It’s nice to see a bit of Safari love around here. Some sites occasionally break, but I really like the macOS/iOS integrations. SMS code autofill on desktop Safari (via Mac <-> iPhone communication) is pretty awesome.
The one thing I cannot stand is that fucking URL/search bar (I detest these things in general, but Safari has the worst implementation). Most implementations (e.g. Firefox and Chrome) will encode the space and go on their way, meanwhile Safari translates a space into a search unconditionally — because clearly I want my wikipedia viewing history to end up in my search history FFS. I'm also not a fan of view source opening in a dev tools frame versus a new tab/window like Chrome and Firefox.
Speaking of the dev tools, I was just poking around and saw this in the console:
[Info] Successfuly preconnected to https://securepubads.g.doubleclick.net/
[Info] Successfuly preconnected to https://aax.amazon-adsystem.com/
Interesting as I'm running uBlock Origin (which is, admittedly, more neutered on Safari). I know I've disabled that prefetching before, but I no longer see any options to turn it off. Speaking of UBO, Safari loves to claim UBO will increase energy consumption and slow down my browsing (HA). I wonder if the "disable plugins to save energy" option means that Safari will kill uBlock whenever it feels like. :/
What would you rather have it do? URL encode it?
Yes. I missed a few words on the original edit.
No, that's not what GP means. If the attacker manages to get malware on the Mac, for example by exploiting a browser 0day, then the attacker can simply circumvent the 2FA by making the Mac fetch the 2FA code. The user won't notice it.
Really, the SMS part is the actual weak link in the chain. Easier to hijack SMS than own a computer or phone.
That depends on the country, in Germany it's way more difficult.
Also, if you have touchID then you can use it on safari to autofill login credentials. I just wish safari had an active plugin ecosystem like firefox (or chrome) does.