Internet Explorer 8, Firefox 3, Google Chrome 4, Apple's Safari 4, and Opera 10 include features that block sites known to host malware and malicious downloads. All but Opera also let you browse without leaving any tracks. But just as important as these protections is ensuring that whichever browser you use is thoroughly patched.
Filtering out bad sites
Firefox's built-in antiphishing tool claims to update its bad-site database 48 times a day, according to Mozilla's Firefox security page. Firefox 3 uses Google's Safe Browsing service to automatically block sites that are known to host malware. The Google Code site describes how Safe Browsing works in Firefox.
To verify that attack-site blocking is enabled in Firefox, click Tools > Options > Security and make sure "Block reported attack sites" is checked.
Firefox will prevent known-bad sites from opening when "Block reported attack sites" is checked.
(Credit: Mozilla Foundation)The same feature is built into Google's own Chrome browser. You can ensure that malware-site filtering is on in Chrome by clicking the wrench icon in the top-right corner, choosing Options, and selecting Under the Hood. "Enable phishing and malware filtering" should be checked. The Google Chrome Help site describes the feature. (Hint: This page looks very similar to the description on the Google Code site.)
Google's Chrome browser blocks known-bad sites when "Enable phishing and malware protection" is checked.
(Credit: Google)The SmartScreen technology in version 8 of Internet Explorer blocks known-malicious downloads as well as bad URLs. Other new security features in IE 8 include automatic blocking of click-jacking and cross-site scripting attacks, automatic crash recovery, and highlighting of the actual domain name in the address bar. The Microsoft Security site describes the SmartScreen Filter and includes links to a SmartScreen FAQ and information for site managers.
Apple's Safari browser added phishing and malware blocking in version 3.2, which was released in late 2008; read about this and other security features in Safari 4 on the Apple Safari site. Likewise, Opera's Fraud Protection predates the phishing and malware filters in IE and Firefox and is enhanced in the latest version 10. But attack-site blocking is only one of Opera's many security features, which you can read about on the Opera site.
Browsing in private
To activate private browsing in Firefox 3, click Tools > Start Private Browsing, or simply press Ctrl-Shift-P. You can set Firefox to start in private-browsing mode by clicking Tools > Options > Privacy and check "Automatically start Firefox in a private browsing session." The Mozilla support site provides more information about this feature. Likewise, put IE 8 in private-browsing mode by clicking Safety > InPrivate Browsing, or by pressing Ctrl-Shift-P. You can also open a new tab and click either Browse with InPrivate or Open an InPrivate Window.
IE 8 also lets you control the information about your browsing habits that's shared with Web tracking services. To activate this feature, click Tools > InPrivate Filtering Settings and choose "Let me choose which providers receive my information." This opens the InPrivate Filtering settings dialog, where you can turn filtering off, choose which services to block from tracking you, or automatically block all trackers.
Internet Explorer 8's InPrivate Filtering lets you block some or all Web tracking services.
(Credit: Microsoft)You can open an incognito window in Google Chrome by clicking the wrench icon in the top-right corner and choosing "New incognito window," or simply press Ctrl-Shift-N. The incognito icon (a shadow figure in a fedora and glasses) appears in the top-left corner of the browser window. The Chrome support site offers a more detailed description of this feature.
Opera lacks an equivalent private-browsing capability but does offer private searching and other identity-blocking features, as described on the Opera site. To activate private browsing in Safari, simply click Safari Settings Menu > Private Browsing.
Automatic and not-so-automatic browser updates
Patching is a way of life with nearly all software, but especially with browsers and the media players associated with them: Adobe Reader, the Flash Player, Apple's QuickTime, and Sun's Java, among others. All of a browser's security features can be rendered useless by a piece of malware that takes advantage of an unpatched hole in the program.
Firefox 3 alerts users to the presence of an update and now also notifies you when your Flash Player is out-of-date. Internet Explorer 8 updates via the Windows Update/Microsoft Update services. Google Chrome made a splash by being the first browser to update itself in the background without requiring any prompting from users. Safari updates automatically via Apple's update service, which also serves up patches automatically for QuickTime, iTunes, and other Apple software. Opera also notifies you automatically when a new version is available.
But updating is too important to leave to others. Back in April, I described Secunia's Online Software Inspector and downloadable Personal Software Inspector, which identify out-of-date programs on your PC. The programs mentioned in that post have all been updated since, but Secunia's services should point you to the most recent versions.
