Upstart Russian browser strips down to take on Google

Yandex.Browser puts tabs on the bottom to give as much attention to the Web app or website you're using as possible.Screenshot by Stephen Shankland/CNET

Yandex released a beta version of its streamlined Yandex.Browser Thursday, a Web browser designed to strip the clutter out of using the Web and help the Russian company stand up to Google.

The company first released a browser in 2012, but in 2014 unveiled a concept with a dramatically different, pared-back interface. This system is designed to put almost all the focus on websites and as little as possible on browser controls like buttons and search bars. For example, tabs that house individual websites are moved down to the bottom of the page, reflecting their subordinate status.

Browser technology languished for the better part of a decade after Microsoft's Internet Explorer won the first browser wars at the end of the 1990s. But browsers have become strategic tools for some of tech's biggest companies -- Yandex now among them -- triggering an explosion of competition that has made the Web vastly more useful to the average person. Better performance and new features mean the Web is becoming much more sophisticated as a publishing medium, even as it expands into a foundation for interactive applications too.The beta release signals that Yandex is ready for a wider audience to test the browser -- it's available now for Microsoft's Windows and Apple's OS X and is coming later for phones andtablets. Additionally, it shows that the company is committed to its browser project, despite the fact that the vast majority of the browser market power is concentrated in the hands of Google, Microsoft, Apple and Mozilla.

Firefox steered browsers away from Microsoft's in-house Web technology toward newer, standardized features any browser could use. Apple breathed life into mobile browsers. Chrome pushed browser speeds ahead. All this led Microsoft to throw away old Internet Explorer baggage and start fresh with the modernized, faster-moving, fuller-featured new Edge browser that's due later this year with Windows 10.

Concentrated power

So far though, the browser world's power is concentrated in Google Chrome, Apple Safari, Mozilla Firefox and Microsoft Internet Explorer. But Yandex has some reason to believe in its project.

In Russia, Yandex is something of a mini-Google, operating a panoply of online services, and it's held its own competing against the larger US company. Its online search site has 40 percent share of usage compared to Google's 51 percent, according to April measurements from analytics firm StatCounter. Yandex also offers services for email, maps, cloud-based document storage, online translation and more.

Yandex.Browser places seventh for global PC browser usage -- but only accounts for 0.4 percent of website usage.Data from StatCounter; chart by Stephen Shankland/CNET

Search ads can provide a major revenue source. These are the ads derived from online search terms and placed alongside search results. But Google's increasingly influential Chrome browser was hurting Yandex's search business, Yandex spokesman Vladimir Isaev has explained.

"Securing search share was one of reasons we had to launch our own browser," he said, describing that it had become harder for third parties to integrate their search services into Chrome and more difficult for people to select them. "We would be in trouble on desktops [without] launching our own browser."

Search revenue key

Search ads represent about 97 percent of Yandex's revenue. In the first quarter of 2015, that was 12.3 billion rubles ($211.1 million). The company's profit for that quarter was 2.1 billion ($36.4 million). Yandex isn't the size of companies like Google and Microsoft, but it is large, with 5,603 employees at the end of March.

Worldwide, Yandex.Browser has attained a creditable seventh-place finish in the browser market, but that's only 0.4 percent of PC browser usage, according to StatCounter. In Russia though it fares better, with fifth place and 10 percent share of PC browser usage.

Yandex.Browser's iconYandex

"The browser market is very liquid and fast-changing," Isaev said. "You remember how long IE dominance continued on the market. Then Chrome began to grow, and now it is a leader."

Most people using Yandex services are in Russia, Turkey and Ukraine. In those markets, Yandex has more than 100 million monthly users, and Yandex services are integrated with the browser. "Yandex.Browser is a natural gateway to Yandex services for them," Isaev said. By contrast, the new Yandex.Browser offers users a choice of search engines when they first install the software (specifics vary by country).

Companies that have their own browser have another financial advantage: they don't have to share revenue with other companies that refer traffic to their search engine. That's one reason Google has called Chrome so successful. In 2013, Google paid Mozilla $314 million for the people who used Firefox to search with Google.

Meet Yandex's browser

Although Yandex.Browser challenges Google, it also relies on it. Google's Chrome browser is based on the open-source Chromium browser project, using elements like the Blink engine to turn website programming instructions into the pictures and text you see on the screen. Open-source software can be freely used and modified by anyone, and that's what Yandex is doing for the basis of its browser. Chromium is mostly the same as Chrome, but the latter has some proprietary elements mixed in that can't be shared freely. This includes support for video that's been compressed with the patent-protected H.264 technology.

