In 2016, Microsoft announced that it will no longer support Internet Explorer 10 (IE10), and that only IE11 and Edge browsers will continue to receive updates. However, two notable exceptions to this were Windows Server 2012 and Windows 8 Embedded, which couldn’t support IE11 at the time. As Microsoft has promised to bring IE11 to these two operating systems later this year, it's also announced this week that IE10 will be deprecated on these enterprise-focused Windows editions in January 2020. 

Switching to IE11

Enterprise customers using Windows Server 2012 and Windows 8 Embedded will be able to start testing IE11 for their operating systems as soon as this spring. They will be able to download IE11 through the Microsoft Update Catalog, but Microsoft will also push the update to all users of these two operating systems later this year.

The IE11 push through the Windows Update service means there’s no escaping from switching to IE11, so those companies that rely on IE10 quirks will have to transition their web apps to the newer IE. Windows Server 2012 and Windows 8 Embedded customers have until January 2020 to get ready for the switch.

Those who, for whatever reason, can’t make the full transition for their apps from IE10 to IE11 will be glad to know that IE11 will also have a IE10 compatibility mode for enterprise apps.

An Easier Migration Path to Windows 10

Microsoft noted that switching enterprise web apps to IE11 means that these companies and organizations will also be able to switch more easily to Windows 10 later on, as Microsoft’s most modern browser, Edge, supports fallback to IE11. Therefore, all IE11-optimized web apps should continue to work in Edge, too.

However, one big question remaining is what happens when Microsoft reveals its Chromium-based browser? It's not clear yet if Microsoft still intends to add any type of fallback to IE11. Chances are that by the time this browser gets a significant amount of users, Microsoft will be encouraging enterprise users to switch either to Edge (if the new Chromium-based browser will have fallback to Edge compatibility) or to the Chromium-based browser itself.

Mozilla has partnered with Troy Hunt, a Microsoft Regional Director, to create a more user-friendly service where users can check whether or not their email addresses have been exposed in previous data breaches. Mozilla’s new tool, called Firefox Monitor, has API access to Hunt’s Have I Been Pwned database of billions of emails exposed in data breaches.

Early Data Breach Notifications

The free Firefox Monitor service functions much like Hunt’s Have I Been Pwned. You can search for your email address in the service’s search box, and if your email was exposed in a data breach you’ll be shown when that happened and which service, specifically, was hacked. 

The tool can also proactively alert you when your email was exposed in a new data breach. This should give you time to change your password for the exposed accounts before the malicious hackers can act on that stolen information.

Keeping Breached Companies Honest

Firefox Monitor should ensure that even when a company that suffered a data breach keeps the hack a secret, you can still learn about the breach. Many companies tend to keep the breach a secret for weeks or longer until they have figured out what happened, something that’s not always in the user’s best interest.

Furthermore, if the company's security hasn’t been up to par until the data breach happened, they may realize that the users might blame them for not properly securing the accounts, thus creating a larger PR scandal. Therefore, before making the hack public, companies may want to also upgrade and modernize their systems to assure users that this sort of data exposure at least won’t be possible anymore in the future, even if damage was already done.

Hunt’s Have I Been Pwned database would often include emails from new data breaches that hadn’t yet been made public. Security researchers might tell him first if they discovered a new data breach themselves, or if they saw hacked data being sold on underground markets. The Firefox Monitor is available to an audience wider than what Hunt could reach alone.

Mozilla has made it clear with all of its recent new features that security and privacy are some of its top priorities going into the future. 

People hate passwords. That's why so many people use the same basic password across multiple websites—and that in turn is why so many data breaches reach much further than most would expect. It's just not secure to use simple passwords, reuse passwords across multiple services, or share passwords with other people. Web Authentication attempts to offer the best of both worlds by letting people abandon passwords for more convenient and secure options, and now that it's supported by Microsoft Edge, the specification will continue to expand.

Web Authentication lets people use facial recognition, fingerprint scanners, FIDO2 devices and PINs instead of passwords. All of these mechanisms have trade offs—facial recognition and fingerprint scanning can be fooled, and FIDO2 devices require you to carry an extra gadget around—but they can still be considered more convenient than memorizing and entering secure passwords. Most people won't remember something like "iH%#xP2v3Ab%R!n," and even if they do, who wants to type that? If one isn't willing to use a password manager, secure passwords can be wildly inconvenient.

Microsoft thinks passwords need to go the way of the dodo. Here's what the company said in a blog post this week about supporting Web Authentication:

"Staying secure on the web is more important than ever. We trust web sites to process credit card numbers, save addresses and personal information and even to handle sensitive records like medical information. All this data is protected by an ancient security model—the password. But passwords are difficult to remember and are fundamentally insecure—often re-used and vulnerable to phishing and cracking."

The company also said Edge's implementation of Web Authentication "provides the most complete support for Web Authentication to date, with support for a wider variety of authenticators than other browsers." That's because it supports Windows Hello, which already lets Windows 10 users access their devices via facial recognition or fingerprint scanning, as well as the more standard FIDO2 devices. (Not everyone wants to evangelize Windows Hello. Apple probably doesn't care to support it with Safari, for example. But FIDO2 devices are platform agnostic.)

Microsoft likely wanted to blow its own horn regarding Edge's support for Web Authentication because it's actually a beat behind Google and Mozilla. The former added beta support for Web Authentication to Chrome in May, and the latter did the same with Firefox that same month. But it's still good that Microsoft is adding support for Web Authentication to Edge, not just because Edge users should be afforded the same options as their Chrome and Firefox-using counterparts, but also because it means the call to enable people to abandon passwords will continue to grow.

Web Authentication support is currently available in the version of Edge shipping with Windows Insider Preview Build 17723.

In the latest “Patch Tuesday” update for Windows, Microsoft fixed 53 security bugs, of which 17 critical, spanning 15 products. More than half of the critical security bugs affected Internet Explorer, which even though users may not see in Windows 10 anymore, still exists as a legacy fallback for the Edge browser.

Multiple Microsoft Products Affected

Microsoft issued patches for 53 security bugs in the latest update, with most of the bugs found in Microsoft’s own products, such as:

1. Internet Explorer
2. Microsoft Edge
3. Microsoft Windows
4. Microsoft Office and Microsoft Office Services and Web Apps
5. ChakraCore
6. Adobe Flash Player
7. .NET Framework
8. ASP.NET
9. Microsoft Research JavaScript Cryptography Library
10. Skype for Business and Microsoft Lync
11. Visual Studio
12. Microsoft Wireless Display Adapter V2 Software
13. PowerShell Editor Services
14. PowerShell Extension for Visual Studio Code
15. Web Customizations for Active Directory Federation Services

Internet Explorer Security Curse

Ten of the 17 critical bugs affected Microsoft’s Internet Explorer, which the Edge browser still uses whenever a website is compatible only with Internet Explorer technology and not with Edge.

This is why Internet Explorer has continued being a security headache for Microsoft years after Edge was introduced. Internet Explorer support is also the primary reason why Microsoft tends to lose the annual Pwn2Own browser hacking competitions and why Edge is not considered as secure as Chrome.

Attackers will likely continue to exploit Internet Explorer until Windows 7 and Windows 8.1 are out of the picture. Edge came as default only for Windows 10, so even if Microsoft drops support for Internet Explorer in Windows 10, the company will still have to support it for as long as it continues to support the Windows 7 and 8.1 operating systems. The Internet Explorer security curse will haunt Microsoft for many more years.

Despite Internet Explorer being the “star” of this month’s Patch Tuesday, the Edge browser wasn’t exactly bug-proof either, as Microsoft had to fix five vulnerabilities in it, too, most of them information disclosure bugs.

In this latest Patch Tuesday Microsoft also issued patches for some of Adobe’s products, including Flash Player, so you may not want to skip this update. Windows 10 users should be getting these patches automatically, but Windows 7 a 8.1users may have to download them manually from Microsoft’s Update Catalog (which still only works with Microsoft’s own browsers).

Google announced that, starting with version 64, the Chrome browser will prevent pages from redirecting to third-party content in unexpected ways.

Iframe Redirects

Google said that one in five Chrome feedback reports mention encountering some type of unwanted content. The company noted that it’s taking user feedback seriously, so beyond Chrome’s existing pop-up blocker and autoplay protections, it will bring three new protections over the next few releases of Chrome that are designed to stop unwanted content.

One piece of feedback from Chrome users is that sometimes a page will navigate to a different page unexpectedly. Google found that often this is not even what the page’s author intended, as the behavior is created by third-party content embedded on the page that wasn’t supposed to redirect visitors to another page.

To address this issue, Chrome 64 will stop such iframe redirects and then show the user an information bar explaining that the redirect was blocked. Chrome will prevent the redirect only if it happens automatically and the user wasn’t interacting with the frame.

Redirects Enabled By User Interaction

Even when the user interacts with the frame, things can go wrong. Some websites open content the user tried to access in a new tab and then redirect the main page to a different website, for example, which effectively bypasses Chrome’s pop-up blocker.

Starting with Chrome 65, this type of behavior will also be curbed by Chrome. When the main tab tries to redirect to another website, Chrome will prevent it from doing so and will also show the user an information bar. This new protection will allow the user to check out the opened content in the new page while also staying on the original page.

Overlay Redirects

Google noted that there are other types of abusive experience that are difficult to automatically detect. Sometimes websites have overlays on them that capture all clicks and redirect users to another site, or the redirect links are embedded within the play button of a video player.

Starting next January, Chrome’s pop-up blocker will prevent these sites from opening new windows or tabs. To help site owners ensure that their websites won’t be blocked from opening content in new tabs or windows, Google has released the Abusive Experiences Report. The tool will warn the site owners if Chrome’s new protections will prevent content on their websites so they can take the appropriate action to remove such content from their websites.

Google announced that it has removed all trust in WoSign and StartCom certificates from Chrome and Android, following the discovery that the two certificate authorities misbehaved.

WoSign/StartCom Go Rogue

About a year ago, Mozilla uncovered that a Chinese Certificate Authority (CA) called WoSign had a number of technical and management failures, which included bypassing previous restrictions by browser vendors on distributing SHA-1 certificates.

The browser vendors had previously agreed not to accept SHA-1 certificates that were issued after January 2016. However, WoSign backdated its certificates so it could continue to issue SHA-1 certificates that would still be supported by the browsers (for legacy reasons).

Mozilla also found out that WoSign had secretly acquired a smaller CA, StartCom, which was against its CA policies.

WoSign previously denied both allegations, until Mozilla and others came up with sufficient evidence to show that the allegations were indeed true. The level of deception coming from WoSign was also what prompted Mozilla to plan a progressive removal of WoSign and StartCom’s certificates. Apple and Google followed with a similar plan.

Plans To Distrust WoSign/StartCom Certificates

Mozilla started phasing out these certificates in Firefox 51, while Google did the same thing starting with version 56 of Chrome, both of which came out last Fall. Google now seems ready to completely eliminate the support for WoSign and StartCom certificates from its browser.

Google initially whitelisted the top 1 million websites for using the WoSign/StartCom certificates, but it gradually reduced the length of that whitelist over the course of several Chrome releases. Starting with version 61 --we’re now at 59--Google will completely remove support for WoSign and StartCom certificates from Chrome.

This means that websites that are still using these certificates by the time Chrome 61 comes out will appear broken in the browser and won’t load for users of that particular Chrome version (as well as all the other versions coming afterward). Google recommended sites that still use WoSign and StartCom certificates to immediately replace them so as to not risk disruption of service for potentially a large portion of their users.

No More Mr. Nice Browser Vendor

Over the past couple of years, Google has shown that it’s not willing to compromise the security of its users if some of the CAs misbehave, no matter how large they are. Google has taken some severe measures against both WoSign and Symantec, one of the largest CAs, to ensure that they properly validate their certificates and follow the rules. This may have also led Symantec to consider the sale of its CA business.

