browser
Symbian^3 reviewed in exquisite and ruthless detail by Eldar Murtazin
Source: http://www.engadget.com/2010/06/24/symbian-3-reviewed-in-exquisite-and-ruthless-detail-by-eldar-mur/
No folks, those mythical N8 review units still aren’t on our doorsteps, but we can offer you the next best thing: a thorough (we mean thorough) overview of the Symbian^3 environment that will be front and center on Nokia’s next great phone. Eldar Murtazin of mobile-review reports on everything from the sophisticated handling of contacts and caller ID pictures, through the noticeable speed improvements, past the limited utility of online widgets that display only two lines at a time, beyond the “weak spot” web browser, and all the way to Symbian’s unhealthy habit of “clinging to continuity.” It’s an enlightening read, which pulls no punches with its conclusion: Symbian^3 is an evolutionary step up from S60 5th edition, which brings nothing new to the market and offers no comparative advantages. Strong words from Eldar, paricularly when he doesn’t disclose what build of the OS he’s using; his rationale, however, is that his analysis relates to overarching design decisions and ignores software bugs and version-specific foibles. Make of that what you will.
[Thanks, scotsboyuk]
Symbian^3 reviewed in exquisite and ruthless detail by Eldar Murtazin originally appeared on Engadget on Thu, 24 Jun 2010 06:15:00 EDT. Please see our terms for use of feeds.
Permalink |
mobile-review | Email this | Comments
Tags: analysis, browser, caller, caller id, Center, comparative advantages, conclusion, continuity, design, design decisions, detail, display, doorsteps, Edition, EDT, Eldar, email, Engadget, environment, everything, evolutionary step, foibles, front, habit, handling, Jun, market, Murtazin, nbsp, Nokia, nothing, online, overview, Permalink, phone, punches, rationale, Read, review, scotsboyuk, software, software bugs, Source, speed, speed improvements, Spot, step, Symbian, thing, Thu, time, unhealthy habit, use, utility, way, weak spot, Web, web browser, widgets
More and more tools to block ads and other “distractions”
As more and more users adopt tools to de-clutter web pages and remove all distractions (such as ads) the effectiveness of display ads will continue to decline, despite innovations and advancements in targeting technologies.
Source: http://lifehacker.com/5568752/add-safari-reader+like-powers-to-firefox-and-chrome
The Safari 5 feature that’s caught the web’s attention is the Reader button, which strips down articles and blog posts into an ad-free, highly readable format. Two add-ons for Firefox and Chrome do a good job of recreating that convenience.
If you missed our round-up of what’s new in Safari 5, the short explanation of Reader is that, while many bookmarklets have come along to offer a simplified, less-cluttered reading experience, Safari is the first major browser to go ahead and offer that kind of feature by default, as an address bar button. If you’re a fan of bookmarklets, and your bookmarks aren’t too cluttered to lose them in, we recommend the tools from arc90′s Readability, the Instapaper Text bookmarklet, and the Readable app for highly customized formatting.
But maybe you want your Firefox or Chrome rig to offer that kind of button-click functionality. You’re in luck. First off, here’s the Top 10 feature we’ll try our reading tools out on—click the image for a larger view:
Now here are two add-ons for Firefox and Chrome, and a look at how they do at getting all minimalist with the text and pics. Click any of the images below, too, for a larger view
Readability (Firefox)

Baris Derin rolled the Readability bookmarklet into a full-fledged add-on for Firefox, but also added in a pretty neat auto-scrolling feature for the true lean-back-and-read experience. Readability tends to keep more of the text and formatting in and around the page, but strips out all the marketing and navigation material. It places an “R” button in the lower-right status area of Firefox, which isn’t the most convenient spot for our use, but some may prefer having it hidden away until needed. Notice the transparent icons, too, that provide printing, email, and refresh functions for live-updating posts.
iReader (Chrome)
Mhd Hejazi’s iReader is directly inspired by Safari’s Reader function, offering the same kind of pop-out white box that darkens the rest of the page, a button right in the address bar, and very, very minimal decoration—as you can see, it pared down our Top 10 feature quite a bit. There are also keyboard shortcuts for Windows and Mac to activate iReader, and options to change the background opacity, font and formatting, and add a “Send with Gmail” link to your articles. Neat stuff.
