browser

Apple dismisses Safari vulnerability

Safari users are at risk of littering their desktops with malicious software because the browser does not ask for user permission when downloading files in the way that Firefox and Internet Explorer do, a security researcher said Thursday.

In a blog post titled "Safari Carpet Bomb," Nitesh Dhanjani describes how a rogue Web site can easily download resources to the Windows desktop or downloads directory on the Mac.

"Apple does not feel this is an issue they want to tackle at this time," he writes.

An Apple representative told Dhanjani that an "enhancement request" … Read more

Featured Freeware: Safari

As the Web-browsing world waits for Firefox 3 and Internet Explorer 8, Apple makes its intentions known with a hard push of Safari for Windows and Mac. No, the sky has not fallen, and we have yet to see the spontaneous evolution of avian bacon.

Much like iTunes, the Windows version of the Mac application works fine but lacks a certain tightness. It feels unfinished because it is, but its browsing engine is solid and has been independently clocked at speeds faster than that of Firefox 2. Still, Safari lacks most customization features. Skins and other aesthetic options exist in … Read more

Web browsers and other mistakes

Correction, 3:40 p.m. PDT: This story initially misspelled Dan Kaminsky's last name.

On Friday at Microsoft's Blue Hat conference in Redmond, Wash., Alex "Kuza55" K. of SIFT challenged the software company and others to build a better Internet browser by detailing the many ways browsers fail to parse malicious code.

In the talk, Kuza55 included details on how various attacks use logged out cross-site scripting (XSS), cross-site reference frame-protected cross-site scripting, JavaScript hijacking, session fixation, XSS reference frame token fixation, and CSRF vulnerabilities to compromise desktop Internet browsers. The talk was provided to CNET … Read more

Skyfire mobile browser updates, gets predictive

Article updated 5/2/08 at 8:00am with additional information.

The youngest mobile browser to hit the scene can do quite a few more tricks after this week's feature-enhancement and bug-fixing release.

At the request of testers enrolled in Skyfire's closed beta program, version 0.6 has included several housekeeping functions. There are the basics of pasting a URL or search term, deleting bookmarks, and beefing up the soft-key menu with a shortcut to search the current Web page. There's also the highly demanded security nod that disguises passwords as you type. Though this hasn't … Read more

Fix broken icons in Firefox bookmarks

(You can see this tip in action at CNET TV.)

Do your Firefox bookmark icons ever break? For instance, I have a bookmark to the CNET Intranet but the Last.FM logo is next to it. Not horrible, I know, but annoying.

Here's how to fix improper icons that, for one reason or another, may show up in the Firefox browser.

First you need to find the bookmarks.html folder for your Firefox.

In Windows XP for me, it's on a torturous thrill ride through the following folders: Documents and Settings - username - ApplicationData - Mozilla - … Read more

Mozilla chairman sets sights on mobile devices

Mozilla's Chairman Mitchell Baker talked about "opening the mobile Web" this morning at the Web 2.0 Expo. While not discussing planned functionality in future products, Baker's vision of tomorrow's browser is less Minority Report and semantic search (see Hakia and Powerset) and more about making browsing a simpler experience by taking advantage of your browser history. She also vaguely mentioned Mozilla's plans to step into the mobile browser market later this year with a browser currently code-named "Fennec."

Mozilla has already taken the first steps to get to such a place … Read more

Opera 9.5 Beta 2 adds neat URL look-up

If you can't remember the URL of a site you've once visited, what do you do? You can either scour your history, willing the evasive address to remain listed, or you can search in Google by the keywords you remember and hope the site you want floats near the top of the results.

The latest version of Opera Software's 9.5 Beta browser, released Thursday for Windows, Mac, and Linux, makes fishing for past Web addresses much easier with a new feature called Quick Find.

Quick Find essentially bundles the keyword search directly into the Opera browser'… Read more

Researcher: Wii and iPhone browsers could allow phishing

In a paper (PDF) presented at the Usability, Psyschology, and Security Conference 2008 in San Francisco, researchers from the University of California at Davis warned that browsers within popular electronic gadgets often eliminate important security features available on desktop browsers.

Researchers Yuan Niu, Francis Hsu, and Hao Chen looked at the Mobile Safari browser in Apple iPhone, as well as the Opera browser included in the Nintendo Wii and DS gaming systems. In general, they cited the reliance on screen typing as a deterrent to typing in known URLs. They said users are more likely to click on URLs presented … Read more

AT&T launches its own browser, Pogo. Surprise: It doesn't suck.

The obvious first question one asks the AT&T execs when beginning a discussion of Pogo, the company's new Web browser, is "What is AT&T doing getting into the browser market?" The answer you get is, at first, amusing. It's a chance to build "another relationship with the customer," they say. They also tell you it could be a great conduit for AT&T messages (e.g., brand or product advertising). Sounds like the makings for a truly awful product, does it not?

Video demo is embedded at the end … Read more

Patches for Firefox and Flock

The past 24 hours have seen Mozilla Firefox (download from CNET Download.com for Windows and Mac) getting another security hole plugged, while its social-networking derivative Flock (also at CNET Download.com for Windows and Mac) earns a minor behavioral bug fix.

Firefox's most recent safety snafu is another JavaScript engine security problem that was causing the browser to crash during JavaScript garbage collection. Although there was no indication that this error was exploitable, says Mozilla, other similar errors in the past were. Not to mention the benefit of not having your browser randomly going kablooey.

Flock's fixRead more