The CA rules are important, because without them, the whole HTTPS security ecosystem could collapse. If users can’t trust the HTTPS connections to be secure anymore, then they may not make certain transactions or communications over the internet. Alternatively, they could switch to alternative encryption communications protocols, which may come with their own benefits and compromises.

The decisions to punish CAs by some of the major browser vendors, such as Google and Mozilla, must not have come easy. Banning a CA from the browser could easily turn into a PR battle if thousands of websites' users can't visit anymore because of broken certificates.

Ultimately, it’s still the site operators' responsibility to educate themselves on their certificates' security and ensure that their users’ connections to the site are protected. That includes not using certificates from CAs that don’t follow the rules or replacing them when necessary.

Google has also been promoting (and soon requiring) support for the Certificate Transparency certificate logging and monitoring system, which should make it much easier to identify when a CA is issuing problematic certificates. It should also encourage CAs to behave and to properly audit their own systems to ensure everything works as it should and that bad actors (whether hackers or malicious employees) aren’t abusing their systems to issue forged certificates.

Google announced that its Portable Native Client (PNaCl) solution for making native code run inside the browser will be replaced by the new cross-browser web standard called WebAssembly.

NaCl And PNaCl

Around the same time Google introduced Chrome OS in 2011, it also announced Native Client (NaCl), a sandboxing technology that runs native code inside the browser. This was initially supposed to make Chrome OS a little more useful offline compared to only running web apps that required an internet connection.

Two years later, Google also announced PNaCl, which was a more portable version of NaCl that could work on ARM, MIPS, and x86 devices. NaCl, on the other hand, only worked on x86 chips.

Even though Google open sourced PNaCl, as part of the Chromium project, Mozilla ended up creating its own alternative called “asm.js,” an optimized subset of JavaScript that could also compile to the assembly language. Mozilla thought that asm.js was far simpler to implement and required no API compatibility, as PNaCl did.

As these projects seemed to go nowhere, with everyone promoting their own standard, the major browser vendors seem to have eventually decided on creating WebAssembly.

WebAssembly

WebAssembly can give web apps near-native performance, offers support for more CPU features, and is simpler to implement in browsers and use by developers. Chrome 57 and Firefox 52 already support WebAssembly, and Microsoft’s Edge and Apple’s Safari support it in the preview versions of their browsers.

Google said that going forward, its native code efforts will focus on using WebAssembly. Meanwhile, PNaCl will be deprecated by the end of the first quarter of 2018. Chrome apps and extensions will continue to support it for a while longer. However, Chrome previously announced the deprecation of Chrome apps, too.

Google published a list of recommendations for developers who want to port their apps from PNaCl to WebAssembly, as well as a roadmap for WebAssembly features that will be supported in future versions of Chrome.

Chrome has long been criticized for using too much power and draining notebook battery life, but Google has been taking some steps lately to improve the browser's efficiency. The latest includes limiting background tabs to using only 1% of the CPU’s performance.

Chrome’s High Power Usage

Both Apple and Microsoft have taken advantage of the fact that Chrome isn’t that efficient in terms of power usage. This may not have put too much of a dent on Chrome’s growing market share, but it did negatively impact its image. It seems Google has taken notice of that, and over the past few months, the Chrome team has been working on making their browser more efficient.

Right now, according to Google, background tabs represent as much as a third of Chrome’s overall power usage. That’s quite significant for browser tabs that are effectively being unused.

New Background Throttling Policy

The recently released Chrome 57 aims to improve that by limiting the timing fire rate for individual background tabs that use excessive amounts of power. Chrome, like other browsers, has limited timers in the background to only run once per second.

Via the new throttling policy, Chrome 57 will delay timers to limit average CPU loads to 1% of a core, if an application uses too much CPU in the background. Tabs that play audio or are maintaining real-time connections such as WebSockets or WebRTC will not be affected. Google found that the new throttling policy can lead to 25% fewer busy background tabs.

Background Tab Suspension Roadmap

Chrome’s background suspension roadmap also shows that it will also start throttling loading tasks later this year, without any disruptions to the user experience.

In 2018, Chrome should be able to fully suspend background tabs, unless developers explicitly opt out of this feature. However, around 2020, Chrome will also remove the opt-out mechanism, so all background tabs will be suspended if they’ve remained unused for a few minutes.

A similar policy of complete suspension for the mobile version of Chrome will be enabled later this year, as on mobile, restricting power use is much more important than on the desktop.

Four years ago, Google introduced the idea of Chrome apps. These were web apps that would work as if they were native apps with offline capabilities. However, Google recently announced it would no longer support Chrome apps because they are used by only 1% of Chrome users.

The idea of Chrome apps was mainly introduced to help Chrome OS feel more like a real operating system. You could continue using Chrome apps even when you were disconnected from the Internet. Your changes would be saved locally, and then, if needed, they'd be synced to the web service as well.

Chrome apps also had other capabilities that regular apps or browser extensions didn’t have, such as more direct access to system hardware (USB, Bluetooth, cameras, etc). You could also use the Chrome app outside of of the Chrome browser, as if it was a standalone application.

Google even worked on helping developers port existing C++ applications to Chrome through the Native Client sandboxing technology. Google didn’t specifically address Native Client apps in its latest announcement, but with Chrome apps being deprecated soon, and with Android native apps also coming to Chrome OS, supporting Native Client apps may not make much sense in the future. Multiple browser vendors are also working on a standardized alternative to Native Client, called WebAssembly, which may help speed up the demise of Native Client support in Chrome as well.

Starting in late 2016, new Chrome apps will only be shown in Chrome OS. Existing apps will work in the Chrome browser on all the desktop platforms until the second half of 2017. In early 2018, only Chrome OS will be able to load Chrome apps. It’s possible that many enterprise and institutional customers of Chromebooks are already depending on some Chrome apps, so Google will probably support them on Chrome OS for a few more years.

Developers of Chrome apps, such as Open WhisperSystems with its Signal for Desktop client, will have to either transition to a similar solution, such as Electron or NW.js, or give up on the “native” web app idea completely and write regular native applications instead.

Back in May, Google said it would start blocking Flash by the end of the year. The company reiterated that today, while also adding that it will begin “de-emphasizing” Flash content in Chrome as soon as next month, when Chrome 53 arrives.

Although Flash used to be quite an important tool for developers in the early days of the web when they couldn’t do too much with HTML, things have changed significantly since then. Over the years, Flash became one of the top targets for malware makers. That happened in part because the plugin was so popular with users and worked in all browsers, but also because it had too much vulnerable code that keeps getting exploited to this day.

Beyond the security issues on the desktop, Flash also had performance and battery life issues on mobile platforms, which is one of the reasons why Steve Jobs famously promised to never adopt it for iOS. Google and Adobe tried to optimize Flash for Android, but it eventually became obvious that even with dual-core processors arriving in high-end smartphones at the time, Flash was not made to work well on mobile. Adobe eventually stopped supporting Flash on Android altogether.

The vast majority of users, whether on mobile or on the desktop, are now using a browser that supports an extensive range of HTML5 capabilities that can match Flash. Therefore, browser vendors, as well as many users, believe that it’s now time to put an end to Flash content on the web.

Starting with version 53 next month, Chrome will begin to block invisible Flash content (such as page analytics). This reportedly represents 90 percent of the Flash content on the web and slows down web pages.

Mozilla has already begun to block flash and promised to block it by default sometime in 2017. Apple will begin blocking Flash by default, too, in the next version of macOS, which should be available this fall. Google said that Chrome 55 will also block all Flash content by default by the end of this year. All websites will then show the HTML5 version by default, with the exception of Flash-only websites.

Mozilla joined other browser vendors in announcing that Firefox will start blocking invisible Flash content this August, and that starting with 2017, it will block all Flash content by default as well.

Last year, Adobe, the creator of Flash, started encouraging Flash developers to switch over to using HTML for their content. However, the transition is not going to be a fast one until browsers start outright rejecting Flash content. Apple has already tried for almost a decade to kill Flash, and despite the popularity of its iOS devices, there are still many websites, especially those serving video content, that continue to use Flash players.

Many advertisers are also still reliant on Flash, which makes it difficult for websites to switch entirely to HTML. Google, Amazon, and Facebook began to push advertisers to HTML last year, while Chrome (and soon Microsoft’s Edge as well) has already started to auto-pause Flash ads, which also began last year. Chrome and Safari will both start to block most Flash content by the end of this year.

Mozilla said that Firefox would start blocking invisible Flash content next month that is not essential to the user experience. According to the company, this should reduce crashes and hangs by about 10 percent on average for its users. To maximize website compatibility, Mozilla will only block a curated list of Flash content that it can replace with HTML.

Over time, the list of content that Firefox can block will increase to the point where the browser will block all Flash content by default in 2017. That’s when Firefox will require “click-to-activate” approval from users for all Flash-based websites that not have switched to HTML.

In March 2017, Firefox will also completely drop support for all the NPAPI plugins, with the exception of Flash. The enterprise version of Firefox (ESR), which Mozilla will release the same month, will continue to support the Flash and Java plugins until 2018. Users who may still want to have Flash enabled by default could switch to Firefox ESR to use Flash for a while longer.

Flash has been the source of many critical browser exploits, so web security should improve significantly once major browsers do not support it anymore and most websites have made the transition to 100 percent HTML content.

After blocking Flash ads last year, the Chrome team is ready to start blocking Flash content by default on most websites. Only the top 10 sites will get an extra year exemption, and after that their Flash content would be blocked as well. Browser users will still be able to manually play Flash inside Chrome for a while longer.

Last year, Chrome began block auto-playing Flash ads, as they would consume too much power, and they can also represent as a security risk. Not long before that, Mozilla had to block all Flash content by default for a short period, because of multiple critical Flash vulnerabilities that affected Firefox users.  

Flash has been a major source of critical vulnerabilities impacting hundreds of millions of browser users. For the most part, Chrome’s sandboxing could protect against those vulnerabilities, but not all browsers have sandboxing that can contain the Flash vulnerabilities, and even if they do, the protection may not be as potent.

After the aforementioned one-year extension, the top 10 sites will get the same treatment as all the other sites with Flash content. The ten sites include YouTube.com, Yahoo.com, VK.com, Live.com, Yandex.ru, OK.ru, Twitch.tv, Amazon.com, and Mail.ru.

Chrome will continue to support Flash for an indeterminate period of time, so users can still activate it on sites on which it is blocked by default if they deem it necessary. The sites that require Flash to run will prompt visitors with a choice to allow Flash or keep it disabled.

On some sites, such as Pandora.com, visitors are now automatically prompted to download Flash from Adobe’s site when they find that Flash can’t be played by default. Once the Flash blocking policy goes into effect, Chrome will intercept this type of request and instead prompt the visitors with an “Allow Flash Player…” info bar. Meanwhile, enterprises will be given the option to “Always run Flash content.”  

Google also said that in the future, the term “plugin” will be replaced by the term “Flash Player,” as that will be the last supported plugin in Chrome.

Adobe itself has begun encouraging developers to stop creating Flash content and focus on HTML5 instead, so it’s likely that Flash won’t be around much longer in other browsers, either.

Lucian Armasu is a Contributing Writer for Tom's Hardware. You can follow him at @lucian_armasu. 

Follow us on Facebook, Google+, RSS, Twitter and YouTube.

Mozilla, along with other browser makers, has been tightening up the rules around HTTPS connections in its Firefox browser by deprecating certain features for HTTP communication and by encouraging web developers to use HTTPS in a stricter fashion. The latest announcement is mainly user-focused by making it more clear just how much security different HTTPS modes provide.

