Ilya Kozhevnikov

Browser Newsletter #24

April 27, 2008

Apple, Mozilla Plug Critical JavaScript Browser Flaws

Critical JavaScript security flaws have been patched in both Apple, Inc.’s Safari Web browser and Mozilla’s Firefox browser. But Mozilla and Thunderbird could be vulnerable in some instances. Apple also patched a flaw in Safari 3.1.1 for Windows. The Safari hole allowed Charlie Miller to hack the MacBook Air at the CanSecWest conference.

iPhone’s Safari browser simplifies phishing, researchers say

According to Yuan Niu, Francis Hsu, and Hao Chen from University of California who presented a report at Usability, Psychology, and Security Conference 2008 in San Francisco, iPhone’s Safari browser, along with the Nintendo Wii’s Opera browser, simplify phishing.

“Phishing” is a process used by many Internet criminals to collect personal information that tricks users into typing in their personal bank/online wallet/etc account information, while thinking they’re visiting a legitimate website. “Phishing” is most commonly achieved by sending a bogus e-mail to the victims, asking them to “update” their personal information at a malicious site that resembles the original site, but that is especially meant to log logins and passwords (which can then be used by the culprits to withdraw your hard earned funds).

PayPal Gives Safari Users a Break Despite Security Shortcomings

PayPal hinted last week that it might enact some strict new rules for web browsers visiting the site. Among the requirements would be some sort of built-in phishing protection and support for Extended Validation (EV) certificates, both of which are designed to reduce fraud.

However, Apple’s Safari browser doesn’t ship with phishing protections and thus far doesn’t support EV SSL certificates which would seem to mean that Safari users would be banned from PayPal’s site.

While many assumed that since Safari fails to meet PayPal’s new standards, it would be a candidate for exclusion, PayPal says that’s not the case. In an e-mail to Computer World a company spokesperson writes, “we have absolutely no intention of blocking current versions of any browsers, including Apple’s Safari, from our Web site”

Flock Announces Eco-Edition of Award Winning Social Web Browser

Flock, the innovative social web browser, today announced the availability of the Eco-Edition of the Flock browser that delivers the latest environmental and sustainable living content to eco-minded social media and web users. The Eco-Edition is based on the latest version of the award winning Flock browser, and comes pre-populated with best of breed news, photos, videos and feeds from leading eco content partners across the web.

Read more…
© The Earth Times, 22/04/08

Firefox 3 Bookmarks (My god, it’s full of stars…)

Firefox 3 introduces a few new features to bookmarks that I think makes them much, much easier to use, more useful in general, and much more useful in particular for catastrophically disorganized folk like me. The three main features being introduced are: Bookmark Stars, Bookmark Tags, and Smart Bookmark Folders.

about:mozilla - Firefox 2.0.0.14, Camino 1.6, Privacy policy, AMO, Security metrics, and more

As part of Mozilla Corporation’s ongoing stability and security update process, Firefox 2.0.0.14 is now available [...]

The Camino Project is proud to announce Camino 1.6, a major update to the Camino web browser. This release includes a number of new features and improvements, including a customizable toolbar search field, a find bar, software update, a scrolling tab bar, and enhanced AppleScript support. [...]

Madhava Enros, User Experience lead for the addons.mozilla.org (AMO) redesign, has posted a detailed discussion about the reasoning behind and road ahead for the AMO 3.2 release. “In the 3.2 redesign, our goal was to improve the experience for people new to the idea of add-ons as well as the large and growing set of people who want to stop in, quickly find something to improve their online experience, and be on their way again. All of that said, … [a] successful AMO must support add-on developers and those advanced users who are at the forefront of add-on testing and reviewing.”

Live Mesh: First Look at Microsoft’s New Platform

The new Live Mesh service that just launched as an invite only “technology preview” is Microsoft’s attempt to tie all of our data together. Live Mesh synchronizes data across multiple devices (currently just Windows computers, but theoretically it will extend to mobile and other devices in the future) as well as to a web desktop that exists in the cloud. [...]

Perhaps the most interesting bit that Microsoft demoed to us was an offline compontent of the Mesh platform. Web apps using the Mesh platform will be able to lean on the client software to take their web applications offline, including all user data, and sync it up when the user gets back online at a later time.