Yandex also contributes some work back to the Chromium open-source project -- for example, byexpanding some new networking features.

Piggybacking on Chromium is important: the table stakes for offering a browser are high, and using Google's software means companies don't have to spend lots of money paying programmers to reinvent the wheel. That's why another browser maker, Opera Software, switched from its own browser foundation to Chrome, and it's why Google based Chrome on Apple's open-source WebKit project, and why Apple based its WebKit project on another open-source browser called KHTML.

Using Chromium also means Yandex.Browser isn't a burden for developers who already have plenty of problems making sure their websites work properly on multiple browsers.

Yandex.Browser offers a choice of search engines when first installed. The choices vary by country.Screenshot by Stephen Shankland/CNET

Yandex offers differences, though, besides the interface. For instance, it has its own safe browsing service to try to keep people from visiting sites infected with harmful software. It's also got a turbo mode licensed from Opera that can compress text, images and video for better performance on slow networks.

Stealth mode

Yandex.Browser also has a "stealth mode" option developed by AdGuard, easily enabled by clicking an icon of a stealth fighter jet in the upper-right corner of the screen. It blocks website analytics tools and other technology that can be used to track user behavior.

Privacy was a concern the during international expansion of Yandex.Browser, which is available in 15 languages. One change from the prototype version of the browser is that in countries including the US and Germany, the browser doesn't share anonymous usage data with Yandex unless the user specifically enables it.

The browser includes Adobe Systems' Flash Player plugin -- a technology that's fading from modern websites but is still widely used for things like streaming video and games. For viewing PDF (Portable Document Format) files, Yandex includes the PDFium software from Google.

Yandex.Browser can also use extensions to get new abilities. Saving articles with Pocket to read later, synchronizing passwords with LastPass and storing notes with Evernote are all available options. A Yandex.Browser extensions site, operated by Opera Software, lists more than 600 extensions, but the software will also run add-ons from Google's Chrome Web Store, Isaev said.

Yandex.Browser is a balancing act between the company's own software and technology from others. Its international ambitions are limited, but closer to home, Yandex thinks it'll keep its edge.

"We think we can compete in this market," Isaev said.

Now Google lets you save your search history

Google will allow users to download their search history — a handy tool if you've ever wanted a closer look at what really makes you tick online.

The details of the functionality are outlined in a Google support document, which breaks down exactly how anyone can save their list of searches.

First, visit history.google.com/history when you're logged in to your account. Then look for the options icon, and click download.

You'll be prompted to create an archive, and your history will begin downloading — it's as simple as that. The archive will be saved to your Google Drive in the form of a zip file that can be saved to your desktop computer.

Of course, you'll need to have your search history option turned on for the feature to work. If you've opted out of keeping a record of your search history, you'll find nothing available.

One blogger noticed early testing of the feature last year, and pointed out the wider availability over the weekend.

Be warned: Google enlists Chrome in push for encrypted Web

Google has added a feature to Chrome that can alert users about unencrypted network connections common on many parts of the Web. The feature isn't on by default.Screenshot by Stephen Shankland/CNET

Google just gave Chrome something of an insecurity complex.

That's because the company has enlisted Chrome -- the No. 2 desktop browser worldwide -- in its effort to make secure, encrypted connections on the Web the rule rather than the exception. Encryption scrambles data during transmission to protect users from identity thieves and prying governments. This week, Google built a feature into a test version of Chrome to explicitly warn people about Web pages that are delivered without encryption.

As the feature spreads to mainstream versions of Chrome, it could alarm people who thought Web pages were working fine and could impose new costs on Web site operators who don't want their users fretting that something is wrong. But in Google's view, the problem needs fixing.

"We know that active tampering and surveillance attacks, as well as passive surveillance attacks, are not theoretical but are in fact commonplace on the Web," Chris Palmer, a security programmer on Google's Chrome team, said last month in a mailing list post explaining the plan.

Moving toward encryption by default is a profound, monumental change for the Web. With unencrypted pages, somebody like an Internet service provider, taxi or airport Wi-Fi operator, or malicious hacker offering a "free Wi-Fi" hot spot can read all the data sent to and from a computer. A hacker can also modify a Web page, and an ISP can insert its own advertising. To block against that kind of eavesdropping and tampering, Google encrypted its Gmail connections and search site in 2010, and Yahoo and Microsoft have followed suit.

But countless Web pages aren't offered over a secure connection, including Wikipedia, Instagram, Craigslist, Imgur, China Daily, CNN and Amazon product pages. Indeed, 55 percent of the Web's top million sites don't offer encryption, according to 2014 analysis. 