DV Certificates

Up until now, Firefox has been showing a grey lock icon for sites that use Domain Validated (DV) certificates, and a green lock for those that use Extended Validation (EV) certificates. Mozilla realized that many users might not understand the difference and may think the DV sites aren't as secure. That's why Firefox will now show sites that use DV certificates with a green lock as well.

Mixed Active Content

Mozilla has been showing a grey and white shield alongside the lock icon for sites with Mixed Active Content. These are HTTPS sites that also use content served over HTTP that can interact with the rest of the HTTPS website. This leaves the site vulnerable to malicious attacks.

Mozilla will replace the grey and white shield with a green lock icon and a small grey warning sign to signify that the site isn't as secure as it should be. However, those who visit such sites shouldn't worry too much as Firefox automatically blocks the Mixed Active Content by default. This could cause some problems with some sites and users could deactivate this protection, but Mozilla found only a small number of users ever do that.

Mixed Passive Content

Another category of mixed content is called Mixed Passive Content, which mainly refers to embedded images or video being served over HTTP within an HTTPS website. This type of content isn't blocked by default in Firefox.

This was previously reflected in the browser as a grey warning sign. The icon has been updated to a grey lock icon with a vibrant yellow warning sign to show that the site isn't secure. This sign is also shown when the cryptography used by websites has been deprecated by the browser.

Mozilla announced that it made similar changes for its mobile Firefox browser as well.

Lucian Armasu is a Contributing Writer for Tom's Hardware. You can follow him at @lucian_armasu. 

Follow us on Facebook, Google+, RSS, Twitter and YouTube.

Google Chrome has a Data Saver feature on the mobile version of the browser that reduces the amount of data used every time you visit a webpage. Recently, the company made an additional improvement to the service, which it claimed reduces data usage up to 70 percent.

The improvement is a somewhat obvious move. Images on a webpage take up a heavy portion of data, and this update halts image loading when Data Saver detects a slow connection. Once the page’s text is ready, you have the option to load all the images onto the page or select the images you want to see.

Data Saver works by optimizing the contents of each page on Google’s proxy servers before the data is sent to your phone. A connection between the smartphone and Google’s servers is opened, the user requests a page, and then the page is optimized for data reduction through the server before it arrives on your smartphone. However, if you visit secure pages (URLs that start with "https") or browse in Incognito mode, Data Saver won’t compress the data.

For now, the updated Data Saver feature will begin rolling out in India and Indonesia, two countries that might have reduced and unreliable mobile data coverage. The company said that it will come to more countries in the coming months, but based on the initial release, Google will first bring the feature to markets that desperately need the feature.

______________________________________________________________________

Rexly Peñaflorida II is a Contributor at Tom’s Hardware. He writes news on tech and hardware, but mostly focuses on gaming news. As a Chicagoan, he believes that deep dish pizza is real pizza and ketchup should never be on hot dogs. Ever. Also, Portillo’s is amazing.

Follow Rexly Peñaflorida II @Heirdeux. Follow us on Facebook, Google+, RSS, Twitter and YouTube .

Microsoft issued an out-of-band security patch for Internet Explorer versions 7 through 11, which contains a critical security flaw that allows attackers to infect users when they visit certain websites, with no action required from those users (this is also called drive-by downloads).

The zero-day flaw is being actively exploited in the wild right now, which is likely why Microsoft pushed an update for it as soon as it was possible. The company credits Google researcher, Clement Lecigne, for finding the zero-day vulnerability.

In the past, Microsoft wasn't too happy about Google giving it only 90 days to push a patch for one of its security vulnerabilities that was found by researchers part of Project Zero, but the company seems to have responded much more rapidly with a fix this time.

According to Qualys CTO, Wolfgang Kandek, there are multiple mechanisms that attackers can use to deploy malware through this vulnerability, including:

Hosting the exploit on ad networks, which are then used by entirely legitimate websites;Gaining control over legitimate websites, say blogs, by exploiting vulnerabilities in the blogging server software or simply weak credentials;Setting up specific websites for the attack and manipulating search engine results;Send you a link to the site by e-mail or other messaging programs.

After the users are infected, the malware gains the same privilege as the user, showing once again how important it is to stay off Administrator accounts. With the Admin privileges, the attackers can gain full control over the machine and can install even more malware on it, if necessary for their purposes.

Because Microsoft has just disclosed the bug, there's still time for attackers to integrate this vulnerability into their exploitation tools by the time most people update their Windows machines. That's why it's critical that all users update their PCs immediately -- or just use a browser other than Internet Explorer.

Microsoft's new Edge browser in Windows 10 is unaffected by the bug, proving how necessary it was for Microsoft to break-apart from the Internet Explorer legacy and start fresh with a new code-base that's cleaner and more secure.

Enterprises are likely not going to upgrade their users' PCs very soon, but if they use Microsoft's EMET tool, which protects against memory corruption bugs such as this one, they should be safe even when using Internet Explorer. However, this should only be used as a temporary solution, because EMET zero-day flaws may also exist in the wild that could make a bypass easier.

Follow us @tomshardware, on Facebook and on Google+.

Even if Mozilla isn't happy about some of the changes in Windows 10, the company still needs to work to optimize its software for the new OS. Mozilla updated the Firefox web browser with a tweaked interface and safety features, making the browser more secure and easier to use.

The key focus of these updates was to give Firefox a more streamlined feel, and to overcome the search issues in Windows 10 that Mozilla previously complained about. Although Cortana is designed to work only with Bing, Mozilla stated that, after installing its browser, all Windows 10 web search functions, including those done with Cortana, will be carried out via your default search engine in Firefox.

Currently, Mozilla uses Yahoo as the default search provider on its Firefox browser, and as such, after installing Firefox, Cortana will also carry searches out in the Yahoo search engine. However, this can easily be changed inside of Firefox's settings if you desire to do so.

Although it wasn't the primary focus of this update, Mozilla also instituted some security features related to its browser add-ons. Add-ons allow users to customize the functionality and design of the web browser to suit their needs, but virtually anyone can create them. As a result, someone could use these add-ons for malicious purposes without Mozilla knowing.

To guard against this, Mozilla pushed out a series of guidelines that add-on developers must follow to ensure security. All current add-ons will continue to work during this transitional period, but a warning will be displayed on uncertified add-ons. Mozilla stated that future releases of the Firefox browser will disable these add-ons in the future, though.

Clearly, the recent Windows 10 release and the new Edge browser from Microsoft have destabilized the balance of power in the web browser market, at least in terms of perception. These feature updates and improved security policies may help Mozilla stave off Microsoft's Edge browser.

Follow Michael Justin Allen Sexton @LordLao74. Follow us @tomshardware, on Facebook and on Google+.

Over the past year or so, Google has begun a campaign to increase the security on the Web. The company promised to declare HTTP sites appearing in Chrome as non-secure in a multi-step process over the next few years. It has also started encouraging the use of HTTPS through its search engine.

Not to be outdone, Mozilla also announced recently that it is going to start a process for deprecating non-secure HTTP features in Firefox while building new features that can work only with secure HTTPS connections.

The company hasn't yet selected a date for when this process will begin. It hasn't selected the features it's going to deprecate or the "new" features it's going to support for HTTPS connections, either. Mozilla is asking the community to help it decide on all of these things and is expecting to make some proposals to the W3C WebAppSec Working Group soon.

Many didn't seem to like Mozilla's announcement. The complaints ranged from having to pay for digital certificates annually when they currently don't have to do it for their non-secure HTTP sites, to HTTPS making their sites slow, to simply thinking HTTPS is just not needed for certain categories of websites.

Mozilla has prepared some rebuttals for all of these criticisms, but it remains to be seen if this will convince the skeptics.

For one, Mozilla said that there are already free certificate solutions right now, such as StartSSL, WoSign and the upcoming EFF project "Let's Encrypt." Mozilla has even built a tool to help website owners properly configure their HTTPS settings for strong security.

When processors were slower and didn't have support for AES hardware encryption, HTTPS did indeed negatively impact site performance. However, these days, the overhead is tiny for most websites, and in some cases HTTPS sites using the new HTTP/2 protocol may load even faster than non-encrypted HTTP.

Many seem to think that their websites don't need HTTPS encryption because they don't have sensitive information, or anything that could become a major privacy breach for the user. However, according to Mozilla, HTTPS is not only about maintaining the privacy of the sites' visitors, but also about keeping the integrity of the website intact.

Without HTTPS, someone could modify what the visitors see on the website and make them believe that what they see comes from the website -- for instance, the way some Internet service providers inject advertising into their customers' traffic.

Recently, with the discovery of China's "Great Cannon" cyber-weapon, HTTPS has become a defensive tool against state censorship, too, as HTTPS is supposed to stop that type of attack.

Mozilla believes there are many other reasons that make HTTPS not just a nice-to-have tool, but a must-have one if we are to have a dragnet-free, censorship-free, and attack-free Web in the future. At the same time, Mozilla is also working on some other security technologies such as DANE or Certificate Transparency that could make HTTPS even better in the long run.

Update, 5/04/15, 2:52pm PST: We asked Mozilla to comment on the story and to help clarify some issues that may have been misunderstood. Richard Barnes, Firefox Security Lead at Mozilla responded:

TH: Can you further clarify when Mozilla will start deprecating HTTP, and when do you expect this to start having an impact on a significant portion of HTTP sites?

RB: "Transitioning the Web to HTTPS is going to take some time, so whatever a website does today it will still work for months or years. The first thing we're going to do is require HTTPS for new features. In the long run, there is some discussion of removing or limiting features that are currently available to unencrypted sites. Those changes will be announced well ahead of any implementation, so users will have time to update their site either to not rely on those features or, we hope, to move to HTTPS. In the short run, the impact on HTTP-only sites will only be that they will not get new features. In the longer run, say several months or a year out, they may begin to lose features if they don't upgrade. We hope that most sites will choose the upgrade path."

TH: Is Mozilla working on some other encryption technology that could replace HTTPS in the future (say something like blockchain technology embedded into Firefox)?

RB: “We believe that HTTPS and the Web PKI are a good foundation for the Web, but like any technology, they can always be improved. We are working on upgrading HTTPS to use the emerging TLS 1.3 standard for encryption, and we are continually improving the assurance that our root CA program provides. We don't have anything to say right now about longer term technologies, but if people have proposals, we would be happy to hear them."

Follow us @tomshardware, on Facebook and on Google+.

Last week, Google's security engineers wrote a post about an intermediate certificate authority (CA) called MCS Holdings that issued some unauthorized digital certificates for Google's domains. The intermediate certificate for MCS Holdings was issued by CNNIC, China's main root certificate authority. Google believes CNNIC is also responsible for that forged certificate and has decided to remove it from Chrome.

The Problem With Rogue CAs

When a certificate authority issues false certificates that allow for unsecure connections and traffic interception, browser vendors usually respond by banning that CA and revoking its issued certificates.

This sort of policy is important because the security model of the Web is rather vulnerable, having to depend on thousands of random certificate authorities and a few root CAs. These root CAs may even have strong ties to their local governments, and depending on the government, their intentions may not always be to the benefit of everyone on the Web.

If browser vendors would allow the rogue CAs to break Internet security, even after they catch them doing it, then it could create a domino effect, and the security of the Web could fall apart. More CAs could start taking risks and forging certificates for various benefits, knowing that the browser vendors won't punish them.

Also, if more people would see that their browsers continue to trust less trustworthy certificate authorities, they would eventually stop trusting HTTPS connections, too (which are useful for secure online banking, e-commerce, and stopping traffic interception, among many other things).

Therefore, banning bad CAs seems like the most reasonable thing to do within the current security model of the Web as a deterrent for other CAs to avoid the same mistake.

Banning The CNNIC Root CA

Although this is usually expected to happen, few thought Google or any other browser vendor would go as far as to ban not just MCS Holdings, but also China's root certificate authority, CNNIC. Yet, this is exactly what Google has just announced.

