{"id":46084,"date":"2018-10-01T14:56:51","date_gmt":"2018-10-01T19:56:51","guid":{"rendered":"https:\/\/eshop.macsales.com\/blog\/?p=46084"},"modified":"2018-10-02T16:02:25","modified_gmt":"2018-10-02T21:02:25","slug":"a-guide-to-the-new-mojave-security-and-privacy-protections","status":"publish","type":"post","link":"https:\/\/eshop.macsales.com\/blog\/46084-a-guide-to-the-new-mojave-security-and-privacy-protections\/","title":{"rendered":"A Guide to the New Mojave Security and Privacy Protections"},"content":{"rendered":"

macOS Mojave<\/a> has a number of security and privacy enhancements that can help make using your Mac<\/a> a simpler, safer, and more secure experience. Apple made changes to Safari<\/a>, as well as expanded Gatekeeper and SIP services provided by the macOS.<\/p>\n

Automatic Strong Passwords with Safari<\/strong>
\nSafari can automatically create strong 20-character passwords for you when you\u2019re setting up a new service or account. Safari will populate the password and password confirmation field for you, though you can accept or reject the supplied password. The account password will be stored in Safari, and synced with your other Apple devices using iCloud. As long as you remain within the Apple environment (macOS, iOS, watchOS, tvOS), you can access all of your account passwords using just your Apple ID password.<\/p>\n

\"\"
(Strong passwords can be automatically generated and inserted into password fields when you sign up for a new service.)<\/strong><\/figcaption><\/figure>\n

To use Automatic Strong Passwords, launch Safari and browse to a website for which you would like to create a login account.<\/p>\n

1)<\/strong> When you come to the password field, click or tap once in the field.<\/p>\n

2)<\/strong> Safari will display a key icon in the far right edge of the password field.<\/p>\n

3)<\/strong> Click or tap the key icon.<\/p>\n

4)<\/strong> In the menu that appears, select Suggest New Password.<\/p>\n

5)<\/strong> A strong password will be generated.<\/p>\n

6)<\/strong> You can click or tap in the password field, and select Use Strong Password, or Don’t Use.<\/p>\n

Of course, to make the strong passwords easy to use, Safari can also auto fill login fields<\/a> when needed:<\/p>\n

1)<\/strong> Launch Safari and select Preferences from the Safari menu.<\/p>\n

2)<\/strong> Select the Passwords item from the Safari preferences toolbar.<\/p>\n

3)<\/strong> Place or remove the checkmark from the item labeled AutoFill user names and passwords.<\/p>\n

Safari Password Reuse<\/strong>
\nApple can’t put an end to password reuse, the practice of using the same password, or weak variants of a common password, over and over across multiple sites and services. Reusing passwords can be a disaster waiting to happen. Should someone gain access to one of your accounts, they\u2019re going to try that same password with any other account or service they think you\u2019re using.<\/p>\n

As you can imagine, the results wouldn\u2019t be very pretty if you\u2019re reusing your passwords.<\/p>\n

\"\"
(Safari can audit your website passwords and point out when you reuse a password multiple times.)<\/strong><\/figcaption><\/figure>\n

Safari in macOS Mojave<\/a> won’t prevent you from reusing passwords on multiple websites, but it can warn you when you do:<\/p>\n

Launch Safari, and then select Preferences from the Safari menu item.<\/p>\n

In the Safari preferences window, select the Passwords item in the toolbar.<\/p>\n

Enter the password for the current user in order to unlock the Safari passwords.<\/p>\n

The passwords that Safari has remembered for you will be displayed. If any passwords are being reused, Safari will mark them with a yellow warning placard.<\/p>\n

Clicking or tapping one of the warning symbols will display details about the warning, including where the password is being reused, and a link to the current site, so you can quickly go there and change the password.<\/p>\n

Intelligent Tracking Prevention 2.0<\/strong>
\nHigh Sierra introduced Intelligent Tracking Prevention (ITP) to help prevent cross-site tracking, and reduce, or at least make the process very cumbersome, websites tracking your movements as you browse the web.<\/p>\n

The original version of ITP used a 24-hour window to allow some cross-site tracking on the assumption that some web-based services would break if there were a complete elimination of cross-site tracking. An example of a site failing because of the inability to use cross-site tracking would be a banking or financial services site that uses persistent cookies to allow a login to a central server, which allows you to access multiple related services without having to log in to each individually.<\/p>\n

ITP 2 removes the 24-hour window, and instead will throw a prompt up asking if you wish to allow a third-party site to access its stored cookies. Selecting Allow will let the third-party site access its cookies, as well as reset a 30-day timer, allowing another 30 days before those cookies are expunged. Selecting Don\u2019t Allow will prevent the site from accessing the cookies this one specific time, and leave the 30-day timer intact, with no changes.<\/p>\n

If you would like to find out more about ITP 1.x, the 24-hour, and 30-day timers, and how they\u2019re used to assist in blocking cross-site tracking, check out the Rocket Yard article: How to Manage Cookies in Safari for High Sierra<\/a>.<\/p>\n

\"\"
(Safari’s privacy capability includes an update to Intelligent Tracking Prevention that will warn you when third-party websites are attempting to access stored cookies.)<\/strong><\/figcaption><\/figure>\n

You can turn cross-site tracking prevention on or off in the Safari preferences:<\/p>\n

Launch Safari, and then select Preferences from the Safari menu.<\/p>\n

In the preferences window, select the Privacy item in the toolbar.<\/p>\n

Place or remove the checkmark from the box labeled Prevent cross-site tracking.<\/p>\n

Fingerprinting Protection<\/strong>
\nFingerprinting is a method that allows sites to build up enough information to be able to distinguish one computer from another that visits it. The site can do this without setting or using cookies. This “fingerprint” is obtained by examining the information the web browser is sending to the site, and comparing it to other fingerprints the site has already put together. Your Mac may be unique because of the fonts you have installed, the Safari extensions you\u2019re using, the apps you have installed, social media status, and much more.<\/p>\n

Find out more about fingerprinting in the article: What Secrets Your Browser Knows (and Reveals) About You<\/a>.<\/p>\n

Fingerprint protection seeks to make the information a site can gather more generic, making it more difficult to uniquely identify you. This is done in multiple ways:<\/p>\n