In an interesting turn of events, Apple's .mac iDisk service has included a security flaw for some time now. It seems that the web interface for the iDisk service does not include a log off button, so anyone wanting to clear the browser of their login credentials must close the browser. Unfortunately, that does not actually fix the problem because anyone can re-open the browser and search through the browser cache to get access to the person's iDisk.

Apple has been notified of the problem and their only noticeable response has been to delete any reference of the problem from their support boards. The funny thing is that this is being called a minor security flaw by most people. I would say that it is pretty major if it risks allowing someone from a public terminal access to your company files.

What does this mean? Well, to be safe, never access your .mac service from any public computers. Also, if you have already done so, see if you can delete the browser cache (temporary internet files) from the computers you accessed it on.

Data Lodge has the capability of web access to the backup system for individual or multiple file access. We achieve this through a java applet that is certificate protected and password protected. Our system is secure and allows for the manual log off process. While we do allow for widescale use of this feature at the moment, we will roll this feature into our new 2.0 version of the website to allow our clients the freedom of accessing their files from anywhere.

The original notice comes from slashdot: http://it.slashdot.org/article.pl?sid=07/12/16/0055211

-The Concierge

---