Migration Assistant Security Issue

Having said that, why does Apple not explain the problem as you did?

😆

Apple is averse to explaining anything. Everything should "just work". If something needs instructions or even an explanation it's too complicated.

Admittedly that is somewhat of an exaggeration but it encompasses Apple's design philosophy on many levels. Adding their near-maniacal approach to security frustrates many people interested in more than the most superficial details. Merely asking about system security is often greeted by a brick wall of silence.

On that subject Ethernet is always preferable to wireless, but it's obviously much less convenient. Apple is all about convenience.

The macOS application firewall is appropriate for use if there are other client users of the local network used for the transfer.

If you performed the transfer wirelessly, on a wireless network that you own and control, one protected by a secure password, using a router that is similarly protected from alteration or malicious interference, then the firewall serves no useful purpose because its traffic remains within that network. Nothing goes beyond your router, assuming again that router is under your exclusive control and its firmware has not been maliciously altered.

Those are a lot of caveats but the point is the application firewall is only one component of what must be a multilayered security strategy. The breach you describe would concern anyone, but there is a lot more to it than that. By itself, the application firewall is just a nuisance and provides little in the way of security. It is primarily a marketing feature. That is not an exaggeration.

To report a security vulnerability to Apple read Report a security or privacy vulnerability - Apple Support. No one on this website can do anything about it.

gordonreed wrote:

Thank you for your response. I believe I understand the problem. However, my degree is not in IT, and I am 78 years old. Having said that, why does Apple not explain the problem as you did? The only advice by Apple when using Migration Assistant is to make sure both computers are on the same internet service using the same OS. I am sure others do not have the information you presented. It remains a security issue Apple should and must address. If using wire connections is the safe way to proceed, Apple should endorse that procedure.

Are you saying you used Migration Assistant over a public WiFi network?

If not, and you were on your own private WiFi network, that's not how your credit card information was stolen.

I don't even think that information could be lifted from Migration Assistant traffic on a public WiFi.

gordonreed wrote:

Yes, I was on my own private WiFi network, I use Xfinite or Comcast which is suppose to have an internal security system. I really do not know how they could access my system or break into my system without the firewall being off. I know very little about IT but thought Apple was pretty secure. Maybe I sould buy my own security program? Thank you for responding. All the information helps.

If it were possible to break into you Mac through your NAT router, the Application Firewall in macOS would not have stopped anything. A firewall is not a security tool. It is a network management tool to isolate parts of the LAN from other parts and devices.

Barney-15E wrote:

A firewall is not a security tool. It is a network management tool to isolate parts of the LAN from other parts and devices.

👍

Whoever came up with that name either regrets it, or ought to. It's horribly misconstrued. No wonder, since there is no fire and there is no wall.

Well said and 110% correct!