(Note that Secunia sometimes reports a program as being out-of-date when in fact you have the latest version. On my PC, it continually reports my up-to-date Flash Player as being in need of an update, for example. But the free service Secunia provides is worth putting up with this and similar minor annoyances.)
With Internet Explorer 9, Microsoft showed Wednesday it's trying to retake the browser initiative.
IE remains the Net's dominant browser. But perversely, it became something of a technology underdog after Microsoft vanquished Netscape in the browser wars of the 1990s and scaled back its browser effort.
That left an opportunity for rivals to blossom--most notably Firefox, which now is used by a quarter of Web surfers, but also Apple's Safari, which now runs on Windows as well as Mac OS X, and Google's Chrome, which aims to make the Web faster and a better foundation for applications.
Microsoft has been pouring resources back into the IE effort, though, and at its Professional Developers Conference in Los Angeles, some fruits of that labor were on display. In particular, Windows unit president Steven Sinofsky showed off IE 9's new hardware-accelerated text and graphics.
The acceleration feature takes advantage of hitherto untapped computing power in a way that's more useful than other browser-boosting technology--Google's Native Client to directly employ PC's processor and Mozilla's WebGL for accelerated 3D graphics, for example--according to Dean Hachamovitch, general manager of Internet Explorer.
"This is a direct improvement to everybody's usage of the Web on a daily basis," Hachamovitch said in an interview after Sinofsky's speech. "Web developers are doing what they did before, only now they can tap directly into a PC's graphics hardware to make their text work better and graphics work better."
... Read more
Earlier in November, Firefox surpassed 25 percent usage share of Web browsers, according to Net Applications.
(Credit: Net Applications)Mozilla released a third beta of Firefox 3.6 on Wednesday, adding stability and performance features, and said it hopes to lock down the code soon for its first release candidate.
The new beta, for Windows, Mac, and Linux, includes a component directory lockdown that makes it harder for other software to meddle with the open-source browser's state by preventing that software from sidling into the same folder as the browser's own components. The result should be fewer crashes, said Mozilla's Johnathan Nightingale in a blog post, and Firefox still is open to third-party extensions via its official add-on mechanism.
The change should improve security, too, added another Mozilla programmer, Vladimir Vukecevic, who wrote in his own blog post that Mozilla is considering bringing the change to Firefox 3.5, too.
"Creating binary components to interface with the operating system or with other applications is fairly straightforward, though ultimately dangerous. Binary components have full access to the application and OS, and so can impact stability, security, and performance," Vukecevic said.
Also in the latest beta of 3.6 is a feature that lets the browser run some Web-based JavaScript programs asynchronously, which is to say without being so picky about the order the scripts run. This can improve the speed that Web pages load, Mozilla said.
The biggest Firefox 3.6 feature most folks will notice is Personas, the reskinning add-on that's now being built in. More than 10 million Personas have been downloaded so far, Suneel Gupta and Myk Melez of the Personas team said Wednesday.
Mozilla is working to release a final version of Firefox 3.6 before the end of the year, and one sign the project is wrapping up is that the developers are locking down the features and changes that can be added into the release candidate 1. Code freeze for RC1 is scheduled for Wednesday but might be at risk, a Mozilla planning site said this week.
Firefox is steadily gaining in use. Last week, Web traffic monitoring firm Net Applications announced Firefox cleared 25 percent share of those using browsers worldwide--not dethroning Internet Explorer by any means but still winning over new users. Mozilla estimates there are more than 300 million Firefox users total, and this week said there are more than 300,000 testers using the Firefox 3.6 beta
Google's Chrome, meanwhile, is appealing to some of the same browser enthusiasts who were Firefox's first users. One of its big selling points is speed, and Google is working on other ways to make the Web faster, too. Chrome gives it a vehicle to test such ideas out in the real world, a strategy that Apple, Opera, and Firefox have employed to advance the Web state of the art.
One Mozilla programmer, Alexander Limi, revealed a speedup technology called Resource Package for Mozilla, too, on Tuesday. His proposal calls for bundling many Web page elements up into a single compressed file that can be retrieved in a single Web-page request action. Browsers are limited in the number of such actions they can take in parallel, so consolidating the interactions can make pages load faster. The approach is backwards compatible with existing browsers that don't support the feature, he added.