Both add-ons are free downloads. Know of another reading/simplifying extension that gets the job done? Tell us about it in the comments. Thanks to emmikkelsen for the inspiration!
Tags: address, app, arc, area, attention, bar, Baris, blog, bookmarklet, bookmarklets, browser, button, Chrome, click, clutter, convenience, default, Derin, display, distractions, effectiveness, email, experience, explanation, extension, fan, feature, Firefox, format, functionality, good job, hejazi, Image, images, innovations, Instapaper, iReader, job, kind, lean back, look, luck, Mac, marketing, material, mdash, minimalist, navigation, offer, page, Readability, Readable, readable format, Reader, reader button, reading, reading experience, rig, Safari, Source, Spot, status, text, tmpPost, transparent icons, view, Web, web pages
Which Phone Is Best for Power Users? [Showdown]
Source: http://lifehacker.com/5559357/iphone-vs-android-showdown-which-phone-is-best-for-power-users
The newest iPhone comes out in two weeks; the Android OS continues to deploy on better and better hardware; and both operating systems roll out exciting new features and innovations with each release. So which deserves your hard-earned cash?
A Starting Point
You can evaluate iPhone and Android devices from countless angles,[1] so rather than pretend that we’ve got the One True Comparison, it only seems appropriate to highlight that we’re not necessarily your average user. For more specifics on how we judge these devices, read this footnote.
For our purposes, we’re measuring each phone OS against 20 features we care about most, declaring a winner (or a tie) for each category, and adding it all up. The extent to which our measurements match up with what you most care about may vary, but we suspect that many of you share similar values when it comes to your smartphone.
Note: The table below indicates the device we think “wins” each category. A happy Android means we think Android is better in that category; an Apple means iPhone outperforms Android; categories with both an Android and Apple are ties.
![Which Phone Is Best for Power Users? [Showdown] iPhone vs. Android Showdown: Which Phone Is Best for Power Users?](http://cache.gawkerassets.com/assets/images/17/2010/06/500x_iPhone-versus-Android.jpg)
Artwork by Adam Dachis
Below, we’ve broken down the categories above and explained whey we chose the winners as we did.
Ease of Use; Winner: iPhone ![Which Phone Is Best for Power Users? [Showdown] AppleLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AppleLogoIcon1.png)
Android has come a long way in a short time, but from an ease-of-use perspective, the iPhone wins out. You can pick up any iPhone and quickly, easily understand what’s going on. It’s got one main button on the front of the device, and everything you do consists of tapping app icons from the home screen. Android devices have several buttons on the front of the device that perform a variety of functions, and once you unlock the screen (and depending on which Android device you have), you’re confronted with many different possible home screens and ways of doing things from those home screens.
Openness; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
We really like that the Android operating system open source, but what’s more important to most end users is openness in terms of what you can run on these devices. The operating systems themselves are clearly important, but one thing’s abundantly clear: the applications make the phone. And while Google has yet to get in hot water for rejecting apps based on anti-competitive fear or censorship, Apple’s has. A lot.
Battery Life; Winner: iPhone ![Which Phone Is Best for Power Users? [Showdown] AppleLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AppleLogoIcon1.png)
Apple has taken battery life extremely seriously in their careful development of the iPhone, and it’s shown. While Android devices get a kitchen-sink’s worth of features that you may consider to be a fair tradeoff for battery life, there’s little question that the iPhone’s battery life outlasts that of most Android devices. Battery performance definitely varies from Android handset to Android handset (the recently released EVO is taking big hits for its poor battery performance), but the iPhone’s battery performance—particularly the new iPhone’s performance—generally outlasts Android’s.
Multitasking; Tie
![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
It’s a big deal that the iPhone is finally getting some multitasking support in iOS4, and while it’s still not as true of multitasking as Android users enjoy, the tradeoff in terms off battery life improvements is important enough that, overall, we’d consider multitasking to be a wash.