In a future update, the CNNIC root certificate will be revoked. For the time being, Google will continue to allow CNNIC's certificates to be used in Chrome through a publicly disclosed whitelist. After that, before it asks for reinclusion in the Chrome root store, CNNIC must adopt the Certificate Transparency system that Google has been proposing for the past few years.

Certificate Transparency

Although right now Google can quickly identify when forged certificates are issued for its domains, thanks to certificate pinning in Chrome, this solution isn't scalable and usually works only for Google's own websites. For that reason, Google came up with the Certificate Transparency project, which provides an "open framework for monitoring and auditing SSL certificates in nearly real time."

The main goals of Certificate Transparency are:

Make it impossible (or at least very difficult) for a CA to issue an SSL certificate for a domain without the certificate being visible to the owner of that domain.Provide an open auditing and monitoring system that lets any domain owner or CA determine whether certificates have been mistakenly or maliciously issued.Protect users (as much as possible) from being duped by certificates that were mistakenly or maliciously issued.

Because it's an open framework, anyone can verify the basic components that make Certificate Transparency work. This open system should bring a certain degree of improvement to the current CA model where it's hard to even know when a certificate against a certain site has been forged.

China's CNNIC responds

Although Google seems to imply that CNNIC has already agreed to implement Certificate Transparency for its certificates before it's reincluded in Chrome, the root CA responded publicly today by using a completely different tone:

“1. The decision that Google has made is unacceptable and unintelligible to CNNIC, and meanwhile CNNIC sincerely urge that Google would take users' rights and interests into full consideration.2. For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected."

Other Browser Vendors Have Yet To React

Although Chrome is arguably the most popular web browser today (especially when including its mobile market share), it still has only about a third of the browser market. For this move to be completely effective, Mozilla, Apple and Microsoft might have to do what Google did and remove CNNIC from their certificate root store.

Right now, Mozilla seems to be at least considering limiting CNNIC new certificates in its browser. However, it doesn't currently plan to remove CNNIC from the root store, unless the Chinese root CA doesn't agree to its set of requests in order to have some form of verification for its certificates.

Do not remove the CNNIC root, but Reject certificates chaining to CNNIC with a notBefore date after a threshold date Request that CNNIC provide a list of currently valid certificates, and publish that list so that the community can recognize any back-dated certs Allow CNNIC to re-apply for full inclusion, with some additional requirements (to be discussed on this list) If CNNIC's re-application is unsuccessful, then their root certificates will be removed

Apple has been in a security promotion campaign lately and has even had some security troubles in China. Therefore, it wouldn't be too far-fetched for the company to follow in Google's footsteps. At the same time, Apple is seeing rapid growth for its iPhones in China, so it remains to be seen whether it will back Google on this, or whether it will compromise in order to maintain a good relationship with the Chinese government there and not harm its sales in any way.

China hasn't always treated Microsoft well either, especially more recently when the government announced the banning of Windows 8 from government institutions. However, Microsoft has a relatively long history of giving in to China's censorship or surveillance requests, so it's once again hard to predict whether the company would follow Google's bold move to ban CNNIC from Internet Explorer (and Project Spartan).

As usual, when security is involved, the weakest leak can make the whole system fall apart. In the same way, having some of the major browser vendors fail to agree to punish the rogue certificate authorities for issuing fake certificates could set a dangerous precedent.

Follow us @tomshardware, on Facebook and on Google+.

Pwn2Own is a browser security competition where security researchers who have been working on finding vulnerabilities in web browsers for the past year try to win significant monetary prizes from companies such as Google, Microsoft, Apple and Mozilla.

The flaws are usually found after months of work. At Pwn2Own they have only 30 minutes to demonstrate their hacking capability and beat the browsers' security before the others in the competition. The first to show a browser exploit in the given timeframe wins the prize. Multiple such prizes are given throughout the Pwn2Own competition.

In the second day of Pwn2Own, security researchers managed to expose multiple vulnerabilities. All of the participating web browsers were ultimately hacked. However, Chrome only had one flaw discovered, and writing the exploit for it was the hardest, according to the researcher who managed to do it.

Internet Explorer was the least secure browser of the bunch, with five vulnerabilities found. The researchers also found five vulnerabilities in the Windows operating system.

5 bugs in the Windows operating system4 bugs in Internet Explorer 113 bugs in Mozilla Firefox3 bugs in Adobe Reader3 bugs in Adobe Flash2 bugs in Apple Safari1 bug in Google Chrome

A total of $557,500 was paid out to researchers. Korean Jung Hoon Lee who wrote the 2,000 lines of code exploit for Chrome was also the one to hack into some of the other browsers, managing to take home almost half of the total payout for himself. Lee won $225,000 at the Pwn2Own competition in bounty prizes, of which $110,000 he got in just two minutes.

Over the past few years, IE and Firefox have traded off being in last place, but Chrome is usually consistently the one with the least vulnerabilities. Google created Chrome from the beginning with security in mind (the process sandbox, as well as other security features), so it's not too surprising to see it again be the most robust.

IE on the other hand has too much legacy code it has to worry about, but hopefully things will change in terms of security as well if Microsoft's new browser, "Project Spartan," has a more prominent role in Windows 10.

Mozilla also intends to replace more parts of its browser with components written in the memory-safe Rust language, which can help protect against common security vulnerabilities. However, a few more years will probably pass until that happens.

Update, 3/23/15, 7:10am: Mozilla Security Lead Daniel Veditz reached out to us to note that Mozilla patched Firefox as soon as the company learned about the Pwn2own exploits. He said that Firefox version 36.0.4 took care of the same-origin violation used in the Pwn2own exploit, while the other vulnerability, which he said was not exploitable on its own, will be patched in Firefox version 37.

Follow us @tomshardware, on Facebook and on Google+.

News of Microsoft's new Spartan browser has been circulating for some time now, and many believe it to be a new browser running side by side with Internet Explorer. Some have also speculated that the new browser may replace Internet Explorer as the Windows 10 default web browser, but according to Christopher Capossela, Microsoft's CFO, Internet Explorer will continue to be used in Windows 10.

At Microsoft Convergence yesterday, Capossela said "We are right now researching what the new brand, or the new name for our browser, should be in Windows 10. We will continue to have Internet Explorer, but we also have a new browser called Project Spartan, which is codenamed 'Project Spartan,' and we have to name the thing."

Some users of Microsoft Windows may be disappointed to hear that Internet Explorer will continue in Windows 10. Internet Explorer is one of the oldest web browsers that has been continuously updated, and over the years it has been the target for numerous viruses and hackers.

In addition, some users have complained over performance issues and stability with the browser. As a result, Internet Explorer has faced tough competition over the years from other web browsers such as Chrome and Firefox.

According to W3 Schools, an educational website for web development, as of February 2015, Internet Explorer ranks third with 8 percent global market share. By comparison, Chrome ranks first with 62.5 percent market share, and Firefox has 22.9 percent market share.

In an attempt to regain market share, Microsoft has been developing Project Spartan with plans to launch in Windows 10 alongside Internet Explorer. Capossela said that in the United Kingdom, users were being surveyed about potential names for the new browser.

The survey showed that users responded more favorably to product names starting with "Microsoft" instead of "Internet Explorer." While the exact tested names were not given, it is certain the name will be "Microsoft (Blank)" because of the positive reaction to the Microsoft brand name.

For now, Microsoft is saying that Internet Explorer will continue to be used along with the Project Spartan browser for Windows 10, but that could change in future versions of Microsoft Windows. It seems a curious idea to have two browsers, so we'll just have to wait and see what Microsoft decides to do. But for now, at least, the plan is for the two browsers to coexist.

Follow us @tomshardware, on Facebook and on Google+.

Google software engineer Lucas Ballard updated the company's Online Security Blog with news that the Chrome web browser, Google Search and Google Ads now provide even more protection against malicious sites and unwanted software.

News of the beefed-up Safe Browsing service arrives after Google rolled out a feature in October 2013 that warns users about a potential threat when clicking on a download link. When users click on the link within the Chrome browser, a warning pops up saying that the file may "harm your browsing experience," and the download is blocked unless the user clicks the "Dismiss" button.

The company also rolled out a "reset browser settings" button, which allows users to return Chrome to its default settings with the click of a button. To access the button, Chrome users simply need to hit the Settings icon in the top-right corner, select "Settings" and expand "Show Advanced Settings" to reveal "Reset Settings." Users can then click on the "Reset Settings" button.

According to Ballard, the Chrome browser will now show a new red warning when the user clicks on a link that's listed in the Safe Browsing blacklist. "Attackers on (website) might attempt to trick you into installing programs that harm your browsing experience," the warning states. Examples include programs that change the homepage, showing additional ads on visited websites and so on.

As for Google Search, this service now "incorporates signals that identify such deceptive sites," meaning users will likely not see the blacklisted sites in search results. Google has also disabled ads that lead to sites hosting unwanted software.

"If you're a site owner, we recommend that you register your site with Google Webmaster Tools," Ballard said. "This will help you stay informed when we find something on your site that leads people to download unwanted software, and will provide you with helpful tips to resolve such issues."

Google's Safe Browsing website revealed that around one billion people use the service, and "tens of millions" see warnings each week whether it's in Google's Chrome, Apple's Safari or Mozilla's Firefox browsers. Even more, each day Safe Browsing scans "billions" of websites and uncovers ten thousand malicious sites serving up unwanted downloads. Many of these websites are legitimate but have been infiltrated by hackers.

Google began warning about malicious downloads back in April 2011. Moheeb Abu Rajab of the Google Security Team said that a warning will appear when the user clicks on a download URL that matches one residing on Google's latest Safe Browsing blacklist. By comparison, the new Safe Browsing feature introduced this week warns users before they even visit the website hosting the unwanted software.

"We're constantly working to keep people safe across the web," Ballard said.

Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+.

Mozilla's Chief Technical Officer Andreas Gal updated his blog on Wednesday with news that Nightly builds of Firefox will now include VR support. This should be good news for users and developers who previously had to download a special build of Firefox that was typically lagging behind the current Nightly releases.  

"Consumer VR products are still in a nascent state, but clearly there is great promise for this technology. We have enough confidence in the new APIs we have proposed that we are today taking the step of integrating them into our regular nightly Firefox builds," Gal wrote.

Firefox users eager to see the browser in the Oculus Rift headset must not only download the latest Nightly release, but install the WebVR Oculus Rift Enabler add-on and open a "non-e10s" browser window. To open this window, simply choose "File" and then "New Non-e10s Window."

Mozilla engineering Director Vlad Vukicevic said in a separate blog that users must choose a non-e10s window because WebVR in Firefox currently does not support multi-process browsing. He added that Mozilla wants to add Direct-To-Rift support soon in the Nightly build. After that, Mozilla is eying Firefox for Android, Linux and the Cardboard device for mobile VR experiences.

"We'll also be starting to revisit VR support using CSS and the DOM, to maximize compatibility with existing Web content and Web development knowledge," Vukicevic wrote. "You'll also soon be able to report bugs to us via bugzilla.mozilla.org in a new WebVR component."

For the uninitiated, Firefox Nightly is the build where Mozilla first introduces new features and fixes. This allows Mozilla to receive feedback from those willing to test the build. Because it's fresh out of the mixing bowl, the Nightly build can be somewhat unstable. Mozilla warns that this build should only be used by "experienced" users and testers.

Vukicevic also revealed in his blog that VR support will be baked into Beta and Release builds, but disabled. "We're still making rapid improvements and changes to both the VR interfaces and the necessary platform support pieces," Vukicevic said. "Once WebVR is more complete, we'll discuss shipping plans to our Beta and Release builds."

To download the Nightly version of Firefox, head here.

Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+.

Yesterday, Mozilla updated its Firefox browser to version 35. Among the many updates is the official launch of Hello, Mozilla's WebRTC platform. In the past, users had to download programs, the biggest one being Skype, to chat with people via video or audio. By providing the same thing straight from a browser, Hello might be a game changer in video and audio chat.

After upgrading to the latest version of Firefox, Hello should already be available in the menu bar or customization panel. Once it's open, Hello allows you to give a name to the call, or as Mozilla calls it, a "conversation," and you get a URL to share.

The link is unique to the conversation, so the user just needs to copy it and give it to the person they want to call. Hello also "remembers" the link, so if you need to call the same person again, just click the link and an audio notification will tell the user on the other end that you are calling them.

Hello also works across multiple browsers. As long as either person is using Firefox, Hello will work. At the moment, the only WebRTC supported platforms are Chrome, Firefox, and Opera.

But the best part about Hello is that it requires no signup whatsoever. All you need to do is start a conversation and share the link, making the process quick and easy. For those who are looking for a more direct approach to calling, Mozilla also provides contact support. By logging in to a Firefox account, you can also see which of your contacts has a Firefox account and contact them that way. There is also support for Google accounts that imports contact directly to your Hello address book.

I tried Hello for a bit today before writing this story, and for the most part it's really easy to use. When you make a call, a small window for the video call appears on the bottom left corner of the screen, which makes it non-intrusive. On the receiving end, it features a large screen for the other user and a smaller window that shows how you look in the call. Both the audio and video quality is surprisingly great, especially when you consider the fact that it's running from the browser.

However, there are still a few issues with Hello as well as a lack of certain features that puts it behind other programs. The most glaring feature is that Hello is strictly one-on-one. You can't provide the link to more than one person, because each conversation can only hold two people, so conference calling is impossible.

When testing the call on different browsers, I also found that Hello doesn't "know" I'm switching browsers -- which can be a good thing. For example, if I'm on the receiving end of the call, and the caller is using Firefox, I can open Google Chrome and paste the link there to join in. However, we found a glitch. When I opened a conversation in Chrome at one point, I received a message saying that there were already two people in the conversation. Thus, at some point, Hello didn't "remember" that I left the call, opened another browser, and started the call again.

Text chat, as well as the ability to share files, are features currently missing from Hello, and I missed having them. So many conversations on video and audio these days go beyond just talking, as people want to share files such as documents and pictures, not to mention links.

For now, Hello is both a very impressive tool and has a ways to go. Even though everyone can start using Hello, it's important to note that it's still in beta. Additionally, WebRTC, the API that powers Hello, is constantly being worked on since it's an open project with the goal of providing easy and high-quality real-time communications via browsers and mobile devices. There's definitely more work to be done with Hello, but what it offers now bodes a promising future for WebRTC-based platforms.

Follow Rexly Peñaflorida II @Heirdeux. Follow us @tomshardware, on Facebook and on Google+.

The Chrome browser is generally considered the most secure Web browser, and it also tends to do the best in hacking competitions such as Pwn2Own. This is in part thanks to the solid security architecture of Chrome, and to its security engineers, who keep adopting strong security designs and policies.

There's always a compromise between security and flexibility/freedom to do something. Security is very much about reducing the attack vectors, which generally means reducing the freedom to use some features.

Some of those security decisions can go too far sometimes, such as the decision to only allow Chrome extensions to be installed from the Chrome store, when there could have been alternative solutions that are not as restrictive.

On Android, users are still allowed to sideload applications, just like Windows and Mac OS users can still install applications from outside the main store. This feature remains despite Android having a much bigger market share than Chrome, and with sideloaded Android apps being potentially much more damaging than Chrome extensions. Yet the security people in charge of Android have decided it's a necessary freedom that needs to stay within the Android ecosystem.

The Chrome Security Team has recently made a proposal on the Chromium.org site that is bound to make some web developers unhappy but at the same time could be highly beneficial to the Web if implemented properly. The team proposed that all browsers begin marking HTTP (plain-text traffic) websites as "non-secure" beginning next year. This comes after Google already announced this year that HTTPS sites would be getting a slight boost in its search engine.

The new move could immediately make some developers panic. However, the security team proposed that this transition happen gradually in order to give developers time to encrypt their websites with HTTPS, if they have not done it already.

The Chrome team said there are three main states for web properties:

Secure [valid HTTPS, other origins like (*, localhost, *)];Dubious (valid HTTPS but with mixed passive resources, valid HTTPS with minor TLS errors); andNon-secure (broken HTTPS, HTTP).

After the Snowden revelations, we know that HTTP is indeed non-secure, and spy agencies from all over the world can not only intercept and spy on that HTTP traffic, but they can also send malware through it.

Chrome's security engineers proposed that browser vendors make the following four-phase transition:

T0 (now): Non-secure origins unmarkedT1: Non-secure origins marked as DubiousT2: Non-secure origins marked as Non-secureT3: Secure origins unmarked

The goal seems to be that ultimately, most (over 85 percent) sites would be protected with HTTPS, and then they wouldn't need to keep the current green mark that differentiates them from the unprotected HTTP sites. The status quo would be encrypted traffic, and only a small percentage would remain marked as non-secure.

The Chrome team intends to implement its transition plan for declaring HTTP sites "non-secure" next year.

Follow us @tomshardware, on Facebook and on Google+.

As promised last week, Mozilla released a browser created specifically for web designers: the Firefox Developer Edition. This web authoring toolset comes packed with a number of items for designing and debugging websites and apps such as WebIDE, Valence, a web audio editor, a style editor and more.

"The first thing you'll notice is the distinctive dark design running through the browser," said Dave Camp, Director of Developer Tools at Mozilla. "We applied the developer tools theme to the entire browser. It's trim and sharp and focused on saving space for the content on your screen. It also fits in with the darker look common among creative app development tools."

In addition to the web audio and style (CSS) editors, the new developer browser includes a network monitor for viewing network requests made by the browser, a JavaScript Debugger, and a page inspector for checking out the CSS and HTML code of websites. There's also a web console for viewing a web page's logged information as well as a mode for viewing a website or app in different screen sizes without having to resize the browser window.

With this browser, the company is also introducing two new features: WebIDE and Valence. The latter feature was originally called Firefox Tools Adapter, and it allows developers to create and debug apps for a number of browsers and devices. This is made possible by connecting Mozilla's new developer browser to other browser engines.

"Valence also extends the awesome tools we've built to debug Firefox OS and Firefox for Android to the other major mobile browsers including Chrome on Android and Safari on iOS," Camp said. "So far these tools include our Inspector, Debugger and Console and Style Editor.

As for WebIDE, this tool allows apps to be created within the browser by using a template or by opening and editing the code of any Web app. These apps can be run in a simulator with just a single click, and debugged by clicking twice. Users can also edit the app's files.

Developers wanting to get their hands on the Developer Edition can download the browser here. This page also provides video samples of all the tools provided with the browser, including WebIDE, Valence, Web Audio Editor and more.

Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+.

Is Comcast coming down on customers who use the Tor Browser? That seems to be the case according to a report by DeepDownWeb. The Internet service provider is said to be contacting subscribers who are using the software, stating that if they continue to use said browser, their service will be terminated. Why? Because the company deems Tor as an illegal service.

"Users who try to use anonymity, or cover themselves up on the internet, are usually doing things that aren't so-to-speak legal," one Comcast agent told a customer. "We have the right to terminate, fine, or suspend your account at any time due to you violating the rules."

Ouch. The comment indicates that Comcast may be monitoring the online activities of its customers to determine if they're staying within the Acceptable Use Policy. Under "Technical restrictions," prohibited equipment and servers include file sharing and proxy services and servers. The company already allegedly monitors its Internet lanes to spot downloaders of pirated media and software.

According to another Comcast representative, the company only investigates "the specifics" of an account if a court order is provided. If Comcast is forced to provide customer information, then the company contacts the individual first so that they can hire a lawyer. If they do hire a lawyer, then Comcast hands over the case and moves on.

The Tor Browser connects to the Tor network and allows the user to surf the Internet without leaving any traces. The browser is a great tool for those who want to remain anonymous online, but it can also be used to surf for illegal material including child pornography and drugs. Just like many ISPs cracking down on newsgroup access, ISPs may now be viewing the Tor network in a similar light.

The Tor Browser works by accessing a list of Tor nodes from a directory server. The client then picks a random path via other users to the destination server; direct routes are never used. That means if the Tor Browser user visits another site, a different, random path is chosen. You can read a good explanation on how Tor works here via the Tor Project.

The Tor Browser became highly popular after Edward Snowden revealed that the NSA was spying on Web surfers. Over 2 million people now use the Tor Browser, down from the nearly 6 million users tracked one year ago (September 2013). The drop in usage could be related to new anonymous features found in current Web browsers.

A Comcast representative recently said that the company does not monitor browser usage or Web surfing, nor is the company contacting customers using the Tor Browser. Still, Comcast is now listed as a "Bad ISP" by the Tor Project, meaning that the company is not "friendly" to the Tor Network.

Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+.

Ian Morris of Forbes has discovered that Google's Chrome browser for Windows can drain a laptop's battery. The problem was first reported back in 2010, and Google is just now getting around to addressing the problem.

Morris reports that the issue stems from a misuse of the "system clock tick rate." When a user opens the Chrome browser, the rate is automatically set to 1.000 ms, and it stays that way until the user closes the browser. That means the processor, which stays "asleep" when nothing is going on, is awakened 1000 times per second. That can raise power consumption by as much as 25 percent.

When consumers open Internet Explorer or Firefox, the rate will stay at 15.625 ms until the processor is required to do something, and the rate is increased to 1.000 ms. Watch a YouTube video, and the tick rate jumps to 1.000 ms. Close the tab, and Internet Explorer and Firefox will shift back to 15.625 ms.

Morris said that he performed a test on his desktop, and discovered that when idle, it eats up 15 to 20 watts with Chrome running. When he closed Chrome entirely, the power consumption dropped down to 12 to 15 watts. He points out that on a desktop, this isn't a problem, but on a laptop, power consumption is "massively important."

So what can consumers with laptops do about this problem? Switch to a different browser until the issue is resolved. Web surfers can also "star" the issue on the bug tracker. However, given that Google is now looking into the problem (thanks to the coverage, no doubt), using an alternative browser for now seems to be the best option.

Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+

Jason Weber, Partner Group Program Manager of Internet Explorer, announced on Monday the launch of the Internet Explorer Developer Channel, a fully functional release of Microsoft's browser that provides Web developers and early adopters an early taste of the features Microsoft is currently working on.

Customers running Internet Explorer 11 can download the Developer Channel version for Windows 8.1 and Windows 7 SP1 now. The beta browser will run alongside and independently of Internet Explorer 11 so that new features don't interfere with the stable channel's performance. Users of the Dev Channel are asked to provide feedback through @IEDevChat or Connect.

Weber reports that the IE Developer Channel version comes packed with support for the emerging Gamepad API standard, which allows developers to add gamepad support to Web apps and games using JavaScript. That means users can plug in their wired Xbox 360 controller and play web-based titles such as Escape from XP, Atari Arcade games and Hover.IE.

The Developer Channel version also comes with the emerging WebDriver standard. Weber says that developers can "write tests to automate Web browsers to test their sites," and that it's a "programmable remote control for developing complex user scenarios and running them in an automated fashion in your Web site and browser."

IE Developer Channel even includes improvements to the F12 developer tools including an enhanced debugging experience with event breakpoints, richer analysis capabilities throughout the Memory and UI Responsiveness profilers, and an improved navigator experience that includes more keyboard shortcuts.

