Recently, possibly after an automatic update, Safari has been frequently showing a mystery sign-in popup. The cancel button makes it go away. Only happens in Safari. Yet another reason to switch to a different browser, so I’m currently using DuckDuckGo.
I’m on Ventura and have run both Malwarebytes and DetectX Swift with no results. I can’t come up with an online search that yields anything useful either. I don’t think I’m the only one, because it popped up when I was working with a client on her computer recently.
Maybe it will show its URL in History after Cancel?
Scan for malware. Lots of discussions here on what malware scanner to use.
Check if you have any Extensions that you do not recognise.
No URL.
I already use two malware scanners, and I won’t add another until I get some feedback from someone about what this might be.
I did check all my extensions, of which I have very few.
Just so you know, Phil Stokes, author of DetectX had this to say in his Slack channel just last week: "…but it’s well past its ‘use-by’ date for anything other than a back-up/supplementary tool.
You could try entering a false name and password and select Remember this password. Then have a look in the Keychain app for that user name. It might show you a URL or app.
I have my local network set up differently now, but if I am remembering correctly, that log-on window looks like the window my previous Wi-Fi router presented whenever I wanted to check its settings or do other administrative tasks via Safari.
It does look exactly like my router login also, except my router (Netgear) actually says “Sign in to ‘nnn.nnn.n.n:nn’” (that is, the actual IP number and port), and it has never spontaneously prompted for a login.
Could Colleen’s be prompting to login for an update? If so, I still don’t think I would check by clicking through an anonymous login prompt.
This dialog is presented by Safari whenever a web page requests basic authentication in order to display content.
For example, on my personal web server, I just created an .htaccess file (directing Apache to ask for a user name and password) for authenticating a page. When I visited it with Safari, I got:
The blacked-out section of the dialog is the hostname portion of the URL.
The real question here isn’t the dialog itself, but why you’re seeing it without any hostname. This tells me that whatever is requesting authentication is not a web page. Maybe it’s from a browser extension (maybe to see if your subscription is paid-up). Pull up Safari’s Settings dialog and go to the “Extensions” tab. Try disabling them all. If that makes the mystery authentication dialog go away, then try adding them back one at a time until it reappears. That’s the culprit.
Probably. Many (especially older) routers use basic authentication for access. Those that do will present that dialog.
I’m seconding that it’s not Safari, but maybe a wifi login or something. (Though it does seem odd that it’s not happening with other browsers.) It’s been my experience that everything shows up in history, even the quick popovers, popunders, etc that show up on some sites.
Are you using a wifi hotspot that you control, or something outside (e.g. coffee shop, airport), when this happens?
