SafeSign and Apple OSX Snow Leopard

Last week I got an e-mail from one of the product managers @ AET Europe regarding the availability of SafeSign / Tokenlounge for OSX Snow Leopard.

The content of the e-mail wasn't very encouraging.... It seems that the Snow Leopard of SafeSign / Tokenlounge release is delayed by a bug in the Apple Keychain;

---------
We use systemkeychain -T to create a login keychain (for a new FV user) associated with our token. When trying to unlock this newly created keychain during login with the smartcard, we get prompted with the "unable to unlock login keychain" panel - as you have observed -.
This is basically our main concern, as this was perfectly running under 10.5. Any idea why the system wants to update the login keychain password, prompting the user with that panel???

What we have discovered beside, is that when you click Create New Keychain on that panel, the keychain gets encrypted with the PIN of the smartcard instead of the RSA key, which is a major security issue (Same behavior if you click Update Keychain Password)...
You can easily verify this last issue by removing your smartcard, launching Keychain Access and entering your PIN code to unlock the keychain...

Once again, we didn't have this kind of problems with Leopard.

As long as this issue isn't resolved, there will be no version for Snow Leopard. The (security) risk is just too big.
-------------

So, we need to be patient, and wait till Apple solves this. In the mean time, when you need the SafeSign software for your every day work, you shouldn't upgrade to Snow Leopard.

Check the follow-up on the original SafeSign post for the availability on the Leopard version of SafeSign / Tokenlounge.

Apple Released OS X Update 10.6.3

Apple released the .3 update to Snow Leopard (10.6) today. You can find this update under the Software Update menu, or on the Apple website as a single (combo) download [.dmg].

The update was ~450MB, and took about ten minutes to install. After the reboot everything seemed to work fine. Some applications (I guess the ones that got updated) reverted back to their default settings. E.g. Firefox wasn't my default browser anymore, but NetNewsWire was still my default RSS reader.

I also thought that QuickTime X (how I dislike that app....) reverted back to its default settings, since my pr0n..... euh movies started opening in different windows. Since I can't find a Terminal command for this on the Internet, I guess that I'm mistaken on that. I might be confusing the excellent QuickTime Pro v7.x with this piece of whatever.
There are no visible enhancements on QuickTime X

An annoyance that got fixed is the deletion on SMB shares (Windows 2003 Server). Without the update, the files got deleted, but the directory they were in stayed behind. When you tried to remove this directory, you got this fancy error code.

The important pieces of software that functioned properly after the update uncluded:

• Adobe Photoshop CS4
• Adobe Lightroom v2.6
• BBEdit v9.2.1

Anyway, (more) updates will follow when I run into unexpected behavior.

Update on Tuesday, March 30, 2010 at 8:42 by Willem

Apple also released a security update for OSX 10.5.8 (Security Update 2010-002). The update (in my case) was 210MB and installed without (a noticable) flaw on my iMac.

Apple Snow Leopard and Filevault

Ran into one of the most annoying bugs in OSX evah.... The earlier versions of OSX had a problem with Filevault and remembering certain default application preferences. This issue is resolved in Snow Leopard, but I ran into another (new) feature.

Whenever I put my MacBook to sleep it closes all running programs and documents (without any save option), and logs me off....
Waking the MacBook back up leaves me with the default log in screen. After the log in, it's like I rebooted the machine...

Need to remember to save before putting it to sleep, or to wander of for a couple of minutes.......

UPDATE: I fixed it. Yesterday I saw a flash of the error reporting tool of OSX while I opened the lid of my MacBook, and before it logged me out on the fly. This meant that there might be some info in the console application.
It turned out there were two applications generating lots of errors. Namely PGP and EyeConnect (some part of EyeTV). Somehow both had come over with the data migration.

After uninstalling PGP manually (because the regular interface didn't work any more) and removing all references to the EyeConnect application everything worked as it should (so far).

UPDATE 2: Never mind the previous cheerful update. LoginWindow keeps crashing. I even reinstalled the compleet OS on a seperate disk and with virtual no apps installed it keeps crashing. So the sleep mode is essentially unusable. I've been thinking of removing the Snow from the Leopard....

Photoshop CS4 and Snow Leopard

Photoshop CS4 was released as an Universal app (system requirements). So both PowerPC (PPC) and Intel support. Since it's an Universal app, you shouldn't need Rosetta on an Intel .
So upgrading to Snow Leopard shouldn't be a problem... Until you're gonna use the droplet functionality of Photoshop CS4. That piece of code still needs Rosetta to function.

