Google demotes Chrome feature that would hide full Web addresses

• by Stephen Shankland 
   @stshank
 



The actions Google takes with its Chrome browser cast a long shadow.Stephen Shankland/CNET

Google has taken a big step away from its "origin chip" plan that would hide the full addresses for Web sites people were visiting with its Chrome browser.

On Tuesday, Chrome team member Peter Kasting demoted the address-hiding feature from a top priority to a third-level priority, saying "the origin chip work is backburnered" on Google's issue-tracking site.

The origin chip was a region to the left of Chrome's address bar that showed only the domain of a Web address. For example, it would show "http://www.cnet.com/" instead of a full Web address such as "http://www.cnet.com/news/google-test-hides-web-addresses-in-chrome/" -- the longer address can be more useful but also can be crowded with obscure coding only a computer could love.

Here's what the difference looks like in Chrome's address bar:



Google tested a feature in Chrome called the origin chip that showed only the domain of a Web site, not its full URL.Stephen Shankland/CNET

It wasn't immediately clear why Google backed away from the feature. CNET has contacted the company for comment and will update this article with its response.

Google had been testing the feature on a fraction of Chrome users to gauge people's response. Some of that was negative, since the full Web address can show useful information.

For example, people might want to know at a glance they're at "http://www.reddit.com/r/bitcoin" or "http://www.ebay.com/vlp/sporting-goods/", details that would be hidden away with the origin chip. Or they might want to know if a program has appended user-tracking tags such as "?feedType=RSS&feedName=technologyNews" to the address.

Navigating the Web has changed dramatically, and full addresses no longer are as essential as they once were. Search engines are often used to get us where we want to go, and the share buttons in smartphone apps can take the place of a copy-and-paste operation when you want to tell a friend about a particular Web site.

But it's hard to change user interfaces when millions of users have grown accustomed to them. Chrome's growth into a major force on the Net makes it harder for Google to introduce significant changes such as the origin chip or the "omnibox" that merged the browser's search box and address boxes when Chrome debuted in 2008.

In earlier comments on Google+, Kasting shared some reasons why the origin chip could be a good idea: The minimalist presentation could make it more inviting to search, could make it easier to refine searches by adding or removing search terms, and could improve security by showing users what site they're really on, not just what a carefully crafted address might misleadingly suggest.

Web addresses, called uniform resource locators (URLs), are a fundamental part of the World Wide Web that Tim Berners-Lee created 25 years ago. The origin chip doesn't remove the full URL, but makes it something people have to look for.

The way the origin chip feature was implemented, a person could click on the chip to see or copy the full address. In addition, the Ctrl/Cmd-L keyboard shortcut shows selects the full address, as it does today without the origin chip.

Apple has hidden full Web addresses on its Safari browser on iOS 7, its mobile operating system. That's used on devices like the iPhone that don't generally have as much screen space as a desktop computer, but Apple seems to like the idea: at its Worldwide Developer Conference on June 2, it showed the upcoming version of Safari for the Mac also hiding Web addresses.

New algorithms speed secure communications for Chrome on Android

• by Stephen Shankland 
   @stshank

Google is promoting a pair of encyrption algorithms called ChaCha20 and Poly1305 for faster, stronger encryption on mobile devices.

Google

Google has sped up secure Web browsing on Android by taking advantage of something most companies don't have: control over the browser and the sites it's visiting.

Google added support for faster new encryption algorithms called ChaCha20 and Poly1305 to its Chrome browser, wrote Elie Bursztein, leader of Google's anti-abuse research team, in a blog post Thursday.

"ChaCha20 and Poly1305 are very fast on mobile and wearable devices," Bursztein wrote, in part because the algorithms can take advantage of some acceleration features in the ARM chips that power the vast majority of mobile devices.

Such algorithms scramble data being transmitted to thwart eavesdropping attempts, including government surveillance or malicious hackers trying to purloin passwords.

Stephen Shankland/CNET

Old encryption algorithms gradually need to be replaced as researchers find ways to weaken them and as new computing hardware brings more power to those who want to crack encryption.Google likes one new algorithm called AES-GCM, according to Google security expert and programmer Adam Langley, but it works best with acceleration hardware not generally present on mobile phones. For that scenario, Google likes theChaCha20 and its related Poly1305 algorithm, from researcher Daniel Bernstein.

The ChaCha20-Poly1305 combination sends encrypted data at 139.9 megabytes per second on a smartphone with a Snapdragon S4 Pro chip, such as the Google Nexus 4. AES-GCM, in contrast, can encrypt data only at 41.5MBps, Bursztein explained.

Google has been pushing for wider use of encryption on the Web for years. However, especially with mobile devices, performance can be a hurdle because of issues such as slower Internet connections and power-consuming encryption calculations.

ChaCha20-Poly1305 aren't finished standards yet, but Langley and others are working to formalize themat the Internet Engineering Task Force. They're also trying to encourage others such as Firefox browser developer Mozilla to embrace the algorithms, adding the support directly to Android, and have written support to the open-source OpenSSL and NSS software used to run websites.