Software Keyboard; Winner: iPhone ![Which Phone Is Best for Power Users? [Showdown] AppleLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AppleLogoIcon1.png)
If you talk to anyone who’s used both the iPhone and Android with some frequency, the general consensus is that the iPhone’s software keyboard is a good deal better than Android’s default keyboard. That’s unfortunate for Android users, but the consolation is that you can install any custom keyboard as your default keyboard on Android, and we’ve seen some solid keyboard alternatives. Still, the advantage, if only by virtue of being better out of the box, goes to the iPhone.
System-Wide Search; Tie
![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
Apple’s implementation of Spotlight on the iPhone searches contacts, media, email, applications, notes, and calendar. Android searches most of that (but notably not email), but also integrates with auto-suggest web searches; it also lets other applications plug into it, so the more supported apps you install, the more robust the universal search becomes.
Notification system; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
This may seem like a silly thing to care too much about, but the iPhone’s modal notification system is particularly user un-friendly, especially for a device as friendly as the iPhone. You have to act on a notification, and you can only see one notification at a time before the next one dismisses the previous one entirely. Android’s brilliant pull-down window shade notification tray, on the other hand, is a beautiful thing that could make any iPhone owner jealous.
Voice-to-Text; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
Nearly every text field on an Android device can be filled with a few words from your mouth, and it works surprisingly well. You can respond to emails by voice, send long text messages by voice while you’re walking around Target, respond to your editor’s IMs while you’re at a graduation ceremony, and so on, as long as you’re comfortable talking to your phone (it is a phone, so you should be). Apart from voice-to-text in third party apps, iOS doesn’t support voice-to-text at all.
Syncing; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
iPhones can be incredible standalone devices, but they’re surprisingly old-fashioned when it comes to syncing, requiring users to plug into their computers and connect to iTunes to do all sorts of syncing and activating that could be more conveniently done wirelessly. Android phones support pretty great over-the-air syncing with your Google account, so much so that if you were to lose your previous Android phone, simply entering your Google account into a new one can get you up and running with a usable phone in a jiffy.
Non-Google Sync; Winner: iPhone ![Which Phone Is Best for Power Users? [Showdown] AppleLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AppleLogoIcon1.png)
Android’s great at syncing seamlessly with Google’s servers, but it’s not so keen on syncing with other popular sources of data—like, say, Outlook, Address Book, or iTunes. If you’re a heavy user of any of those applications, the iPhone is the easiest option.
Tethering; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
The cost of tethering on Android devices varies depending on the provider, but so far the Android tethering situation is better off than what AT&T is offering on the iPhone. In the States, AT&T will charge you $20/month just for the privilege of tethering your iPhone’s data connection to a computer—despite the fact that you’re already paying for a metered data plan. The situation isn’t necessarily much better across the Android-sphere (Sprint is also planning to charge for tethering on the EVO, for example), but currently most Android carriers are sticking with “unlimited” plans, versus AT&T/iPhone’s 2GB limit. It’s still a close race on this point, but Android edges ahead with the ability to turn your handset into a Wi-Fi hotspot that can deliver wireless to you and seven of your closest friends.
Release and Update Consistency; Winner: iPhone ![Which Phone Is Best for Power Users? [Showdown] AppleLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AppleLogoIcon1.png)
These days, your mobile OS is just as important (if not more) than mobile hardware, and Apple has set the consumer expectation to expect that their device will receive new feature updates even if it isn’t the latest phone. To that end, it’s extremely easy to keep track of what’s going on in the iPhone ecosystem. Apple releases one new phone a year, and one major update each year. When an update rolls out, every phone receives the update at the same time (unless it’s particularly old; the original iPhone won’t upgrade to iOS4, for example). In contrast, Android runs on a lot of different devices, and when Google pushes out a new update, there’s no telling when or if it’s going to make its way to your phone. In the future Google is planning to change to yearly Android updates similar to iPhone OS updates, which will likely help this situation, but in the meantime, it’s a source of frustration for Android users.
Apps; Tie
![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
A lot of people may disagree on this assessment, given that Apple’s App Store has around four times the number of applications the Android Market does, but there’s also a lot of crap in the App Store, and at this point, most popular, mission-critical applications have been developed for both the iPhone and Android. What’s more, some potentially very popular applications end up locked out of the App Store for, if we’re being generous, arbitrary reasons. At the end of the day, it may be a big deal that your must-have application X is missing from the Android Market/App Store, and those may end up to be dealbreakers for you, but overall we’d call them pretty even.
Web browsing; Tie
![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
The iPhone’s Mobile Safari browser, while not without its faults, is a very nice, very usable mobile browser. Android’s browser, while not as smooth an operator as Safari, supports (or can support) Flash. The extent to which that matters to you may vary, but it’s big enough that we’re considering it a tie.
Gaming; Winner: iPhone ![Which Phone Is Best for Power Users? [Showdown] AppleLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AppleLogoIcon1.png)
We’re frugal productivity nerds at Lifehacker, so we don’t really care all that much about gaming. And while the number of solid gaming options available in the Android Market continue to grow, it’s still not on par with what’s available for the iPhone.
Music Player; Winner: iPhone ![Which Phone Is Best for Power Users? [Showdown] AppleLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AppleLogoIcon1.png)
Android may do a lot of things well, but one arena where its users regularly voice complaint is with its default media player. Where the iPhone comes with a very solid iPod app, most Android users quickly go looking for alternative players. Google is hyping over-the-internet streaming of all your music from your desktop computer eventually, but until we see something great there, the iPhone still wins out.
Free Turn-by-Turn Navigation; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
After the Google Voice debacle from last year, it’s looking less and less likely that Google will ever develop another new app for the iPhone. Unfortunately, that means that extremely cool applications like Google Maps Navigation, Google’s free turn-by-turn GPS application, will never make it to the iPhone, and so far there isn’t anything as good for the iPhone that’s also free. The iPhone does have its share of solid for-a-price GPS utilities in the App Store (and some decent inexpensive-to-free options), but Maps Navigation is built into Android and outshines the iPhone’s free alternatives.
Integration with Google Apps; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
If you rely on Google tools like Gmail, Google Contacts, Google Calendar, and the like, Android just does it better. The iPhone’s still no slouch, and can sync over-the-air with Contacts, Calendar, and even does Gmail push for instant new message notifications, but if you’re a serious Google or even just Gmail user, the iPhone doesn’t stack up to Android.
Google Voice; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
It may seem absurd to make this a separate point of comparison from Google Apps, but Voice is a very phone-centric app with potentially huge influence over how you use your phone. Apple had the option to approve a Google Voice app for the iPhone and completely blew it. And since we really love Google Voice, it only makes Android look that much more attractive.
Customizable; Winner: Android ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
You may be able to add a wallpaper to your iPhone desktop when iOS4 rolls out, but beyond that, there’s not much you can do to tweak your iPhone to exactly how you like it—without jailbreaking, that is. In comparison, Android devices are Mr. Potato Heads of customizability.
Overall Score: Android: 13; iPhone: 11 ![Which Phone Is Best for Power Users? [Showdown] AndroidLogoIcon1 Which Phone Is Best for Power Users? [Showdown]](http://cache.gawker.com/assets/images/lifehacker/2010/06/AndroidLogoIcon1.png)
Clearly our scorecard is extremely subjective, so take this evaluation with a grain of salt, and consider how important the features we listed (and maybe those we didn’t list) are to you and come up with your own assessment. If your priorities are similar to ours, you’re likely looking at an Android for your next purchase. Frankly, it feels a little like a draw overall. (My ideal would be Android running on the iPhone 4, which is actually possible, eventually.)
In fact, in our recent poll on the subject, 66 percent of Lifehacker readers said they prefer Android; 30 percent prefer the iPhone, and 4 percent preferred neither. Whichever end of the spectrum you fall on, we’d love to hear more about what’s driving your decision in the comments.
Why just Android and iPhone? The iPhone and Android operating systems are not the only mobile OSes on the block, but they’re what we’re focusing on in this post. It’s cool if you’re really into Windows Mobile/Phone 7 or webOS. For the purpose of this post, we’re focusing on what we consider to be the most popular options among our readers. [go back up]
How we judge: We consider ourselves power users who care about things like openness, user control, and customizability; we also care about ease of use, high quality design, and quality hardware. For better or worse (usually worse), these qualities often end up at odds with one another in the current smartphone market, but they make up the measuring stick against which we’re evaluating these devices.