"As we work on new features and standards, we will continue to share early code through the IE Developer Channel," he writes. "You can always go to the DevChannel.Modern.IE page to learn more about the latest features in the IE Developer Channel. All of the new features supported in IE Developer Channel are also listed on Status.Modern.IE, our new portal to communicate our roadmap for interoperable Web platform features."

Weber warns that IE Developer Channel uses virtualization and code changes so that it can run alongside the stable version of Internet Explorer 11. The virtualization portion causes a performance hit, so the Developer Channel version should not be used to measure a site's performance and should not be installed in an enterprise environment.

Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+.

Mozilla announced the launch of Firefox 29 on Tuesday, reporting that the company has re-imagined and re-designed Firefox to reflect how web surfers use the Internet today. The browser now has a new user interface, customization mode and an enhanced Firefox Sync service powered by Firefox Accounts.

"The first thing you'll notice in Firefox is the beautiful new design that makes it easy to focus on your Web content," reads the company blog. "The tabs are sleek and smooth to help you navigate the Web faster. It's easy to see what tab you're currently visiting and the other tabs fade into the background to be less of a distraction when you're not using them."

Mozilla ripped out the old menu system and placed a re-designed interface in the right corner of the toolbar, using the same three-bar icon found in Google's Chrome. This new menu includes a "customize" tool that allows users to add or move any feature, service or add-on. Other settings in the re-designed menu include New Window, New Private Windows, Save Page, Print, History and more.

The company also updated the Firefox Sync service that provides access to Awesome Bar browsing history, saved passwords, bookmarks, open tabs and form data across the user's computers and mobile Android devices. This feature is powered by Firefox Accounts to simplify the setup and device syncing process.

"We looked at every piece of Firefox and made everything more enjoyable and easier to use – even bookmarks. You can create bookmarks with a single click and manage them from the same place," states the blog.

For those who haven't used Firefox for a while, now may be a good time to test run Mozilla's browser. Save for the text, tabs seemingly disappear when not in use, providing a more streamlined look. The menu itself is extremely easy, providing an app menu-like environment with drag-and-drop capability. The big seller will likely be the customization aspect, allowing users to fine-tune the browser to their own needs, not the needs of the many.

To download Firefox, head here. The list of changes in Firefox 29 can be found here.

The Google Chrome Blog was updated on Wednesday with news of the company's Remote Desktop service extending out to smartphones and tablets. As the name implies, users can now install the Remote Desktop app in the Chrome browser, install the Chrome Remote Desktop app for Android, and then access the desktop from the mobile device.

1. To get this service up and running, first you need to open the Chrome desktop app and enable remote connections; your desktop or laptop should be listed under "My Computers."

2. To provide access to this particular computer, users must create a PIN of at least six digits. This PIN number will be required from the smartphone or tablet.

3. On your Android device's screen, your shared laptop or desktop should be visible. Tap on it, and the app will ask for the PIN number used on the host PC.

4. After that, you should see your desktop on the mobile Android device. Even more, a box stating that "your desktop is currently shared with blah@blah.com" should be positioned at the bottom of the computer's screen. There's also a button to halt the sharing.

That's it; setting up the connection is super easy and super fast.

Once the setup is completed, users can swipe their finger across the smartphone or tablet screen to move the mouse pointer. In this hands-on demo, all three screens were streamed, not just display #1, so maneuvering around on a 4.7-inch smartphone screen took some time, but that's OK. There's seemingly no delay between finger and remote mouse movement. Naturally, remotely accessing the PC was easier on a tablet thanks to the larger screen coverage.

This service would be ideal for those who ran out of the office without their report, for those who continuously go to Mom's house to fix her PC settings, and so on. Users can also remotely open an application, read documents, and even surf the Internet. What's great is that this Chrome service is absolutely free.

To stop sharing, simply hit the button on the bottom of the screen. Keeping this service on indefinitely isn't recommended; the whole blinking cursor thing seems to indicate that this service could interfere with games and applications that require a lot of the PC's resources. If anything, turn it on only when needed.

Although Chrome Remote Desktop has been around for a while now, adding mobile device support is a welcome addition to the Android family. For more information about this new service, head here.

On Sunday, Opera officially launched the Opera Max beta, a free and easy-to-use app that, according to the company, will save users data when using installed apps such as Vine, Google Chrome, Instagram and more.

"Opera Max uses a Virtual Private Network, or VPN, to measure all the data usage on your phone," reads the company's blog. "Once Opera Max savings is enabled, all non-encrypted data requests are sent through our compression servers that optimize video, images, and websites to use less data. We only measure how much data you use and how much data you've saved."

The overall data savings will depend on the applications in use and the type of content that is accessed. Users will see data savings from HTTP non-encrypted apps. Opera Max does not work with applications that use HTTPS encryption (like Facebook) or other protocols.

Back in December, Opera began a limited beta using customers with Android 4.0 "Ice Cream Sandwich" devices in the United States. Then on Tuesday the company began taking pre-registrations for the United States and Western Europe. For now, Eastern Europe will not be able to test Opera Max.

"We've always compressed data, on desktop and mobile browsers," reads the company's blog. "We started in 2005; and, today, we're happy to extend our data-saving ideas beyond browsers to help you save on all your phone's apps, too."

"We want to make sure our servers have enough capacity for all of you, so access to our beta will be given out on a first-come first-served basis," the blog continues. "If you are one of the early US beta testers (and have already installed Opera Max), you do not need to join the queue. We'll auto-update you."

To get into the Opera Max beta, first download and install the app from Google Play here. Once the app is up and running, users will be placed in line (similar to how BBM launched). The team says that they will unlock the app as soon as they know the servers can handle the load. Users will start to see their progress in the queue shortly, and they'll be saving data in no time, the blog concludes.

For more information about Opera Max, head here.

Check out all our Mobile World Congress 2014 coverage here!

Google this week announced changes to Chrome that will help the browser run faster and smoother. This is thanks to a change to the way Chrome compiles JavaScript.

Chrome’s V8 JavaScript engine compiles JavaScript in the main thread, which could in turn affect the performance of the JavaScript app, slowing things down or causing stuttering. The latest Chrome Beta hopes to eliminate that by offloading the JavaScript compilation to a background thread.

V8 defers compilation of JavaScript functions until right before they’re executed for the first time. It’s a fast process, but it doesn’t place any focus on optimizing the code. If a piece of code is executed often will get compiled a second time by an optimizing compiler. This compiler employs advanced optimization techniques, which takes more time than the first compilation, but delivers faster code.

Up until now, V8 alternated between compiling optimized JavaScrip code and executing it. This new version of Chrome Beta introduces concurrent compilation, which means compilation and execution happen at the same time, with V8 optimizing large pieces of code in a background thread.  

Concurrent compilation is, right now, only available with Chrome Beta but should hopefully trickle down to the full version of Chrome in the not too distant future and will ultimately contribute towards reducing latency in Chrome.

Follow Jane McEntegart @JaneMcEntegart. Follow us @tomshardware, on Facebook and on Google+.

Mozilla this week announced that it will launch a program called 'Directory Tiles' that will fill those tiles on a new tab with sponsored content. Don't worry, though. If you're a frequent Tom's Hardware visitor, this doesn't mean your Tom's tile is going to be pushed out of the way in favor of an ad. Instead, this program will only affect new users.

"[New users'] tiles – those nine rectangles that populate over time with the most frequent and recent websites they visit – are empty.  The new tab page isn't delivering any value for them," Mozilla's Darren Herman explained. "Directory Tiles will instead suggest pre-packaged content for first-time users. Some of these tile placements will be from the Mozilla ecosystem, some will be popular websites in a given geographic location, and some will be sponsored content from hand-picked partners to help support Mozilla's pursuit of our mission. The sponsored tiles will be clearly labeled as such, while still leading to content we think users will enjoy."

Mozilla says Directory Tiles carries 'inherent value' for users and helps Mozilla become more diversified and sustainable. That said, it's possible some users will see this as black and white as a once ad-free product displaying ads. After all, it's hard not to play the 'what if' game when a company makes a move like this. What if targeting new users is no longer enough? What if, down the road, Mozilla decides to reduce the number of user-generated tiles to six and save the last row for ads?

Follow Jane McEntegart @JaneMcEntegart. Follow us @tomshardware, on Facebook and on Google+.

The Google Chrome Blog was updated on Wednesday with news of a new release for Chrome Mobile on Android and iOS that promises up to 50 percent in data reduction, thus saving users money on their data plan. This data savings is due to a new compression and bandwidth management feature in Google's mobile browser, launched on Wednesday.

To start saving that precious mobile data, Chrome users simply visit "Settings" > "Bandwidth Management" > "Reduce Data Usage." From there Chrome users can slide the toggle to "On." Even more, on this menu, users can see how much bandwidth they save each month when using Chrome, as seen in the supplied screenshot.

In addition to the data savings, Chrome for Android will allow users to create shortcuts to their favorite websites right on the home screen for faster and easier access to the Web. To make these shortcuts, users simply select "Add to home screen" from the toolbar menu when visiting a site to save. For certain websites, the shortcut will open in a full-screen experience and appear as a separate app in the Android app switcher.

On the Apple iOS front, Google plans to introduce Google Translate in Chrome for iOS in the coming days, so stay tuned.

"With this update, you can now translate webpages in Chrome with the click of a button on your iPhone and iPad, just as you're used to on Chrome for desktop and Android. To translate a page into your phone or tablet's native language, just look for the translation bar and select 'Translate'," writes Matt Welsh, Software Engineer & Data Squasher Extraordinaire.

Download the latest releases of Chrome for Mobile at the Play Store and App Store. The updates will reportedly roll out over the next several days.

Andreas Gal, Mozilla's vice president of mobile and R&D, and Brendan Eich, CTO and SVP of Engineering, have updated Gal's blog with a long entry about how Firefox users can trust Mozilla when it comes to government backdoors and user privacy.

In the blog, they point out that due to laws in the U.S. and elsewhere, Web surfers must interact with Internet services knowing full well that even though cloud service companies want to protect user privacy, eventually one day those companies will be required to comply with laws. The government may acquire information that seems to violate privacy and could even force surveillance. Even more, the government can do so while enforcing gag orders on the service, leaving the consumer unaware.

This creates a problem in regards to privacy and security. Every major browser today is distributed by an organization within reach of surveillance laws, they point out. Injecting surveillance code in a web browser is quite possible.

"The unfortunate consequence is that software vendors — including browser vendors — must not be blindly trusted," they report. "Not because such vendors don't want to protect user privacy. Rather, because a law might force vendors to secretly violate their own principles and do things they don't want to do."

They also point out that unlike other browser vendors, Mozilla's products are truly open source. That's a "critical advantage," as Internet Explorer is closed, and both Safari and Chrome have open-source rendering engines, but contain "significant" fractions of closed source code. By being 100 percent open source, security researchers can verify the executable bits contained in the browsers Mozilla is distributing.

However, the answer to getting real trust, it seems, is to create a global audit system verifying that Firefox isn't immediately injected with government-tainted code at the request of court orders.

"To ensure that no one can inject undetected surveillance code into Firefox, security researchers and organizations should regularly audit Mozilla source and verified builds by all effective means, establish automated systems to verify official Mozilla builds from source, and raise an alert if the verified bits differ from official bits," they suggest.

"Beyond this first step, can we use such audited browsers as trust anchors, to authenticate fully-audited open-source Internet services? This seems possible in theory," they add.

Brad Smith, General Counsel & Executive Vice President of Legal & Corporate Affairs at Microsoft, recently updated Microsoft's blog with a post assuring customers that their personal data is safe from government snooping. The company is taking steps to ensure governments use a legal process rather than technological brute force to access customer data.

"Like many others, we are especially alarmed by recent allegations in the press of a broader and concerted effort by some governments to circumvent online security measures – and in our view, legal processes and protections – in order to surreptitiously collect private customer data," Smith writes. "In particular, recent press stories have reported allegations of governmental interception and collection – without search warrants or legal subpoenas – of customer data as it travels between customers and servers or between company data centers in our industry."

