I usually know why because I've expected it. For example: The rule that I've set in the section other, is used for streaming the videos on www.collegehumor.com. – gentmatt Mar 5 '12 at 17:56
oh okay i've just got it. if it's a "google.com" popup, and it asks me "allow port 80" it will only be specific to chrome + port 80, right? not the whole port 80 ... – Paul Mar 5 '12 at 20:12
actually i'm saying that because i only checked "port 80" when a popup appeared but in the "rules", each rule is written next to an application, so i guess it understood that it was for each specific app... – Paul Mar 5 '12 at 20:21
1  
@Paul The pop-up notification is always app/process-specific. The rule you define will only apply to the app/process which prompted the pop-up and can be identified by the icon on the top left. The only case where such a rule would affect other apps/processes is when you choose global from the tabs. – gentmatt Mar 5 '12 at 21:02
show 1 more comment
up vote 3 down vote

Port 80 is the standard port for all HTTP traffic, so disallowing port 80 will give you a popup for all web browsers and web sites.

Little Snitch is about telling you what is on your machine trying to communicate with other things.

Rules are generally about Program A, Port B, Destination C

So you could have a rule that says, "Safari", Port 80, "All Destinations" which would allow Safari to browse the web, but that would stop Google Chrome doing the same.

Note in the real world, there are other ports such as those for HTTPS (443) that would also be open.

share|improve this answer
thanks, so potentially, because i let the port 80, a program can be installed on my mac and sends infos to a server through the port 80, and Little Snitch doesn't tell me because i considered the port 80 as safe? what should i do to be sure? – Paul Mar 5 '12 at 13:32
To stop other programs from accessing port 80, you could only allow programs like web browsers to access the internet on Port 80 and then set up a deny rule for all programs on port 80 – Stu Wilson Mar 5 '12 at 14:45
up vote 2 down vote

As @bmike said: port 80 is where just about every non-secure web browser is set to listen for incoming http connections by default. So any communication to unencrypted http services is going to require port 80 to be open.

However, if you open up port 80 for every program, you're going to lose a lot of control over what information is being sent out of your machine (remember, Little Snitch is only an outbound firewall solution).

Little Snitch has the ability to set outbound connection rules on a program by program basis. If you're worried about programs sending out information without your authorization you really shouldn't ever set a general port rule in Little Snitch that allows any program to send out over the port. Instead of allowing all programs the ability to send information out over port 80 you should enable them one at a time. This can be arduous as a lot of programs are going to want to talk over port 80 but it's really the only way to ensure you know who is getting information about you.

When Little Snitch asks if you want to allow or deny a program wanting to send out over a particular port select allow but for this program only. This way you know which programs you've authorized to use the port. If you wanted to get really controlling you could limit each program to the port and the specific address.

You'll basically never want to use the 'Global' tab in the Little Snitch allow dialog:

enter image description here

The tabs across the top of this box control how long the rule persists for:

  • Once: Just this one time. After one access, permission is revoked.
  • Until Quit: As long as the program stays open. After the process ID of the program changes, permission is revoked.
  • Forever: Across all instances of the program for ever more.
  • Global: Not just for this program, but any program that wants to use this port.

The list of options control how specific the rule is:

  • Any Connection: Allow it to use any port to connect to any destination
  • Only port 43 TCP (nicname): Allow to connect to any destination over port 43 using the TCP protocol
  • Only whois.arin.net: Allow it to connect to only the destination whois.arin.net over any port using any protocol
  • Only whois.arin.net and port 43 TCP (nicname): Allow to connect to only whois.arin.net and only over port 43 using the TCP protocol
share|improve this answer
thanks Ian C. for the answer – Paul Mar 5 '12 at 17:44
if you go on an new website, how many dialogs do you get with your settings? i cannot believe that the way i'm experiencing little snitch is the right way... – Paul Mar 5 '12 at 17:54
1  
@Paul: you get the dialog per application so Safari or Chrome or whatever you're browsing the web with will trigger this dialog and you can decide to block or allow *:80 or <this domain>:80 -- it's up to you. If that's not happening check the ruleset and make sure you haven't allowed : for your browser. – Ian C.♦ Mar 5 '12 at 18:45
okay, so on your screenshot : if you check only port 43 TCP (nicname), will it allow every connections on port 43 ? because i only checked this line (only port 80) when a popup appeared, and in little snitch rules, each rule is written next to an application name, so i don't really see the difference betwen "only port 43" here and "only whois.arin.net and port 43", if by any chance you know what i mean? – Paul Mar 5 '12 at 20:17
1  
@Paul I explained the options in the body. Hopefully that helps. If you check only port 43 it will allow the whois command to talk to any destination over port 43 that it wants to. If you select the last option it can only talk to whois.arin.net and only over port 43. That's much more restrictive. – Ian C.♦ Mar 5 '12 at 20:45
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.