"If the feedback is good we're likely to try and get this implemented for Firefox 3.7," said Mozilla evangelist Christopher Blizzard in a blog post Tuesday.
LOS ANGELES--Although Microsoft intends to talk a bit about its plans for the future of Internet Explorer this week, the company won't offer preview code of its next browser, CNET has learned.
The software maker is also not planning to announce a move to the WebKit engine, as some had speculated.
Ray Ozzie, speaking Tuesday at Microsoft's Professional Developers Conference in Los Angeles.
(Credit: Ina Fried/CNET)In his opening keynote at the Professional Developers Conference on Tuesday, Chief Software Architect Ray Ozzie pledged that Microsoft will make Internet Explorer the absolute best Windows browser, but did not offer further details.
Microsoft is expected to talk more about its browser plans as part of Wednesday's keynote speech. During that talk, he is expected to talk about some--but not all--of its "focus areas" for the next browser version, a Microsoft representative told CNET.
The latest version of IE 8 was released in March and is also built into Windows 7. Despite the new release, though, Microsoft faces intense competition from Firefox as well as from Google and Apple.
In addition, Microsoft has struggled to get Internet Explorer users to move past IE 6.
There's no way to reduce to zero your risk of picking up some piece of malware while browsing. You need layers of security to keep viruses, Trojans, and botnets at bay—the more layers, the safer your browsing. (Of course, the more layers, the slower your browsing, too, so don't get carried away.)
Much emphasis has been placed on the enhanced security features of the latest versions of the popular browsers. Whether one is any safer than another is anybody's guess, but no browser gives you more ways to thwart a Web-based attack than Firefox via its wealth of security add-ons.
Link checkers add warnings to search results
Search results are often difficult to trust, even when the URL looks familiar. Phishers are adept at planting dangerous links that look like harmless ones. Link checkers provide you with an indication of the trustworthiness of sites before you click their links. (Note that several of the products are available for Internet Explorer as well.)
Some of the programs, such as McAfee's SiteAdvisor, give the thumbs-up or thumbs-down based on a single company's research. Web of Trust (WOT) bases its recommendations on the collective intelligence of a network of volunteers. LinkExtend is a link-check aggregator that combines the analyses of eight different services.
McAfee SiteAdvisor adds a safety indicator to Web search results.
(Credit: McAfee)While the recommendations of link checkers are helpful in identifying safe sites, you can't take their yeas and nays as gospel. For example, sites that offer downloads of system utilities may be flagged as dangerous because the programs require access to the operating system and thus could do major damage in the wrong hands.
Track the trackers
You know popular Web sites download software that tracks your activities on their sites, but do you know who's doing the tracking? Find out with the Ghostery add-on that pops up the names of the trackers as the page opens. The program puts a small "ghost" icon in the bottom-right corner of the Firefox window that turns orange when trackers are present. Click the link that appears to the right of the icon to find out more about the trackers and block them individually or entirely.
The Ghostery Firefox add-on lets you know who's tracking your activities on the site.
(Credit: Ghostery)
View encryption specs
When you open an encrypted Web page, a lock icon appears in the bottom-right corner of the Firefox window and the URL in the address bar begins with "https." But there's more than one form of encryption, and knowing which type and strength of encryption in use can be handy.
The CipherFox add-on puts in the bottom-right of the Firefox status bar the Secure Sockets Layer/Transport Layer Security (SSL/TLS) cipher and keysize currently in use. Double-clicking the entry opens the CipherFox dialog box, where you can disable RC4 encryption and display partial SSL/TLS. (Note that the developer accepts donations to support the product.)
Take charge of Web password management
Firefox's built-in password manager lets you create a master password and remember passwords for specific sites, but if you want to get serious about managing your passwords, get LastPass, a password manager that provides much more granular control over your sign-ins.
After you download and install the add-on, an icon is placed in the top-right corner of the Firefox window. Click it to open the LastPass menu, which lets you manage your identities, open the LastPass Vault, jump to favorite sites, and generate secure passwords. You can also import or export sign-in IDs, compose and print secure notes, and assign keyboard shortcuts for specific actions.
In addition to Firefox and IE, LastPass is available for Google Chrome and Apple's Safari browsers. LastPass backs up your passwords by storing an encrypted copy on its own servers. And because you can access your passwords via the Internet, you can use LastPass on any Web-connected device, although use of LastPass on an iPhone or other smart phone requires a Premium membership, which costs $1 a month. (You can also put LastPass on a USB thumbdrive for use with Firefox Portable and other portable apps.)
