2

Since the last Safari update (I'm on Lion, 10.7.5), I've been unable to connect to a client's VPN. Their VPN runs via a Java network client from Juniper Networks, and it appears to require write-access and chmod permissions on several folders. I can get around this by enabling "Run in Safe Mode" in Safari, which is what the client is recommending I do. I can't find anything about the security ramifications of doing this and I don't feel comfortable downgrading security on my system, even if it's for a client I trust. On the other hand, I don't know if I was running the software in "unsafe mode" before the update without knowing it (which is what I'm afraid was probably the case).

Does anyone know what the ramifications of running Java apps in "unsafe mode" are?

There is a knowledgebase article (Google cache) on this, which says they are working on a certified client. I understand it won't be out for another month.

2

It looks like unsafe mode allows the Java app full access to your filesystem, which is enough that a malicious Java app could do anything it wants (take over your computer, infect it with malware, spy on you, etc.). So, the name "unsafe mode" does seem appropriate here.

It's your call whether you want to take the risk. Personally, I wouldn't, on my own personal computer. I might set up a virtual machine and run the VPN client inside the VM, or ask the client for another solution that doesn't involve shooting holes in your computer's security. Right now, Java security is a bit of a mess; it's a shame we don't have better solutions available.

  • Apple updated their docs to say "Allows the Internet plug-in to load and display its content completely without malware safety checks". I'm assuming that since I'm not asked to enter an admin password when I add applets to the list, this only gives access to user files. The thing I'm most worried about is giving Java root access. I agree that Java security is pretty bad right now. If it weren't for the VPN, I'd have Java completely disabled in the browser. It really irks me that this client would rely on Java over the wire to protect them but not me. – Andrew Nov 9 '13 at 6:29
  • @Andrew, I understand and sympathize. But, let me mention a caveat. Even if Java only gets access to user files, that's enough that it can take essentially total control of your desktop (e.g., delete all your data, upload your data to the cloud, steal your website passwords, man-in-the-middle your online banking, you name it) -- so even if it is limited to just user files, it is still potentially very dangerous. – D.W. Nov 9 '13 at 6:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .