What is Safaritool?

Hi Wellard,

'safaritool' is located here: /System/Library/CoreServices/SyncServer/Contents/Resources/safaritool

As far as I can tell it's used during the syncing process between your .mac account and your Safari bookmarks, so this is where to look. Check Safari's prefs, 'bookmarks' tab and perhaps fiddle with the checkbox at the bottom. Check the password details in your 'Keychain Access' app found in /Applications/Utilities and also perhaps log in to your .mac account and have a look in there as well.

I wouldn't delete it, that's almost certainly going to cause more problems than it solves. If you want to see what happens then you could try renaming it to something like 'safaritool.deactivated' but be very careful messing around inside packages, especially system ones.

Something you could try if you haven't already is this tip by Marcia G. in this thread:

Open your .Mac preferences in the System Preferences.
Choose advanced pane.
Press Reset Sync data...
Set Replace to your bookmarks
Choose the direction .Mac to your computer and press replace

Just ignore the last two steps and make sure it isn't set to do anything with bookmarks after the reset.

Have you ever set it to sync your bookmarks? It seems like something's stuck...

If you can find the right keychain entry then I suppose you could change it's access to "Allow all applications to access this item" which would probably stop it asking you every time, but this seems a bit of a security issue if you can't find out why it's asking...

Apologies for not being able to offer anything else (I don't have a .mac account to test with unfortunately).

It is very odd. I've nothing really left to offer and searches of these forums and the net in general don't yield many hits which also suggests it's a bit of an oddity.
From what you've said happens it definitely seems to be related to .mac and sync services in some shape or form, especially as 'safaritool' is involved in this process.
I guess you could try reposting in the isync forum here or one of the .mac ones here.

A common troubleshooting tip is to test the behaviour in another (new) user account on your machine. This helps to pin down whether the problem is isolated to your own account or is system-wide.

Have you ever let it access the keychain? Maybe if you let it once it'll stop asking! ;D

Keep testing your system to see if you can find out any other clues as to why this is happening and post back if you notice anything else.
I'll keep my eyes open in the meantime.

Another thing Wellard, have a look in the iSync.log file in Console.app (found in /Applications/Utilities). If you haven't used it before, click the 'Logs' toolbar icon in the upper left corner to show the logs list and then navigate through ~/Library/Logs to 'Sync'.

Look for any error messages or other clues to why it's being called.

That is interesting.
When I fire up iPhoto, it attempts to make a connection to 'configuration.apple.com'. Perhaps this has something to do with the subsequent effect on Safari attempting the sync.

There's gotta be a setting somewhere that is governing all this behaviour. If I type in 'sync' into the search box in system prefs, one of the options that comes up is 'Stop .Mac synchronization' - where does that take you? (I can't get anywhere with this on mine due to the absence of a .mac account).

I was going crazy with this one, and still am, since it hasn't been resolved. I was very suspicious as well when I got this dialog box from safari tool asking for permission to access the keychain. Glad to finally see someone else with the same annoying issue. Apple has never offered any good response to this habit, I know, becuause I've called more than once and unfortunately I seem to get less and less educated (apple system related) folks on the line. I did read that it can be prompted after clicking on the item that utilizes it, i.e. bookmarks. Which I had done this time. I never made the connection because it was delayed in showing up. I've tried using the "allow once" as well as "deny" and it keeps coming back with the "always allow" highlighted and pulsating...a hint I guess. I totally agree with the original poster here, that I would like to know what my computer is doing in the background. I have a .mac account as well, and the same, I don't have any syncing features enabled except for address book. Aye carumba. hope this helps bring some dialog to this mystery. For now, though at least it's occuring on two or three independent systems which may suggest it's not a malware program.

I just received this same response upon opening my preferences in Safari. Looked in "Console" and I saw the following two responses timed at the moment I saw and denied the request for access:

2006-04-25 00:23:16.041 safaritool[339] [DML PAPILogging DotMacSessionProxy.m(237)] Error creating LightweightReplicantLoginSession: NSError "Unable to access your .Mac user name or password. Please verify your .Mac member name and password in the .Mac preferences in System Preferences." Domain=DotMacProxyErrorDomain Code=-103 UserInfo={
NSLocalizedDescription = "Unable to access your .Mac user name or password. Please verify your .Mac member name and password in the .Mac preferences in System Preferences.";
}
2006-04-25 00:23:17.958 safaritool[339] [DML PAPILogging DotMacSessionProxy.m(237)] Error creating LightweightMallornLoginSession: NSError "Unable to access your .Mac user name or password. Please verify your .Mac member name and password in the .Mac preferences in System Preferences." Domain=internalMallornErrorDomain Code=5012 UserInfo={
NSLocalizedDescription = "Unable to access your .Mac user name or password. Please verify your .Mac member name and password in the .Mac preferences in System Preferences.";
}

What is "LightweightMallornLoginSession:?" Sounds strange to me. Don't consider myself any kind of expert user, just know I've used Macs for years without any malware and yet I'm a bit nervous as of late having read that Macs aren't quite as "secure" as we of the faith have thought/proclaimed them to be. Not sure how much validity there is that claim, but...just made me a wee bit nervous and now... this! Hope I'm just paranoid and someone can say what's going on here. Just updated some Java software from Apple this afternoon and turned on some kind of sharing (can't remember what) a few days ago. If I recall, I'll post. Hope someone can shed some light here.
Thanks,
Lugano2015