Mozilla, racing to release Firefox 3.6 before the end of the year, has released a second beta of the open-source browser for Windows, Mac, and Linux.
Firefox 3.6 beta 1 introduced most of the new features, most visibly the ability to customize Firefox's look through Personas, less than two weeks ago. But among the 190 patches in the new beta is what Mike Beltzner, Mozilla's director of Firefox, described in a blog post as "a mechanism to prevent incompatible software from crashing Firefox."
There also are a number of deeper changes in Firefox 3.6 that Web developers likely will be more interested in. Note that one of them, the ability to use color gradients with formatting technology called Cascading Style Sheets (CSS), has changed syntax in between Firefox 3.6 beta 1 and beta 2.
Mozilla is trying to accelerate the pace of Firefox releases; Firefox 3.7 is set for release in the first half of 2010 and 4.0 some time later that year. The project faces new competition from Google's Chrome browser.
Five years ago, Mozilla made it clear that the browser wars weren't over after all.
In the 1990s, Netscape had lost its dominance in the browser market to Microsoft's Internet Explorer, and the Netscape-spawned open-source project called Mozilla had sunk into obscurity. Even a federal antitrust suit accusing Microsoft of anticompetitive practices with its browser and Windows was not enough to turn the tide.
But on November 9, 2004, Firefox 1.0 emerged to fight back again.
The project, originally named Phoenix to symbolize rebirth from Netscape's ashes, has now clawed its way back to account for nearly a quarter of the browser usage today. Microsoft may not be on the run, but it's on the defensive, gradually building its browser development effort back up into fighting form.
... Read moreIt's been a few days since Opera unwrapped its latest beta browser for mobile phones, and we've had some more time to get acquainted. Opera Mobile 10 beta (download), which runs on certain Symbian Series 60 smartphones, adds some improvements to its password manager and has made a few tweaks under the hood. However, its most significant alterations are in its visual design. Bottom line: We like it, and we like how similar it is to Opera Mini 5 beta, a recent overhaul of the free Opera browser for Java phones.
There are some downsides with the version 10 beta browser that have cropped up--these go beyond the known issues and bugs. Opera's smartphone browser continues to struggle with accurately rendering complex pages. When zooming in on CNET Download.com on the Nokia N97, we saw text and graphics overlap. While Web sites often redirect to a URL optimized for mobile phones, we'd still like to see graphically rich pages rendered more faithfully in Opera Mobile on those that don't have specialized versions.
Its responsiveness was also an issue on the Nokia N97 test phone, but we suspect this has more to do with the device than with Opera. CNET reviewers dinged the Nokia N97 for its choice of an inconsistently responsive resistive touch screen instead of the capacitive touch screen that's found on the iPhone.
Even if you don't have a compatible Nokia, Samsung, or Sony Ericsson phone to test Opera Mobile 10 beta with yourself, you can watch our First Look video to see the new browser beta's features--its new tabs interface shines.
... Read moreWith a project called Closure Tools, Google plans on Thursday to start helping developers who aspire to match the company's proficiency in creating Web sites and Web applications.
Google is a strong proponent of using JavaScript to write Web-based programs, part of its Web-centric ethos. Indeed, the company has pushed the language to its limits with services such as Gmail and Google Docs, and it developed its Chrome browser in part to enable JavaScript programs to run faster.
But writing, debugging, and optimizing heavy-duty JavaScript can be difficult--in part because a given JavaScript program sometimes works differently on different browsers. Google's open-source Closure Tools project is an attempt to help with some of these challenges.
The first in the suite of tools is the Closure Compiler, a software package designed to boil down a JavaScript program so it's smaller and runs faster. For example, a function named DisplayAddress() could be replaced with just a().
Along with the compiler come some extra tools that run in the Firefox browser. One, Closure Inspector, is an extension for Firefox's Firebug add-on designed to help programmers understand and debug the rewritten JavaScript--linking a() back to DisplayAddress(), for example. Another add-on for the Google Page Speed extension lets programmers see how much the compiler helped.
Google also plans to make the compiler available as a Web application hosted on its Google App Engine service.
The second element is called the Closure Library, a collection of prebuilt JavaScript code that lets programmers handle relatively sophisticated technology--arrays and string manipulation, for example.