In light of the allegations, Microsoft has decided to expand encryption across all services, reinforce legal protections for customer data, and enhance the transparency of the company's software code, making it easier for customers to reassure themselves that products do not contain back doors. For the latter, Microsoft plans to open transparency centers in Europe, the Americas and Asia so that government customers can review the company's source code and make sure no back doors are installed.

On the encryption front, customer content moving between users and Microsoft will be encrypted by default. All key platform, productivity and communications services will encrypt customer content as it moves between data centers. Microsoft will also use best-in-class industry cryptography to protect these channels, including Perfect Forward Secrecy and 2048-bit key lengths. All of this will be in place by the end of 2014, and much of it is effective immediately, he writes.

"We also will encrypt customer content that we store. In some cases, such as third-party services developed to run on Windows Azure, we'll leave the choice to developers, but will offer the tools to allow them to easily protect data," Smith adds. "We're working with other companies across the industry to ensure that data traveling between services – from one email provider to another, for instance – is protected."

As for reinforcing legal protections, Microsoft will take new steps to reinforce legal protections for customer data. As an example, Microsoft will notify businesses and government customers if the company receives legal orders related to their data. If a gag order prevents Microsoft from doing so, then the company will challenge it in court. Microsoft will also assert available jurisdictional objections to legal demands when governments request customer content stored in another country.

"Except in the most limited circumstances, we believe that government agencies can go directly to business customers or government customers for information or data about one of their employees – just as they did before these customers moved to the cloud – without undermining their investigation or national security," he writes. "And when those limited circumstances arise, courts should have the opportunity to review the question and issue a decision."

To read the full blog, head here.

Back in September, Microsoft launched the Release Preview of Internet Explorer 11 for Windows 7. Currently, the company is releasing the full version of Internet Explorer 11. The company announced today that Windows 7 users can now enjoy the same version of IE that is shipping with Windows 8.1.

The browser is available worldwide in 95 languages and will be rolling out to Windows 7 users over the next few weeks. First to get the update will be those already running the Developer and Release Preview version of the software.

Internet Explorer 11 brings improvements in performance (faster page loading, faster interactivity, faster JavaScript performance) and is less taxing on your CPU and battery.

Follow Jane McEntegart @JaneMcEntegart. Follow us @tomshardware, on Facebook and on Google+.

In light of all the controversy surrounding cookies and possible real-time monitoring by the government, on Friday Mozilla announced the launch of Lightbeam, an add-on for Firefox that allows the web surfer to see who is tracking them online. After installation, Lightbeam will create a record of events for every site the user visits and every third party site that is stored locally via cookies on the user's browser.

"Lightbeam visually graphs these events to highlight the interactions between sites you intentionally visit and the third parties," reads the product description. "Lightbeam will continue to add to your graph as you browse the Web. You can stop Lightbeam at any time by disabling it or uninstalling the add-on. Your Lightbeam data can be easily saved or deleted."

Mozilla's Alex Fowler said that the company set out to create a big picture view of Web tracking, and how first and third party sites are connected to each other. "Development of Lightbeam for Firefox, we worked with a number of leading online publishers about the value of the crowdsourced data," he said. "More work is needed, though. Once the open data set has time to mature, we'll continue to explore how publishers can benefit from additional insights into the interaction of third parties on their sites."

Once installed, Lightbeam users will find the logo installed in the bottom right hand corner of the browser. Click on it, and the Lightbeam screen loads up in another tab. At the bottom right, users can toggle between Recent Site, Last 10 Sites, Daily and Weekly to see how they are tracked across the Internet. Just for kicks, I loaded up Tom's Hardware and received a full cloud of sites (shown above).

According to the chart, 40 third-party sites were attached to the Tom's Hardware nucleus by cookie-based data and other connections. These include Google Services, Google Syndication, Doubleclick, Twitter, Moockie1, Yieldmanager, and a number of our affiliates and tools that help make the Tom's world go round. Facebook and Google actually tracked my journey to Tom's, it seems.

The legend shows that triangles are third-party sites, and circles are visited sites. The more connections these sites have to your data, the larger they become. The purple lines represent connections via cookies, whereas each site you supposedly visit is connected by a white line, seemingly whether directly or indirectly.

Lightbeam also provides information in a graph, as a clock and in a list. The graph looks like an atom of sorts (or a ball with lots of balloons), whereas the clock resembles the side view of a planet, with the data shooting outwards in a straight line every 15 minutes or so. Out of the few sites I tested with Lightbeam, Tom's Hardware has the least number of connections. Naturally, Facebook was loaded, as was the Mozilla Festival website.

"Not all tracking is bad. Many services rely on user data to provide relevant content and enhance your online experience. But tracking can happen without the user’s knowledge," reads the Lightbeam page. "That’s not okay for some. It should be you who decides when, how and if you want your browsing data to be shared. We recognize the importance of transparency and our mission is all about empowering users — both with tools and information."

By default, the data collected by Lightbeam is yours and yours only. However, Mozilla provides an option for sharing this information so an even bigger picture can be created from a pool of users. To see who is tracking you, download the add-on here.

Follow us @tomshardware, on Facebook and on Google+.

While a stalwart cadre of PC users has stuck with Windows XP for the past decade, Microsoft has said that its support of the OS will end on April 8, 2014. Earlier today Google announced that it would continue patching and updating Chrome for XP an additional year – until 2015.

Mark Larson, the Superintendent of Public Safety at Google said in a blog post, "Our goal is to support Chrome for XP users during this transition process. Most importantly, Chrome on XP will still be automatically updated with the latest security fixes to protect against malware and phishing attacks."

Supporting legacy software is often rough – the code’s flaws are much better known by definition and that tends to make computers running older, outdated tech significantly more vulnerable to attack. That aside, many businesses still rely on bulk licenses to keep their  enterprises running, and the closer we get to that April 8^th deadline, the more likely those IT departments will be forced to switch over.

For a good chunk of people, that’s going to mean big change and certainly plays into Microsoft’s hands as it brings in new bulk licenses for its latest operating systems.

Chris Lee, Director of Product for Firefox OS, updated the Mozilla blog with news that the company's mobile operating system has been updated to v1.1. The release arrives after the first Firefox OS phones hit the market this summer, and now provides new features, significant performance improvements and support for more than 15 new languages.

That said, Mozilla announced in a separate blog that Firefox OS is expanding into new territories. Telefonica has already released the ALCATEL ONE TOUCH Fire and ZTE Open devices in Spain, Venezuela and Colombia, and now plans to launch Firefox OS in Brazil and three other Latin America markets in 4Q 2014.

Meanwhile, Poland's Deutsche Telekom has rolled out Firefox OS devices under the T-Mobile brand, and is currently planning to launch a device in Germany this month using the Congster brand, followed by additional devices in Greece and Hungary. Norwegian operator Telenor has also confirmed that it plans to launch Firefox OS phones in Hungary, Serbia and Montenegro before the end of the year.

"The positive market reception of the first Firefox OS smartphones demonstrates that people like the user experience and openness we're building with Firefox OS," said Jay Sullivan, Mozilla Chief Operating Officer. "We continue to enhance Firefox OS to deliver the best experience for the many people around the world buying their first smartphones. We are looking forward to seeing the response to the next round of Firefox OS launches."

As for Firefox 1.1, the updated platform now supports sending and receiving pictures, audio and video files via MMS, and providing an adaptive app search directly on the home screen. There's also a push notifications API so that developers can push timely notifications, the new ability to download images, audio and video in the browser, and keyboard improvements.

Firefox OS 1.1 also promises faster application load times and smoother scrolling, email enhancements, calendar enhancements, contact management enhancements, and a new music search. This function allows users to simply swipe down from the top of the Music app to reveal a search bar and find music by artist, album or song title. Email enhancements include a draft mode, sending image attachments and downloading audio and video attachments.

Firefox OS is a Linux-based open-source OS that heavily relies on web technologies such as HTML5, JavaScript, CSS3, open web APIs that communicate directly to hardware, and so on. The platform includes its own Marketplace that offers popular apps like Facebook, The Weather Channel, Twitter, TMZ and a number of others. Most apps don't require to be installed while others are less intrusive on the device than native apps found on Android and iOS.

"Mozilla is working on Firefox OS with more than 20 hardware and operator partners to deliver a better and more attainable smartphone experience to first time smartphone buyers around the world, as only 21 percent of global mobile subscribers have smartphones," the Mozilla blog states.

Not to be outdone by Google's report of blocking most plugins within Chrome starting January 2014, Mozilla updated its own blog reporting that Firefox will no longer activate most plugins by default, starting with the latest Aurora release.

On Tuesday, Mozilla's Benjamin Smedberg said that when a website tries to use a plugin, users can choose whether to enable it or keep it blocked. Ultimately, this should provide a better Firefox experience on a performance level, as plugins are known to be a source of hangs, crashes, and security incidents. Putting control in the hands of users should keep them more secure and the browser running more smoothly.

However, the one plugin that won't be blocked by default is Adobe Flash because it's used just about everywhere on the World Wide Web.

"Many websites use 'hidden' Flash instances that the user does not see and cannot click on; making Flash click-to-play would be confusing for most users," he said. "Users with older versions of Flash that are known to be insecure will see the click-to-activate UI and will be prompted to upgrade to the latest version. Our security and plugin teams work closely with Adobe to make sure that Firefox users are protected from instability or security issues in the Flash plugin."

Back in March, Mozilla conducted a user research survey on the prototype implementation of click-to-play plugins (pdf), and quickly discovered that many Firefox users actually had no idea what a plugin was. As Smedberg pointed out earlier in his blog, many plugins go unnoticed on web pages, so when participants suddenly had to enable these plugins on the same site repeatedly, they grew highly annoyed or confused. Mozilla decided to fix that.

"We redesigned the click-to-play feature to focus on enabling plugins per-site, rather than enabling individual plugin instances on the page," he said. "Advanced users who want to activate individual instances may still do so by installing a Firefox extension. We encourage people who want to try the new plugin experience to use the Mozilla Nightly or Aurora preview releases."

At one time, plugins were ideal for prototyping and implementing new features, but now that browsers have matured, these features can be tested within the browser environment thanks to WebGL, WebSockets, WebRTC and asm.js. Plugins have become legacy technology, they're a consistently growing security threat, and are not used on most mobile devices.

Mozilla is now encouraging website developers to ditch plugins if possible, and to hit the mozilla.dev.platform project list to request plugin features not available in the web platform.

Google said earlier this week that most plugins will be outright banned in Chrome starting January. As of Monday, the Chrome Web Store began rejecting new Apps and Extensions based on the Netscape-based plugin tech, and will delist current NPAPI-based Apps and Extensions in May 2014, followed by a complete removal in September 2014. Installed Apps and Extensions will continue to work until support for NPAPI is removed at the end of 2014.

This month Google turns 15 years old. That's pretty crazy when you think about where the company has gone from being the work of two Stanford students to now the internet monolith it is. Either way, it all started with search, and today we're treated to a bit of an easter egg that'll give you a blast from the past.

Go to Google and search for "google in 1998" and you'll see this:

Google has come a long way in the last decade and a half, and today blogged about many important new features its added since 1998.

Follow Marcus Yam @MarcusYam. Follow us @tomshardware, on Facebook and on Google+.

_{Contact Us for News Tips, Corrections and Feedback}

Justin Schuh, Security Engineer and Plug-in Retirement Planner for Google Chrome, said on Monday that browser plug-ins based on the popular Netscape Plug-in API architecture will be blocked starting next year. The roll-out will be in stages, with webpage-instantiated NPAPI plug-ins blocked by default on the Stable channel in January 2014.