Google has been pushing for an encrypted Web for years, but former National Security Agency contractor Edward Snowden's revelations about NSA surveillance has lent new urgency to the cause. In 2013, Snowden showed the massive extent of government surveillance both through official channels like subpoenas and the interception of communications traffic.

The first step in bringing the encryption plan to fruition came this week with a small first step that will directly affect almost nobody. The bleeding-edge Canary version of Chrome -- not stable or tested enough for ordinary users -- now offers a manual setting that enables the warning about unencrypted pages. A person visiting an unencrypted page will see in Chrome's address bar a padlock with a red X over it. As the year progresses, expect the change to spread to mainstream Chrome.

To enable the feature, a person has to install Chrome Canary and activate the "mark non-secure origins as non-secure" option in Chrome's chrome://flags interface.

Google's Chrome Canary, an early test version of the browser, can be configured to show the warning about unencrypted HTTP connections.Screenshot by Stephen Shankland/CNET

Google suggests a phased transition to the warnings, but in the long run, the company expects a reversal in browser behavior. Today, green lock icons denote secure pages while unencrypted pages are plain. In the future, as encrypted pages become the norm, they could get the plain pages while unencrypted sites could sport a red warning sign.

HTTPS advocacy

Encrypted Web pages are sent using the HTTPS (Secure Hypertext Transfer Protocol) technology. HTTPS arrived not long after unencrypted HTTP helped begin the Web revolution 25 years ago; the main incentive for adding HTTPS was preventing password eavesdropping on login pages and keeping credit card numbers secret for e-commerce.

Google has worked to counter one perception standing in the way of HTTPS: that HTTPS requires more powerful and therefore expensive hardware for Web site operators. But SSL/TLS, the encryption standard underlying HTTPS, "is not computationally expensive any more," Google security expert Adam Langley argued back in 2010. "Ten years ago it might have been true, but it's just not the case any more. You too can afford to enable HTTPS for your users."

Snowden's revelations helped marshal more allies to Google's cause.

For example, the Electronic Frontier Foundation (EFF), an advocate of personal freedoms on the Net and outspoken critic of government snooping, has advocated HTTPS for years. But it increased its efforts after Snowden's leaks.

The EFF and partners including Firefox developer Mozilla, network equipment maker Cisco Systems, and content distributor Akamai Technologies launched a project late last year called Let's Encrypt to make it easier for Web site operators to move to HTTPS. Specifically, Let's Encrypt will offers free certificates, the electronic credentials required to encrypt a Web site connection.

Mozilla support

Another ally for Google's HTTPS plan is Mozilla.

"In general, this proposal seems like a good idea," said Richard Barnes, the nonprofit organization's cryptographic engineering manager. "Adding security to the Web is a core part of our mission...We strongly support the deployment of HTTPS as widely as possible."

He specifically supports one facet of Google's proposal: that warnings be shown starting when HTTPS-encrypted Web pages become more ordinary. Being more aggressive could cause confusion and other undesirable side effects.

"We wouldn't want to turn on a warning light that's on all the time -- that just trains users to ignore it," Barnes said. "An indicator of HTTP being insecure should be thought of as a way to move the state of HTTPS from 'dominant' to 'universal,' not from 'bare majority' to 'universal.'"

Speed bumps and stop signs

Yandex, a Russian search rival to Google that now also offers a Web browser, sees user privacy and security benefits to Google's plan, but it has its own ideas about warning users about unencrypted Web connections.

The Internet industry isn't ready to deliver HTTPS connections at the scale they deliver HTTP connections today, said Anton Karpov, Yandex's head of information security. Web site operators have to worry that HTTPS connections are sometimes blocked in areas like airports and that, contrary to Google's position, HTTPS does require beefier hardware to handle the encryption calculations.

Another hitch is the content delivery network (CDN) business, in which companies armed with global network capacity and servers help Web site operators distribute their content the world over. CDNs can offer HTTPS connections -- but they often charge a premium.

Outside the tech industry, there's another kind of opposition. For example, in January, UK Prime Minister David Cameron pledged to ban encrypted communication software that's unbreakable by the government in order to more effectively combat terrorism.

Web encryption could help thwart legislative ambitions to ban smartphone apps whose encryption comes with a government-accessible back door. For example, a person could point a browser at an encrypted online chat site in a different country.

Overall, the momentum toward encryption is powerful, as seen in Apple's decision to encrypt data stored on iPhones and iPads and Google's parallel move with its Android mobile operating system. New network technologies, including Google's SPDY and its related standard HTTP/2, will in practicerequire encryption in some common instances.