It’s also probably worth noting that, Android OS and hardware aside, we’re big fans of several of Google’s services, and so some of those play an important role in some of the categories above. It may not seem fair to Apple and the iPhone to do so, but in most instances (like Google Voice), Apple had the opportunity to accept Google-focused applications to the App Store.
Finally, the state of Android devices can be somewhat confusing because they’re released by different carriers and on lots of different hardware. We tried to strike a balance between acknowledging faults on some of the worst incarnations of Android hardware while also keeping in mind the best. To the extent that older iPhones aren’t up to snuff compared to the new iPhone, we’ve done the same thing in discussing the iPhone. [go back up]
Adam Pash is the editor of Lifehacker; you can read more of his stuff here at Lifehacker and follow him on Twitter.
Tags: account, amp, android, angles, app, apple, application, Artwork, browser, computer, device, email, end, example, extent, field, footnote, gaming, google, hand, home screens, innovations, iOS, iPhone, lot, market, mdash, measurements, modal, mouth, music, navigation, new features, Notification, number, openness, operating systems, owner, perspective, phone, player, point, power users, Safari, search, shade, short time, situation, specifics, store, system, text, thing, Tie, ties, time, tmpPost, tray, true comparison, update, user, voice, Voice-to, Web, window, Winner, year
Chrome brings Flash Player into the fold, trains it to kill iPads?
Source: http://www.engadget.com/2010/03/30/chrome-brings-flash-player-into-the-fold-trains-it-to-kill-ipad/
If Apple had its way, we expect that the iPad would go down in history as the device that nearly single-handedly destroyed Adobe’s empire of Flash. While HTML5 has been in development for years, content providers like the Wall Street Journal, NPR, CBS and more have only begun transitioning video services to the new standard (and subsequently, away from Flash) now that it’s time for Cupertino’s big release. But this week, Adobe has found an ally in Google, which has just announced that the Chrome browser — and more importantly, Chrome OS — will not merely support but natively integrate the technology. In the short run, what this means is that the Chrome browser won’t require you to download Adobe Flash Player or spend time updating it before back-to-back YouTube viewings and marathon Newgrounds sessions. In the long run, Google explains that it intends Flash to become an integral, seamless part of web design up there with HTML and Javascript — and if we extrapolate, an integral part of its new Chrome OS as well. Pardon us for thinking out loud, but it sounds like Google’s found an exclusive feature to highly tout, when it inevitably brings a Chrome OS tablet to! market.
[Thanks, Adam]
Chrome brings Flash Player into the fold, trains it to kill iPads? originally appeared on Engadget on Tue, 30 Mar 2010 20:19:00 EST. Please see our terms for use of feeds.
Permalink
Electronista |
Official Chromium Blog | Email this | Comments
Tags: Adam, adobe, adobe flash player, ally, apple, browser, CBS, Chrome, Chromium, content, content providers, Cupertino, design, development, device, Download, Electronista, empire, Engadget, EST, extrapolate, feature, flash, google, history, HTML, iPad, javascript, Journal, Mar, marathon, market, market thanks, nbsp, Newgrounds, NPR, official, Pardon, part, Permalink, player, release, run, sessions, tablet, technology, time, Tue, use, video, video services, Wall Street, wall street journal, way, Web, Week, what this means, YouTube
Law Enforcement Appliance Subverts SSL
Source: http://gizmodo.com/5501346/law-enforcement-appliance-subverts-ssl
That little lock on your browser window indicating you are communicating securely with your bank or e-mail account may not always mean what you think its means.
Normally when a user visits a secure website, such as Bank of America, Gmail, PayPal or eBay, the browser examines the website’s certificate to verify its authenticity.
At a recent wiretapping convention however, security researcher Chris Soghoian discovered that a small company was marketing internet spying boxes to the feds designed to intercept those communications, without breaking the encryption, by using forged security certificates, instead of the real ones that websites use to verify secure connections. To use the appliance, the government would need to acquire a forged certificate from any one of more than 100 trusted Certificate Authorities.
The attack is a classic man-in-the-middle attack, where Alice thinks she is talking directly to Bob, but instead Mallory found a way to get in the middle and pass the messages back and forth without Alice or Bob knowing she was there.