So no way that CS4 is Universal. It's just another piece of buggy Adobe software.

What's next? An announcement that this crap won't be supported and that you can upgrade to the >1000USD Adobe CS5 suite next year?

PGP and Snow Leopard

It seems that the current versions of Pretty Good Privacy (PGP) are NOT compatible with Snow Leopard. Incompatibilty issues are are something that mostly occurs on mayor OS upgrades. The upgrades that overhauls the entire OS. But Snow Leopard is merely a fancy service/feature pack. So I have no idea why this would cripple PGP.

The blogposting is of August 27th. 1 (ONE) day before the release of Snow Leopard. And according to the post they are still in some sort of beta stage in the Snow Leopard compatibility development. This raises the following question(s);

• Why aren't they further in the development?
• Have they missed the news that Snow Leopard was on its way (announced somewhere last year)?
• Don't they have access to the developer tools (and associated beta's of the OS)?
• Were they asleep the last couple of months?

Instead of patching the 'old' v9.x of PGP they will release a new (commercial) version 10 which will be compatible with Snow Leopard. This shows the 'real' commitment of supporting the current customers. I'll try to make a list of applications which were incompatible with the release of Snow Leopard, but are pathed for FREE. Just to show that real service still exists.

I'll be keeping my eyes in the mean time on the MacGPG pages (the free implementation of the opensource part of PGP).
No more PGP for me. I'll be heading towards S/MIME and Truecrypt for the time being.

Snow Leopard So Far

The last couple of days have been Snow Leopard only. The Windows 7 hard disk is still gathering lots of dust in the corner.
Even though my Snow Leopard version may not be the final version, it feels solid on most fronts. Finder is even more intuitive. It starts to grow on me :).

I ordered my copy today. You can pre-order Snow Leopard in the Apple Online Store (upgrade costs around 29 euro/USD). With the free shipping it's a bargain (normally you need to spend >100 euro/USD for free shipping). This offer (free shipping) expires on August 27th 2009.

Upgrading to OSX Snow Leopard

I tried to upgrade to OSX Snow Leopard today. 'Tried' is the keyword here. It seems though that the current installment of OSX (Leopard) is installed on a file system supposedly UNSUPPORTED by Apple OSX Snow Leopard.

NOTE: I have no way of knowing if the release I have is the final 'Gold Master'. So it could be that my findings are irrelevant for the actual (official) Snow Leopard OS.
I will however verify my findings when I have the actual 'Gold Master' in my possession.

When you run the installer from the OS (or by booting from the DVD) I get a error message saying that I need a GUID Partitione Table disk to install the new OS on. Somehow I use a different (and unsupported) partition scheme. And I thought that I selected all the best options during the clean install a while back......

There's no way of converting (using Disk Utility and/or Terminal commands) this to the appropriate settings without formatting your hard drive. So a normal upgrade is out of the question for me (or so it seems). And for many others I guess, since I won't be the only one with the 'wrong' partition table setup.

Click to read more ...

Apple Favors Own Products, or FileVaults Screws Up

Apple FileVaultSomething everyone would do I guess (the favoring part at least :) ). But Apple is doing this in a very peculiar way. When you run OSX with a ton of third-party applications you won't notice things, since everything runs as it should. But when you're going to use FileVault, things change. A lot....

FileVault is the way Apple secures your data. When turned on the OS creates a sparse iage of your userdata. So everything stored within your user directory is encrypted using AES-128.

The use of FileVault screws up certain system files. One of those is (or several for that matter) is used to store the default applications. Like FireFox for Internet instead of Safari. Every time you reboot your system the default application settings are read.
This weekend I also found out that at least one handy program also disagrees with FileVault. Little Snitch won't properly save it's registration info when you're using FileVault.

You know what the worst thing is? This BUG is present since Panther (OSX 10.3). I wonder if this is going to be fixed in Snow Leopard. To be honest, I doubt it. If they can't figure it out in 4 years, they probably never will.

As a security savvy nerd I want to use FileVault on my MacBook, but the problems with FileVault made me decide to uninstall this feature. Too bad that there are no other real alternatives. Truecrypt (or PGP) is nice, but it can't encrypt your hard disk (from which you boot) or even your user directory. Check Point seems to have software, but there's no way of buying it easily. So it seems that's it's mainly reserved for corporate environments.

UPDATE: w00t... They solved this annoying 'feature' Apple OS X 10.6 a.k.a. Snow Leopard. Way to go Apple. Although it being several OS releases/years too late!!!!