Moving to an encrypted Web won't happen quickly, but Google has momentum on its side.

Google's Android, Chrome software may converge, exec change suggests

Google is blurring the lines between Chrome and Android.Google

Google may want one software platform to rule them all.

A top Google executive in charge of engineering for the company's Android mobile operating system is now also overseeing engineering for Chrome, software primarily used for personal computers, according to a person familiar with the situation.

Hiroshi Lockheimer, Google's vice president of Android engineering, has taken on the duties of Linus Upson, his counterpart in the Chrome division. Upson has left the role, according to The Wall Street Journal, which earlier reported the news. While Lockheimer takes over engineering for Chrome OS, he won't be responsible for other Chrome-related products, including the Chrome Web browser, Chromecast TV streaming stick or Chromebook laptop hardware, according to the Journal.

A Google spokeswoman declined to comment.

The move underscores the growing ties between the two operating systems, with Android primarily used on mobile devices including smartphones and tablets and Chrome used on personal computers. Both the Android and Chrome teams already report to Sundar Pichai, who has led the groups since 2013. Android is already the most widely used mobile operating system in the world, with more than 80 percent of the market, according to market researcher IDC. Bringing the two operating systems together would help ease the burden on developers, who have to create applications for both platforms to reach users on mobile devices and PCs.

"I think the idea is, you look around and there are all these screens everywhere," Lockheimer told CNET last month when asked about the expansion of Android. "These screens don't know how to talk to each other. They are islands."The leadership move makes sense given that Google has made a push to expand Android beyond smartphones and tablets. At the company's I/O developer conference in June, Google showed off initiatives to have the software power everything from wearable devices like smartwatches to television sets to car dashboards.

"So how do we unify them and have a common platform where apps and services and information can flow between these screens and give more utility to your life?" he said.

Google has already been blurring the lines between Android and Chrome. At I/O, Pichai announced a plan to help app developers easily adapt their Android apps for use with Chrome. Last month, the company announced it had partnered with the first batch of app makers to bring their Android apps to Chrome OS-powered Chromebooks. Those apps include language-learning aid Duolingo, productivity app Evernote, children's literacy system Sight Words and video-looping Vine.

"Wouldn't it be nice to get some of your favorite applications on your Chromebook?" Pichai said at the conference. "We want this to be intuitive for users. For developers, we want this to work with as little modification as possible."

Hate Chrome hiding Web addresses? It may be the future

Google is testing an "origin chip" that replaces the ordinary view of a Web site's full address, at top, with just the domain and a search bar, as shown on the bottom example.Stephen Shankland/CNET

• by Stephen Shankland 
   @stshank

Get ready for the disappearance of an aspect of Web browsing that's been there since browsers were invented: an address bar that shows the full location of the Web page you're visiting.

Google has begun a test among some Chrome users to see whether it might be better to hide away this fundamental part of browsing from the average user -- and that's triggered some sharp displeasure. But it may be that those who like seeing full Web addresses probably should get used to a future where that increasing complex and baffling text is something they have to retrieve manually.

The first stage of the test began in December when Google first added the feature, called the "origin chip," that shows a rectangular box including only a Web site's top domain -- "cnet.com," for example, instead of a full address such as "http://www.cnet.com/news/google-chrome-continues-to-outpace-firefox/" that exactly describes the Web page's location on the Net. Chrome today shows the complete address, but with the new approach shows it only when clicks the origin chip. The origin chip itself changes from gray to green to signify a Web site with valid security credentials.

The feature has been activated for some users of the Chrome browser. "This is a new UI experiment that's deployed to a small fraction of users," said Paul Irish, a Google developer advocate, in a Hacker News discussion about the feature Thursday.

Change often generates a backlash, and that's exactly what happened here. One newly filed Chrome bug seeks to excise the origin chip.

"This change is not needed at all, and I don't find it convenient at all. It's the newest crap that Google made after the 'great' idea of removing the scrollbar arrows. Glad that the scrollbar arrows are back. Now I would like the address bar to be back too," the bug submitter complained. More people are piling on to reinforce the opinion, too.

More anger is evident on the Hacker News thread. Google's own Irish doesn't like it, user interface designer Gary Bacon is "not a fan," and mobile app developer Allen Pike calls URLs "the entire point of the Web."

But change, while hard, is a constant on the Internet. Ultimately, it'll be Google that decides whether it's time to retire full Web addresses from public view.

Why ditch URLs?