The existence of a marketed product indicates the vulnerability is likely being exploited by more than just information-hungry governments, according to leading encryption expert Matt Blaze, a computer science professor at University of Pennsylvania.
“If company is selling this to law enforcement and the intelligence community, it is not that large a leap to conclude that other, more malicious people have worked out the details of how to exploit this,” Blaze said.
The company in question is known as Packet Forensics, which advertised its new Man-In-The-Middle capabilities in a brochure handed out at the Intelligent Support Systems (ISS) conference, a Washington DC wiretapping convention that typically bans the press. Soghoian attended the convention, notoriously capturing a Sprint manager bragging about the huge volumes of surveillance requests it processes for the government.
According to the flyer: “Users have the ability to import a copy of any legitimate key they obtain (potentially by court order) or they can generate ‘look-alike’ keys designed to give the subject a false sense of confidence in its authenticity.” The product is recommended to government investigators, saying “IP communication dictates the need to examine encrypted traffic at will” and “Your investigative staff will collect its best evidence while users are lulled into a false sense of security afforded by web, e-mail or VOIP encryption.”
Packet Forensics doesn’t advertise the product on its website, and when contacted by Wired.com, asked how we found out about it. Company spokesman Ray Saulino initially denied the product performed as advertised, or that anyone used it. But in a follow-up call the next day, Saulino changed his stance.
“The technology we are using in our products has been generally discussed in internet forums and there is nothing special or unique about it,” Saulino said. “Our target community is the law enforcement community.”
Blaze described the vulnerability as an exploitation of the architecture of how SSL is used to encrypt web traffic, rather than an attack on the encryption itself. SSL, which is known to many as HTTPS://, enables browsers to talk to servers using high-grade encryption, so that no one between the browser and a company’s server can eavesdrop on the data. Normal HTTP traffic can be read by anyone in between – your ISP, a wiretap at your ISP, or in the case of an unencrypted WiFi connection, by anyone using a simple packet sniffing tool.
In addition to encrypting the traffic, SSL authenticates that your browser is talking to the website you think it is. To that end, browser makers trust a large number of Certificate Authorities – companies that promise to check a website operator’s credentials and ownership before issuing a certificate. A basic certificate costs less than $50 today, and it sits on a website’s server, guaranteeing that the BankofAmerica.com website is actually owned by Bank of America. Browser makers have accredited more than one hundred Certificate Authorities from around the world, so any certificate issued by any one of those companies is accepted as valid.
To use the Packet Forensics box, a law enforcement or intelligence agency would have to install it inside an ISP, and persuade one of the Certificate Authorities – using money, blackmail or legal process – to issue a fake certificate for the targeted website. Then they could capture your username and password, and be able to see whatever transactions you make online.
Technologists at the Electronic Frontier Foundation, who are working on a proposal to fix this whole problem, say hackers can use similar techniques to steal your money or your passwords. In that case, attackers are more likely to trick a Certificate Authority into issuing a certificate, a point driven home last year when two security researchers demonstrated how they could get certificates for any domain on the internet simply by using a special character in a domain name.
“It is not hard to do these attacks,” said Seth Schoen, an EFF staff technologist. “There is software that is being published for free among security enthusiasts and underground that automate this.”
China, which is known for spying on dissidents and Tibetan activists, could use such an attack to go after users of supposedly secure services, including some Virtual Private Networks, which are commonly used to tunnel past China’s firewall censorship. All they’d need to do is convince a Certificate Authority to issue a fake certificate. When Mozilla added a Chinese company, China Internet Network Information Center, as a trusted Certificate Authority in Firefox this year, it set off a firestorm of debate, sparked by concerns that the Chinese government could convince the company to issue fake certificates to aid government surveillance.
In all, Mozilla’s Firefox has its own list of 144 root authorities. Other browsers rely on a list supplied by the operating system manufacturers, which comes to 264 for Microsoft and 166 for Apple. Those root authorities can also certify secondary authorities, who can certify still more – all of which are equally trusted by the browser.
The list of trusted root authorities includes the United Arab Emirates-based Etilisat, a company which was caught last summer secretly uploading spyware onto 100,000 customers’ Blackberrys.
