How unsafe is an old computer online?

I have an aged mid 2010 Mac Pro as a backup computer that is still quite usable, however it is limited to Mojave without applying unofficial patches, which I do not wish to do. Last year I picked up a new Mac mini as my main machine, largely because I knew Apple would stop supporting Mojave with security updates later this year and my rough plan was to take the Mac Pro offline in a couple of months, so it is reserved for tasks like Photoshop.

I am in the process of changing ISP and will require a new router, so I have been looking around and reading up on different options. It seems some routers are more secure than others, so at a certain point I wondered how much of the security is down to the router and how much is down to the OS?

Just to be clear I am not trying to ignore potential security risks, far from it. I just want to understand the process a little better. In theory the Mac Pro should still be safe connecting to my server via FTP and I just need to avoid general usage online.

When you say some routers are more secure than others, what do you mean by that exactly?

For the average home user, the router does not really play any major part in security. They all provide basic "features" which give the effect of security. Simply using different brands of routers isn't going to really change how secure you are other than the reasonably rare occasions where the routers themselves are found to have security issues, even then normally only caused by when the user has turned on administration from the outside world.

In reply to a post by charlestown:

Just to be clear I am not trying to ignore potential security risks, far from it. I just want to understand the process a little better. In theory the Mac Pro should still be safe connecting to my server via FTP and I just need to avoid general usage online.

Yes most likely but bare in mind if your FTP server is encrypted (which it should be) then the protocols used by your older Macbook might not be very strong. I'd say if you are literally just using the computer to connect to a trusted server and nothing much else (i.e not general web browsing) then yes that would be a very low risk. If you start browsing the internet with an unsupported browser on the other hand, you could get compromised very quickly indeed.

This is one of those old cheese grater towers that go on forever and very expandable, though the speed advantage they once enjoyed just isn't there nowadays. Part of me just doesn't want to give up the old beast, which has run so reliably since new and still potentially useful as an offline production machine for a couple more years.

On the other hand, no which way do I want to compromise the security of my setup, especially since it currently has a lot of shared project data stored on iCloud. I suspect it would be possible to continue running current browsers like Chrome or Firefox for quite a while, but I am perplexed when I see Mac users running even older hardware with El Capitan that hasn't been updated in about three years. Running patches to install newer software is filled with compromises as well.

Basically I always need two computers here in the office. One as a main machine and a backup that can also be put to work in the background on tasks like video editing, 3D rendering or photo retouching. The plan was to try and keep this one going until the dust has settled with with new M1 machines.

Regarding the routers I was thinking about Wi-Fi 6 and WPA3, plus having a separate router from the modem. My understanding is that most ISP supplied routers are somewhat compromised.

I think you're going to be fine. WPA2 with a strong password is secure enough. It's not like someone is going to be standing outside your premises for days on end trying to compromise it.

If you're dealing with highly sensitive/valuable information on the other hand which is a target then yes, everything should be completely enterprise-grade and supported including your router etc.

I actually ordered a DrayTek Vigor 130 modem and a TP-Link Archer C2300 router not long ago that should e here tomorrow and hopefully OK. The modem looks like a safe bet and I was unsure about the router but it seems to be highly rated.

Nevertheless I have thought on the Mac Pro and decided it would be better to retire before long. Realistically the only reason I have to keep it here is to run a few old apps like Photoshop CS6, however it seems to be running into more compatibility issues all the time. I cannot really complain after 10 years running practically 24/7.

I think safety all depends on how you're intending to use the machine. It's possible that some native applications on the latest released OS version on the older Mac don't support recent security standards (older versions of Mail don't support TLS v1.2 for example) but third party alternatives can so they should be used instead.

It's also important to ensure that Mac computers which are regularly used to access email or for web browsing should have some sort of antivirus / antimalware package installed. I use a full fat paid version to protect the Macs I use but there are lots of free packages available.

The thing I would be wary of would be running any sort of service on the Mac Pro that you want to be available from the outside world via port forwarding. I run lots of externally accessible servers doing different things but they're all on a separate DMZ so don't have direct access to anything on my LAN. If I want to access anything on the LAN from remotely I need to use a VPN.

You mention;

In theory the Mac Pro should still be safe connecting to my server via FTP

The way I understand this is that you have a remote server which you wish to connect to from the Mac Pro. As has already been mentioned you should only use encrypted SFTP, not FTP, but consider using SCP and SSH to access the server instead - preferably coupled with multi-factor authentication and automatic IP lockout after a very small number of failed login attempts and account lockout after a slightly higher number. You need to consider protecting the server here more than protecting the Mac pro.

As for the security of routers, most domestic grade routers, even high end ones, are pretty abysmal as far as security is concerned - see Fraunhofer Home Router Security Report 2020. Running NAT doesn't protect machines on the LAN from external compromise due to a recently disclosed attack method called NAT slipstreaming so you need to be very careful with router configuration.

Reading that PDF report on home routers was quite depressing and seems like my best protection so far is simply having complex passwords for both wifi and router alike. I also disabled 2.4GHz, since that can be picked up from further away. The DNS settings inside the router have been switched and all sharing turned off.

FTP connections, much like my websites have all been using SSL for years. My web host won't even let me add a domain to the server without SSL, yet I found myself wondering earlier as I set up the new TP-Link router why their login isn't SSL enabled by default. The server is already set up to reject any IP number that fails to connect properly more than a couple times.

Yes I ran into the issue with mail and TLS a couple years ago on an ancient iMac from 2007 running El Capitan that was sitting in a cupboard as an emergency backup. One day my web host changed their minimum TLS requirements and Mail was rendered useless. I briefly tried Thunderbird as an alternative, which did work, however it was clear that very few apps were even compatible at this stage, so it ended up at the local recycling centre after removing the hard drive.

I don't have a crystal ball, so I don't know how long it will be before Mojave runs into such problems, however there are already a few compatibility issues with various apps and that will only accelerate now we have the new silicon processors.

Overall I see waving red flags telling me that none of this is worth the risk or hassle, because you only need one problem to risk spilling over to the entire network as long as it remains online and networked to the other computers. For example I keep work files in iCloud and it's very conveneient when working in a team, but I would be crying if they were accessed through an insecure old Mac.

The Mac Pro could still be a decent machine for rendering 3D files from Maya and also enjoys the ability to run Photoshop CS6, which is still useful, but that is about it. Practically anything else can be done faster and better on a new machine. My hope is that Apple will come out with a second generation M1 Mac mini later this year and then I should be set for 5+ years.

In reply to a post by charlestown:

The Mac Pro could still be a decent machine for rendering 3D files from Maya and also enjoys the ability to run Photoshop CS6, which is still useful, but that is about it.

You might find installing a different OS on the machine (e.g. Windows or Linux) gives you more utility.

For example - I have a laptop over 10 years old with a Core2Duo processor with 8GB of RAM that is running the latest Windows 10 version 20H2, and up to date patches.

I was thinking about that but apparently Photoshop CS6 has issues with AMD graphics cards on Windows 10, which is not the case on Mac. Above all I really don't want to spend any money on this computer as it is now 11 years old.

In general I only use Windows if I have no choice and that is very rare nowadays, but yes it's ironic a Mac could theoretically run Windows with all the latest patches after Apple has already abandoned the same hardware.