But perhaps the biggest lever Google has is its own properties, such as Gmail and search. Google is able to introduce new technologies to the Internet because it can not only build them into Chrome, but also make sure that there are sites that use the algorithms.

Google speeds WebP image format, brings animation support to Chrome

Google has built a new version of its WebP software into Chrome to let browsers display its image format 25 percent faster, the company said Friday.

The better performance new libwebp 0.4.0 is part of Google's general effort to speed up the Web, and the new software also uses less memory and fixes an issue that had blocked Google from supporting animated WebP images. The updated WebP support is built into the version of Chromethat's currently in beta.

Animated GIF images, popular on sites such asTumblr and Imgur, are the last remaining holdout for the elderly Graphics Interchange Format, which otherwise has largely been replaced by PNG (Portable Network Graphics) and JPEG. Google argues WebP can replace all three image formats, but has yet to persuade other browser makers to support WebP despite some urging from sites such as Facebook and Netflix.

One very popular feature combines two aspects of JPEG and PNG: JPEG's lossy compression, which can significantly reduce file sizes by throwing away data in original images, and PNG's alpha transparency, which lets a graphic designer designate portions of an image as transparent. The latter is very handy when overlapping images such as icons atop a background.Google argues that WebP reduces file sizes compared to JPEG, but the WebP improvement hasn't been dramatic enough to persuade Mozilla, which is concentrating on squeezing a little more life out of JPEG. Even if WebP or some alternative catches on, countless JPEGs will live on the Web, and Mozilla is leery of introducing a requirement to support another file format for perpetuity.

WebP also can operate in a lossless mode that works where PNG is more common today, for example in corporate logos on the Web. Google uses WebP to replace PNG in this context on its Google Play site, a move that lopped off a third of file sizes.

Google also said it's moving to WebP for YouTube thumbnail images, showing yet again how much influence it can have on the Web's future by controlling both a major browser and major properties on the Web.

"All the rollouts within Google combined have raised our aggregate data transfer savings tally to tens of terabytes every day," said Husain Bengali, a product manager and WebP optimizer at Google, in a blog post on Friday. "For users, this translates into faster page load times and fewer bytes counted against metered data plans."

The WebP debate has been very contentious for Mozilla. Ardent fans, distressed at Firefox's continuing lack of support, have urged Mozilla to support WebP on the Firefox bug-tracker. After 193 comments, Mozilla restricted commenting privileges on Wednesday and tried to move the discussion to a mailing list.

Popular web browsers face threat of mischievous attacks

The agency, in its advisory, said the vulnerability is caused "due to improper restrict access to 'about:home' buttons by script on other pages in Mozilla Firefox".

NEW DELHI: Multiple vulnerabilities have been detected in popular web browsers Google Chrome and Mozilla Firefox and cybersecurity sleuths have advised internet users in the Indian cyberspace to guard against arbitrary activities on their systems.

In view of these suspicious virus-based activities, internet users have been asked to upgrade their personal versions of these two most used web browsers on their work stations.

"Multiple vulnerabilities have been reported in Mozilla Firefox, Thunderbird and SeaMonkey which could be exploited by a remote attacker to bypass certain security restrictions, disclose potentially sensitive information, gain escalated privileges, execute arbitrary code and causes denial of service condition on the affected system," the Computer Emergency Response Team of India (CERT-IN) said in its latest advisory to online users in the country.

The CERT-In is the nodal agency to combat hacking, phishing and to fortify security-related defences of the Indian internet arena.

"The two web browsers are an important tool for internet surfing among Indian online consumers. The anomalies have been detected recently and it would be advised that users upgrade their existing versions sooner than later. These activities are mischiefs on part of hackers or they are harmful viruses," a cyber security expert told PTI.

The agency, in its advisory, said the vulnerability is caused "due to improper restrict access to 'about:home' buttons by script on other pages in Mozilla Firefox".

"A user-assisted remote attacker could exploit this vulnerability using a crafted website or webpage. Successful exploitation of this vulnerability could allow user-assisted remote attacker to cause a denial of service condition," the CERT-In said.

Chrome, Opera pass Epic Citadel demo's Web graphics test

The Epic

Citadel demo of Unreal Engine 3 running in a browser using high-speed JavaScript and WebGL.
(Credit: screenshot by Stephen Shankland/CNET)

Chrome and Opera have become the first browsers to match Mozilla Firefox's support for Epic Games' Unreal Engine 3 and the Web-based Epic Citadel demo that's built on the 3D graphics technology. The demo's computing challenges include 3D graphics covered with 2D textures, rustling leaves, flowing water, reflective stone floors, lens flare, and shadows and other lighting effects.

Mozilla and Epic Games demonstrated the advanced Web programming in March using a combination of Mozilla technologies: Emscripten that converts C or C++ software into JavaScript, and asm.js that can run a specialized subset of JavaScript much faster.