Soghoian says fake certificates would be a perfect mechanism for countries hoping to steal intellectual property from visiting business travelers. The researcher published a paper (.pdf) on the risks Wednesday, and promises he will soon release a Firefox add-on to notify users when a site’s certificate is issued from an authority in a different country than the last certificate the user’s browser accepted from the site.
EFF’s Schoen, along with fellow staff technologist Peter Eckersley and security expert Chris Palmer, want to take the solution further, using information from around the net so that browsers can eventually tell a user with certainty when they are being attacked by someone using a fake certificate. Currently browsers warn users when they encounter a certificate that doesn’t belong to a site, but many people simply click through the multiple warnings.
“The basic point is that in the status quo there is no double check and no accountability,” Schoen said. “So if Certificate Authorities are doing things that they shouldn’t, no one would know, no one would observe it. We think at the very least there needs to be a double check.”
EFF suggests a regime that relies on a second level of independent notaries to certify each certificate, or an automated mechanism to use anonymous Tor exit nodes to make sure the same certificate is being served from various locations on the internet – in case a user’s local ISP has been compromised, either by a criminal, or a government agency using something like Packet Forensics’ appliance.
One of the most interesting questions raised by Packet Forensics product is how often do governments use such technology and do Certificate Authorities comply. Christine Jones, the general counsel for GoDaddy – one of the net’s largest issuers of SSL certificates – says her company has never gotten such a request from a government in her 8 years at the company. ”I’ve read studies and heard speeches in academic circles that theorize that concept, but we never would issue a ‘fake’ SSL certificate,” Jones said, arguing that would violate the SSL auditing standards and put them at risk of losing their certification. “Theoretically it would work, but the thing is we get requests from law enforcement every day, and in entire time we have been doing this, we have never had a single instance where law enforcement asked us to do something inappropriate.”
VeriSign, the largest Certificate Authority, declined to comment.
Matt Blaze notes that domestic law enforcement can get many records, such as a person’s Amazon purchases, with a simple subpoena, while getting a fake SSL certificate would certainly involve a much higher burden of proof and technical hassles for the same data.
Intelligence agencies would find fake certificates more useful, he adds. If the NSA got a fake certificate for Gmail – which now uses SSL as the default for e-mail sessions in their entirety (not just their logins) – they could install one of Packet Forensics’ boxes surreptitiously at an ISP in, for example, Afghanistan, in order to read all the customer’s Gmail messages. Such an attack, though, could be detected with a little digging, and the NSA would never know if they’d been found out.
Despite the vulnerabilities, experts are pushing more sites to join Gmail in wrapping their entire sessions in SSL.
“I still lock my doors even though I know how to pick the lock,” Blaze said.
Tags: acco, account, Agency, Alice, America, Anyone, appliance, attack, authenticity, authority, bank, bank of america, being, Bob, browser, case, certificate, certificate authorities, check, China, Chris Palmer, Chris Soghoian, com, communication, community, company, computer, computer science professor, confidence, convention, copy, Court, domain, e mail account, eBay, eff, encryption, enforcement, existence, expert, feds, Firefox, forensics, Gmail, government, ility, information, Intelligence, intelligence community, intercept, Internet, ISP, law, leap, list, lock, Mallory, man in the middle attack, Matt Blaze, mechanism, money, Mozilla, need, new man, order, Packet, PayPal, Pennsylvania, Peter Eckersley, point, Private Networks, Product, professor, Ray Saulino, researcher, root, Science, secure website, security, security certificates, sense, server, Seth Schoen, site, SSL, staff, technologist, Tor, traffic, United Arab Emirates, University, university of pennsylvania, user, vulnerability, Washington, way, Web, website, window, year
Early reports show IE not faring well in the post-ballot screen days
Source: http://www.engadget.com/2010/03/22/early-reports-show-ie-not-faring-well-in-the-post-ballot-screen/
Most PC users hit the web using Internet Explorer by default, simply because that’s what came along with Windows. Now, after antitrust investigations, European users get a choice of browser to install via ballot screen, and initial reports are not good for ‘ol IE. According to Statcounter, IE use in France has dropped 2.5 percent since last month’s implementation of the ballot, 1.3 percent in Italy, and 1 percent in Britain. It’s still early days, and it’ll take more than this to chip away from IE’s 62 percent lead in the browser war, but it’s certainly not a good trend for Microsoft. With that in mind, we’re going to have to ask you to place your bets now.