Last are Closure Templates, more prewritten code to ease creation of JavaScript and HTML user interfaces.
In an earlier era, programming tools were expensive packages bought by a select few, but open-source software, new marketing strategies, and new business methods have made that approach the exception rather than the rule these days. Now programming tools are often a means to another end--encouraging programmers to produce the software that will make Windows or the Palm Pre useful and therefore popular, for example.
In Google's case, the objective is often to make the Web more popular because it sees more activity on the Web as corresponding directly with more activity on its revenue-generating search site. Among the high-profile projects to this end are Chrome, Chrome OS, and Android, all subsidized by Google's powerful search-advertising business.
One interesting contrast to Closure is another Google project called Google Web Toolkit. It's designed to accomplish some of the same goals as Closure, including paving over browser incompatibilities and producing high-performance JavaScript. But with GWT, coders write programs in Java that gets translated into JavaScript.
So one last question: why the name?
Google's reply: "Being a functional language, the concept of a function closure is fundamental to the JavaScript language."
More people will get a chance to try out bookmark synchronization with Monday's release of a beta version of Google Chrome for Windows.
Google introduced the bookmark sync feature for the developer-preview version in August, but now it's also in the better-tested beta version, Chrome 4.0.223.16. However, there's still no Chrome beta for Mac OS X or Linux.
In a video explanation, Google's Anthony LaForge somewhat breathlessly describes how the sync feature can keep bookmarks the same on multiple machines. That's a fair point, but let's be realistic here--bookmark sync in Chrome is more catch-up than paradigm shift. Indeed, with the popular Xmarks extension--in the works for Chrome, people can synchronize bookmarks among multiple browsers, not merely multiple computers.
And Chrome's clever message-based sync technology notwithstanding, Chrome bookmarks would be a lot more magical if they synchronized with the Google bookmarks service, which is linked with iGoogle and the Google Toolbar.
Speaking of extensions, one of the 4.x series' biggest features is the ability to accommodate extensions, but because Google is shifting the extensions interface, the feature isn't enabled in the beta version. Chrome is released in three versions: the roughest, fastest moving developer preview, the more stable beta, and the stable edition for the broadest audience.
The 4.x series has other significant features, too, though it's not clear whether they'll arrive in the beta or stable versions. One is Google's Native Client, which lets JavaScript applications take more direct advantage of a PC processor's horsepower through a careful security mechanism. Another is WebGL, a 3D interface that does the same with hardware-accelerated graphics.
Together, the features have the potential to dramatically improve the power and sophistication of Web-based applications. That's particularly interesting given that Google is building Chrome OS, a browser-based operating system.
The Mac version isn't in beta yet, but it's a priority.
"Our goal for this Friday is to be able to count our Mac P1 M4 release blocker bugs on one hand (we're in the 20s now)," said Chrome programmer Mike Pinkerton in a mailing list announcement on Monday. P1 bugs are priority-one; M4 refers to milestone 4, or version 4.0.
And Google is willing to put more manpower onto the Mac version, he added. "Everyone should have their P1 list practically at zero by the end of this week. If you are not going to be able to reach this, let me (or other triage folk) know ASAP so that we can get you some help.
Chrome edged up to 3.6 percent of browser usage for October, its highest showing so far in Net Applications' statistics since the browser's first public release 14 months ago. That's within striking distance of third-place Safari at 4.2 percent, but still well short of second-place Firefox at 24.1 percent and dominant Internet Explorer at 64.6 percent.
Chrome has helped fan the browser war flames even without becoming dominant, though. In particular, it's helped increase the emphasis on performance such as the speed to load the software, load Web pages, and run Web-based JavaScript applications. Here, more than with bookmark sync, Google's chest-thumping has some merit:
"As with every release, this new beta comes with many speed improvements. In particular, as Web applications we use every day become increasingly dynamic, browsers like Google Chrome need to be able to construct and change elements on web pages as fast as possible," said programmers Idan Avraham and Anton Muhin in a blog post. "We've improved performance scores on Google Chrome by 30 percent since our current stable release, as measured by Mozilla's Dromeao DOM Core Tests, and by 400 percent since our first stable release."
There has been some slowdown with the arrival of Chrome extensions, though, so Google will have some more optimization work to do to keep the browser in fighting trim.
Updated 9:57 p.m. PST with further details on the Mac OS X beta priority.