Mozilla has been trying to drum up support for asm.js, but Chrome and Opera used their own JavaScript technology. (Opera Software, earlier this year, shifted away from its browser engine, adopting Chrome's and benefiting from Google's investment in the software.) The Epic Games demo also uses the WebGL standard for 3D graphics, which Chrome, Mozilla, and Opera all support.

The new browser support is notable, given the push toward Web programs that run on any machine with a browser -- cross-platform flexibility that has big advantages over writing native code that only works on iOS, Windows, or some other specific operating system. But the maturity and consistency of Web programming still leave a lot to be desired, especially for complicated, performance-intensive Web apps.Epic Games added Chrome 31 and Opera 18 to its Unreal Engine 3 supported browsers list. Martin Best, the product manager of games at Mozilla, noted the rival browsers' achievementin a blog post Tuesday.

Mozilla and Google got their Unreal performance with significantly different approaches. Asm.js uses a technology called ahead-of-time (AOT) compilation for its performance boost, with the Web app sending a "use asm" hint to the browser to trigger the technology. Compilation is the process of converting human-written source code into machine language that a computer can execute. AOT compilation means the browser can build an optimized version of the software in advance.

The Epic Citadel demo of Unreal Engine 3 running in a browser using high-speed JavaScript and WebGL.

(Credit: screenshot by Stephen Shankland/CNET)

But Chrome uses a different approach with its V8 JavaScript engine called just-in-time (JIT) compilation that's standard nowadays for most Web sites and Web apps. The JIT approach means the browser compiles the JavaScript, monitors how it runs, and optimizes with new compilation as it goes.

"V8 people seem to want to JIT-optimize harder, not process 'use asm,'" said Mozilla Chief Technology Officer Brendan Eich, but he's not convinced the performance will catch up to AOT compilation. In his experience, Unreal Engine 3 on Chrome shows more "jank" from pauses triggered by recompilation.

"Yet they do well," Eich said, praising Chrome's virtual machine that runs the JavaScript programs. "V8 is a formidable JIT'ing virtual machine."

In my tests of the two, Chrome showed a higher frame rate on a 2012 Retina-equippedMacBook Pro. Firefox Nightly version 28.0a1 (2013-11-26) showed 52.4fps, but Chrome 33.0.1712.4-dev ran at 59.8fps.

Both versions sent the CPU fan whirring, though, so there's still work to be done.

The Epic Citadel demo of Unreal Engine 3 running in a browser using high-speed JavaScript and WebGL.

(Credit: screenshot by Stephen Shankland/CNET)

I told ya!

In few of my earlier tweets I told you about some of the loopholes in the Google Chrome browser. And now I have proof to say I was right.

This one is from Design&Trend.

Google Chrome Update, Store, For Mac: Security Breach, Lack of Protection, Passwords Exposed

Google Chrome allows anyone using your computer to see the plaintext web passwords stored by your browser.

As Wired explains, this is not a security bug; but rather, Google Chrome's documented behavior. On Wednesday, U.K. software developer Elliot Kember posted a blog highlighting the issue. His blog was picked up by Hacker News, and the problem was brought to public attention. 

Google Chrome's security chief Justin Schuh spoke out against the criticism, writing, "The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater." 

His entire statement can be read here.

Other browsers fail to employ extra security as well. For example, Mozilla's Firefox browser gives a user dialog that asks, "Are you sure you want to show your passwords?" without asking for further verification. 

According to Apple Insider, Mac's Safari employs extra security. The browser pops up a dialog requiring that a user enters the password for the currently logged-in ID of the computer. Without the user ID, Safari will not show the passwords. 

There are experts saying that Chrome's password manager is not at all reliable.

Here's one more from KEYE TV.

A warning to web users about a popular browser: Google Chrome has a serious vulnerability.  And the maker doesn't plan to fix it.  If you're not in the habit of locking up your computer with a password, you may want to-- especially if you're using Google Chrome internet browser.  Google chrome is now the world's most popular browser, just recently edging Microsoft's Internet Explorer.  But Chrome has a security problem.  A few clicks of the mouse and you can call up all the passwords you have stored on the browser.  And they're in plain English. Google says it is aware of the issue but doesn't plan to fix it.  Justin Schuh, a security chief with Google, tells Hacker News that Google doesn't want to provide users with a false sense of security and encourage risky behavior.  It wants users to know that once someone has access to your machine, they can get at everything ... and that includes your chrome passwords. So what can you do to protect your passwords?  Sorry-- but it comes down to two simple rules: lock your computer with a password and don't save your passwords to Google Chrome.

Read More at: http://www.keyetv.com/news/features/top-stories/stories/google-chrome-design-exposes-passwords-11043.shtml

The security system of Chrome deserves to be criticized.

Not just these two, there are many websites, newspapers and experts mentioning the problems in Chrome's System.

I request Google to repair this as soon as possible. And. remember I was the first one to reveal it.