Web addresses -- also called URLs (uniform resources locators) or URIs (uniform resource identifiers) can indeed be very useful. So why would Google risk incurring its users' wrath?

Google didn't respond to a request for comment for this story, but it's not hard to make some good guess: because Web addresses also can be incomprehensible, distracting, and a pain.

For example, here's an URL that can be used to track any problems that arise with the Google Omnitheater project of which the origin chip is a part: https://code.google.com/p/chromium/issues/list?can=1&q=label%3ACr-UI-Browser-Omnitheatre&colspec=ID+Pri+M+Iteration+ReleaseBlock+Cr+Status+Owner+Summary+OS+Modified&x=m&y=releaseblock&cells=tiles.

A careful look reveals some structure in that URL, and a regular user of Chrome's bug-tracker probably will be comfortable with it. But to the average person, it's as useless as the C++ programming code from which Chrome itself is built or the HTML code out of which a Web page is made. It's information best suited to a computer, not a human brain.

In the case of Web sites protected with secure encryption, the origin chip turns green.Stephen Shankland/CNET

Even some people you might think would be adamantly opposed to the origin chips aren't necessarily so. Take Ian Hickson, a Google employee who helps oversee the standardization of another seminal part of the Web, HTML (Hypertext Markup Language).

"I initially was skeptical, and for me personally it's a little annoying because I edit and copy/paste URLs more than do new searches, but the cleanliness is growing on me," Hickson said.

Even closer to the technology is Anne van Kesteren, a Mozilla employee who's helping to write the standard for the URL itself.

"URLs seem too hard for typical end users to have to learn to comprehend, but we also don't have a better way to share information," van Kesteren said. "It does seem worthwhile to investigate how to have less UI [user interface] the end user does not understand. Especially if it is not necessarily important to them."

A simpler interface

Google has made a point of simplifying the browser interface, and a key part of that is the "omnibox," which displays the URL today and which also lets people people type addresses or searches. Omnibox creator and Chrome team founding member Peter Kasting shared reasons why the origin chip might be a good idea in a Google+ comment. He said it makes the omnibox less intimidating and "more inviting to type in," spotlights the actual Web domain people are using to better thwart some security problems, and could let Chrome show search terms more cleanly when people are typing and refining searches.

Currently, if you search with Chrome's omnibox, the results are shown on a page that shows those search terms on the Web page itself for those who want to refine a search. Moving those terms to the omnibox would let Google devote more of the Web page itself to showing the actual search results.

People who want to try the origin chip feature on their own can do so on Chrome by going to chrome://flags, enabling the feature for showing origin chip in the omnibox, saving the setting, and restarting the browser. Google has begun testing the feature even among those who don't enable the origin chip on their own.Stephen Shankland/CNET

Kasting also said that using the origin chip to show a simplified address also could help people understand more easily where on the Web they actually are. But some location information can lost, too.

For example, "http://www.cnet.com" and "http://www.cnet.com/news" are distinct Web sites, but the origin chip shows the same address in each case. Likewise, "http://www.ebay.com" and "http://www.ebay.com/motors" are different, but the origin chip shows just "ebay.com." And the New York Times uses Web addresses that give some potentially useful information about a story's publication date -- for example with the address "http://www.nytimes.com/2014/05/02/us/white-house-report-calls-for-transparency-in-online-data-collection.html."

Computer-readable address data

For all the human-readable parts of Web addresses, though, there are also elements that are designed only for computers. URLs often are plumped out by tracking tags so analytics software can monitor people's behavior on the Web, for example. Google Docs files contain dozens of characters of alphanumeric gibberish to provide each with a unique ID on the Web.

As the Web gets more sophisticated, URLs could well follow suit, doing things like encoding the state of a videogame you're playing so you could restart from a particular moment later. In other words, machine-readable URL tidbits that let you link to a particular time in a YouTube video or spotlight a section of the XKCD comic's money chart are just scratching the surface.

There are good reasons Web developers should favor simpler URLs that humans can understand better. Even if they're not shown at the top of a Web page, people still copy and paste them, bookmark them, and modify them. But as Web apps become more powerful and the Web reaches into new corners of our lives, it seems likely that computers will be doing much of the hard work of handling URLs and URIs.

"Any resource anywhere can be given a URI," said World Wide Web creator Tim-Berners Lee in 1996, and we should expect that axiom to extend far beyond just a collection of documents on the Internet. The bigger the Web gets, and the more Web addresses include instructions for a computer to use a particular Web site, the farther we'll get from simple URLs.

And when happens, it could be that Chrome's origin chip will seem just the normal way of using the Web.