Early reports show IE not faring well in the post-ballot screen days originally appeared on Engadget on Mon, 22 Mar 2010 08:31:00 EST. Please see our terms for use of feeds.
Permalink |
Reuters | Email this | Comments
Tags: antitrust investigations, ballot, bets, Britain, browser, browser war, chip, choice, default, email, Engadget, EST, Explorer, France, implementation, initial reports, Internet, internet explorer, Italy, lead, Mar, microsoft, mind, Mon, month, nbsp, pc users, percent, Permalink, Reuters, screen, Statcounter, trend, use, using internet, war, Web, Windows
Design Principles for the modern digital world
Don’t design 2 or 3 websites. Design one, but make sure it is accessible by whatever medium or device the user chooses to use to access it.
You can start with a site that has:
1) javascript and AJAX
2) no script version
3) mobile version
When you design for mobile, think of what tidbit of information the user is really after. For example, Google Mobile is smart enough to return “27 – 17 with 3:14 left in the game” when I type a search for “dallas cowboys’ score.” Versus Google which returns a list of website search results when I access it via a browser on a broadband connection. Google detects what device I am using when I am searching and returns the exact thing that I was looking for based on the device and channel I am using.
Tags: access, ajax, broadband, broadband connection, browser, connection, dallas cowboys, design, device, Don, example, game, google, google mobile search, google mobile vs regular google, google search, information, javascript, list, medium, Mobile, mobile version, score, script, script version, search, site, thing, tidbit, tidbit of information, type, user, version, Versus, website
About Me
http://twitter.com/acfou
Send Tips: tips@go-digital.net
Digital Strategy Consulting
Dr. Augustine Fou Bio
Tags
Popular Posts
- HP Mini 311 Nvidia ION Netbook Hackintosh'ed
- Facebook advertising metrics and benchmarks
- When NOT to use Groupon (as an advertiser)
- How-To View Gmail for iPad on Your Regular Computer - Chrome and Safari
- social media benchmarks
- What is Web 3.0? Characteristics of Web 3.0
- Facebook's Security Check Asks Users to Identify Photos of Friends' Dogs, Gummi Bears
- Vapor4 May Be the First Bumper Worthy of the iPhone 4
- Two Social Success Stories - Groupon and FourSquare
Recent Posts
- 1535
- ‘we are prioritizing our Android platform’
- 1531
- 1529
- 1527
- HP Labs teams up with Hynix to manufacture memristors, plans assault on flash memory in 2013
- Amazon planning subscription video service to challenge Netflix and Hulu?
- It’s Time To Make Standardized Ratings For Gadgets
- Arcade Fire and Google Pushing HTML5 Together
- New ARM architecture (likely Eagle) better suited for OS virtualization
Recent Articles by Dr. Augustine Fou
- Augustine Fou | ClickZ
- ClickZ Welcomes Augustine Fou | ClickZ
- The ROI for Social Media Is Zero | ClickZ
- A New Definition of 'Digital' | ClickZ
- Social Commerce: In Friends We Trust | ClickZ
- 10 Commandments of Modern Marketing | ClickZ
- Digital is the DNA of All Advertising | ClickZ
- Experiential Marketing | ClickZ
- Social Intensity: A New Measure for Campaign Success? | ClickZ
- Beyond Targeting in the Age of the Modern Consumer | ClickZ
Pages
Archives
- September 2010 (7)
- August 2010 (101)
- July 2010 (61)
- June 2010 (28)
- May 2010 (28)
- April 2010 (26)
- March 2010 (33)
- February 2010 (21)
- January 2010 (12)
- December 2009 (4)
- November 2009 (2)
- October 2009 (14)
- September 2009 (6)
- August 2009 (19)
- July 2009 (34)
- June 2009 (11)
- May 2009 (4)
- April 2009 (6)
- March 2009 (13)
- February 2009 (32)
- January 2009 (25)
- December 2008 (1)
- October 2008 (1)
- November 2007 (1)