Now your mobile phones get to take some Acid

Dominique Hazael-Massieux, co-chair of the Mobile Web Test Suites Working Group at the W3C, has published a test in the spirit of the ACID tests: Web Compatibility Test for Mobile Browsers:

That test, in the same spirit as the ACID tests, combines in a single page tests for 12 Web technologies, ranging from well-deployed (but often poorly implemented on mobile devices) technologies such as HTTPS and PNG, to technologies we believe will matter in a year or two (like SVG animation and CSS Media Queries).

The Next Browser War

A brand-new crop of browser betas gives us a glimpse of what Web surfing will be like when IE, Firefox, and Opera release new versions later this year.

WebKit GTK+ port passes Acid3 on Linux

The GTK+ port of WebKit is the first open source HTML render to fully pass the Acid3 test on the Linux platform. WebKit, which is Apple’s increasingly popular fork of KDE’s KHTML rendering engine, is used by Apple’s Safari web browser and the iPhone. The GNOME desktop environment’s Epiphany web browser has also adopted WebKit and will be using it instead of Firefox’s Gecko rendering engine in a future release.

The Acid3 test evaluates compatibility with a wide range of web technologies (some of which are quite obscure), including SVG, advanced CSS features, DOM Level 2 support, XML capabilities, and certain JavaScript functionality. The test was created earlier this year by Ian Hickson with help from volunteer contributors who assisted with several of the subtests. A recent Internet Explorer 8 beta passes only 18 of the 100 tests, a Firefox 3 nightly build passes 71 of the tests, and a recent development build of KDE’s KHTML renderer passes 73 of the tests. Like WebKit, experimental builds of Opera’s rendering engine also pass all 100 of the tests on Linux.

Mozilla: Fennec to Revolutionize Mobile Browsing

Fennec, the mobile version of the Firefox browser, will simplify and enhance Web browsing on cell phones and usher in an era of intense developer innovation, the chairman of the Mozilla Foundation and of Mozillla Corp. said Thursday.

Access to data, sites and applications on the Internet shouldn’t be limited by the type of device being used, and Fennec will make that possible, said Mitchell Baker during a keynote speech at the Web 2.0 Expo in San Francisco.

Firefox reached 29% share in Europe

XiTi Monitor has released the latest numbers on browsers utilization in Europe and the rest of the world, announcing it has reached about 29% in March 2008.

Finland, Poland and Slovenia keep leading the pack with 45.9%, 44% and 43.7% respectively. Considering other browsers including Safari and Opera probably have a strong presence in Europe as well, it could also mean that Firefox is used even more than Internet Explorer in those same countries.

Opera Desktop Beta 2 (Kestrel) now available for download

Opera today unveiled the second beta preview of the forthcoming Opera 9.5 desktop browser, code-named Kestrel. The new beta improves on security, speed and performance, while refining some of Opera ’s most popular features.

Web 2.0: Firefox Key To Open Mobile Web

Mozilla chairman Mitchell Baker on Thursday called on developers to bring the same features, functionality, and passion to handheld devices as they have to the PC, using the Firefox browser as the model.

“We should be able to access it, mix it up, mash it up, save it, store it. All of those things should be the same if I am on a laptop or phone, at home or on a train,” Baker said during her keynote at the Web 2.0 Expo in San Francisco.

IETester

IETester is a free WebBrowser that allows you to have the rendering and javascript engines of IE8 beta 1, IE7 IE 6 and IE5.5 on Vista and XP, as well as the installed IE in the same process.

Firefox wins Webware 100 2008!

Duh-factor aside, Firefox was among the top 10 voted products that amounted for about half of the 1.9 million votes, so at least it was one of the most voted browser, despite Maxthon’s tricky tactics.

Hackers Focus Efforts on Firefox, Safari

Many people are switching from Internet Explorer to alternative browsers such as Firefox and Safari. Though that might make them feel more secure, the shift has also opened new doors for bad guys.

Case in point: We have no IE bugs to report this month, but both Firefox and Safari have been hit hard.

In a somewhat dubious recognition of Firefox’s growing popularity, hackers have focused their attention on it, leading to a rash of newly discovered holes. The folks at Mozilla recently released two Firefox updates in less than six weeks, fixing a total of five critical security vulnerabilities. All five can be exploited by planting a poisoned JavaScript file in a Web site and waiting for you to stumble across it.

This entry was posted on Sunday, April 27th, 2008 at 12:39 am and is filed under Browser Newsletter. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.