The most popular NPAPI plug-ins used in the Chrome browser include Silverlight (15 percent), Unity (9.1 percent), Google Earth (9.1 percent), Java (8.9 percent and is already blocked by default), Google Talk (8.7 percent) and Facebook Video (6 percent). These will be temporarily white-listed to avoid disruption to users, he said, for an unspecified amount of time.

"The Netscape Plug-in API (NPAPI) ushered in an early era of web innovation by offering the first standard mechanism to extend the browser," Schuh explained. "In fact, many modern web platform features—including video and audio support—first saw mainstream deployment through NPAPI-based plug-ins. But the web has evolved. Today's browsers are speedier, safer, and more capable than their ancestors."

He said NPAPI's 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity. Because of this, Chrome will be phasing out NPAPI support over the coming year. In the short term, users and businesses will be able to white-list specific plug-ins, but eventually NPAPI support will be completely ripped out of the Chrome browser.

"We expect this to happen before the end of 2014, but the exact timing will depend on usage and user feedback," Schuh said. "Note that the built-in Flash plug-in and PDF viewer will be unaffected because they don't use NPAPI."

Google switched the Flash Player plug-in bundled with Chrome for Windows from NPAPI to a new plug-in architecture called Pepper Plugin API, or PPAPI, back in August 2012, and then made the switch in Chrome for Mac OS X one month later. Google's PPAPI forces plug-in code to run securely inside a sandbox, thus making Flash Player less susceptible to crashes.

As of Monday, the Chrome Web Store will be refusing new Apps and Extensions containing NPAPI-based plug-ins, and developers with current solutions offered on the platform will be able to make updates until they will be removed from the store's home page, search results and category pages in May 2014. In September 2014, all existing NPAPI-based Apps and Extensions will be unpublished. Installed Apps and Extensions will continue to work until support for NPAPI is removed at the end of 2014.

Schuh said developers relying on NPAPI can use alternatives where standard technologies are not yet sufficient, including NaCl, Native Messaging API, and Legacy Browser support. However, moving forward, the Chrome team is shooting to evolve the standards-based web platform to cover the scenarios currently served by NPAPI.

"We feel the web is ready for this transition," he said. "NPAPI isn't supported on mobile devices, and Mozilla plans to block NPAPI plug-ins in December 2013."

Mozilla has moved the touch-friendly version of Firefox out of the nightly channel and into the Aurora channel. The company is now asking Firefox users to take the updated browser for a spin and send in feedback. As before, in order to use the touchy side of Mozilla's browser, Windows 8 customers will need to set this version as the default so that Windows 8 doesn't send them straight to the desktop.

"This touch-friendly version of Firefox has been designed to ensure people get the best browsing experience on their Windows 8 tablet," the company said. "It has a tile-based Firefox Start experience and supports Firefox Sync, Windows 8 touch and swipe gestures, Snapped and Fill views, and Windows Share integration all delivered with a streamlined, modern and beautiful interface."

As stated several weeks ago by Mozilla, the goal of this "Metro Preview Release" is to gather feedback and defects from the larger Aurora community. Whether or not the Metro Preview Release will graduate from Aurora to Beta and Release channels is still to be determined, the company said. But if all goes well, the final release of Firefox 27 with the Modern UI version intact will be on January 21, 2014.

Originally the plan was to release the touchy version of Firefox to the Aurora channel on September 16, and market it as the Metro Preview Release. All Aurora features would then be merged into the Beta channel on October 28, thus making the Windows 8 touch-based version available to the Beta audience. After that, Firefox Metro was scheduled to be released on December 10. That has obviously changed, and could likely still as Mozilla receives feedback from the Aurora build.

"Because this new version of Firefox uses the same powerful Gecko rendering engine as in Firefox desktop, there’s also support for WebGL for compelling 3D graphics and asm.js which supercharges JavaScript in the browser, allowing developers to port high performance C++ games to the Web," the company said. "Hardware accelerated full HTML5 video is also supported, including open video formats like WebM and proprietary formats such as H.264."

Mozilla added that over the coming weeks, the company will be almost exclusively focused on improving performance and responsiveness. The company also points out that this is still a preview build, and while many of the features are nearly complete, expect some performance issues and bugs.

If for some reason Windows 8 refuses to set the aurora build as the default browser after the initial confirmation (meaning you're still kicked back to the desktop version), simple head into Firefox and load up the Options/Advanced/General panel to manually set it as the default program.

To try the new build of Firefox for the Windows 8 Start screen, head here.

Follow us @tomshardware, on Facebook and on Google+.

_{Contact Us for News Tips, Corrections and Feedback}

On Wednesday Microsoft announced the launch of the Release Preview of Internet Explorer 11 for Windows 7. Consider yourself lucky, as Windows 8 users are still stuck with Internet Explorer 10 unless they've installed the preview build of Windows 8.1. The latest browser isn't slated to officially land on Windows 8 until October 18, so expect the final Windows 7 build to arrive sometime after that.

Internet Explorer 11 Release Preview arrives just two months after the Developer Preview, and promises 30 percent faster performance than other browsers on Windows 7. The company also claims that this Release Preview build is around 9 percent faster than Internet Explorer 10 and 5 percent faster than the preview Developer Preview build.

"IE11 Release Preview for Windows 7 includes updates to reflect the latest emerging Web standards," the company said on Wednesday. "For example, now that the Pointer Events specification is a Candidate Recommendation at the W3C, IE11 supports an un-prefixed version of the emerging standard. With Pointer Events support across the full range of Windows devices (and soon to other browsers), Web sites can easily build experiences that work equally well with mouse, keyboard, pen, and touch."

The company has also upgraded the developer tools to make it easier to diagnose and optimize web apps used within the Internet Explorer environment. This includes mapping WebGL errors to the corresponding JavaScript location, an improved file picker for faster access to files in a complex Web project, and an updated F12 tool that now identifies what operations were performed on allocated data between memory snapshots.

"IE11 Release Preview for Windows 7 adds new user controls for the Standard Delivery Profile for Closed Captioning," the company said. "With the new control, accessible from the Internet Options menu, users can customize how captions appear in the browser, even overriding the default styling provided by the video source. This customization further advances IE11 as the best browser for professional-quality online video without plugins."

Web surfers on Windows 7 can download the Release Preview of Internet Explorer 11 directly from Microsoft here. Virtual Machine images of Internet Explorer 11 Release Preview for Windows 7 will also be available on modern.ie later this week, the company said. Microsoft has also made available the Internet Explorer 11 Developer Guide here.

After installing the new browser, Internet Explorer 11 users can visit the IE Test Drive site and check out a few demos including Levitation, Lawnmark and Lite-Brite. The company has also added PirateMarrrk, which tests the browser's HTML5, JavaScript, and Scalable Vector Graphics performance, in celebration of International Talk Like a Pirate Day.

Follow us @tomshardware, on Facebook and on Google+.

Microsoft launched on Thursday the developer preview of Internet Explorer 11 for Windows 7. It follows the release of Microsoft's latest browser in Windows 8.1 Preview, which requires Windows 8 customers to install the OS update before they can test-drive the latest Internet Explorer build. The company confirmed late last month that the browser would eventually be brought to Windows 7 customers although a time frame was not provided.

"In IE11, developers can build next generation experiences with professional-quality Web video, and hyper-fast 2D and 3D Web technologies that make the most of the underlying hardware," the company said. "IE11 supports real world standards and compatibility, and new developer tools enable developers to build high-performance Web experiences."

Microsoft said that Windows 7 customers will receive all of the performance, security, and under-the-hood changes that went into the Windows 8.1 version. These include natively decoding JPG images and text in real-time on the GPU – both of which are the heart and soul of the Internet. It also implements the W3C Resource Priorities standard enabling developers to specify which parts of the page are important and need to be loaded first.

"IE11 also supports HTML5 link prefetching and pre-rendering, so developers can help the browser anticipate where you’ll go next and get those pages ready," the company said. "On Windows 8.1, IE11 also supports the SPDY network protocol, the precursor to the HTTP 2.0 specification, enabling some sites to be downloaded faster."

Microsoft also pleads its case regarding IE11 supremacy and the new Chakra JavaScript engine, claiming that it's significantly faster than Chrome, Firefox and Opera. On Windows 7, IE11 is 4 percent faster than IE10, and nearly 30 percent faster than the nearest competitive browser – according to the WebKit SunSpider JavaScript benchmark, that is.

The company points out that Internet Explorer 11 supports WebGL for GPU-powered 2D and 3D graphics, and plugin-free HTML5-based video. All the latest standards for closed captioning is supported as well as is the HTML Full Screen API and WebCrypto. The version on Windows 8.1 also supports the latest media streaming standards, Media Source Extensions (MSE) and Encrypted Media Extensions (EME).

"IE11 includes a completely re-designed and enhanced suite of in-browser F12 developer tools," the company said. "These tools help Web developers diagnose and optimize their apps quickly and efficiently. Having fast and reliable Web apps is more critical than ever. The new F12 supports the fast, iterative workflow used by modern Web developers. F12 helps developers get from problem to solution quickly with actionable data, enabling fast and fluid Web experiences."

The full disclosure about Internet Explorer 11 for Windows 7 can be read here along with a link to the download.

A few interesting tidbits have popped up since Google introduced Chromecast less than 24 hours ago, including some of the specs and tips on how to load up videos stored on a hard drive. Google's streaming gadget went on sale for $35 on Wednesday, only to immediately sell out, making Chromecast a seemingly cheap and popular alternative to purchasing a set-top box or Smart TV.

According to the specs, Chromecast is powered by a Marvell "Armada" DE3005 chip and an AzureWave 2.4 GHz Wireless N chip. The details were spilled by updated FCC documents that originally evaluated the device as a Google H840 Device labeled H2G2-42.

Unfortunately, Marvell doesn't show the DE3005 on its website, so we couldn't get the specifics -- the chip could be a custom solution for Google's gadget. The closest relative would be the Armada 1000 (88DE3010) which has two "Sheeva" cores clocked up to 1.2 GHz, dedicated hardware acceleration for multi-format video and audio decoding, and a Qdeo processing pipeline. This chip supports HDMI v1.3.

There's also the Armada 1500 (88DE3100) which is a bit more feature-rich, packing two ARMv7 compatible PJ4B CPU cores with symmetric multi-processing and clocked at 1.2 GHz, a dedicated security engine, support for USB 2.0 OTG, support for HDMI v1.4, a Vivante GC1000 graphics core, 512 kb of L2 cache, a Qdeo pipeline and so on. We're betting the chip used in Google's Chromecast is similar to this one.

Based on the FCC shots, the AzureWave chip used in Chromecast may be the AW-NH387. This combo chip combines Wireless N, Bluetooth 3.0 + HS and FM radio into one solution. FM bands are supported, the specs read, and supports the European Radio Data Systems (RDS) and the North American Radio Broadcast Data System (RBDS) modulations. If this is indeed the chip, does this mean Google plans to open up Bluetooth and FM radio capabilities in the future?

As for the whole power cord aspect, the FCC shows an image of the device plugged into the back of an HDTV during testing. The power cord is clearly dangling from the device, meaning despite Google's presentation of merely connecting and steaming with no visible wires, that indeed is not the case. Chromecast doesn't have a battery, so users will either need to plug it into a wall outlet, or possibly a spare USB port on the HDTV to provide power.

As for additional Chromecast specs, the device sports Micron D9PXV 4 Gb DDR3-1600 RAM and 4 GB of Micron flash memory (29F16G08MAA). The device also supposedly uses a simplified version of Chrome OS instead of Android to better handle media tuned in from a Chrome browser on a desktop or laptop. Chrome's browser extension for the gadget, which will essentially let users play any Flash-based video on Chromecast, can be installed here.

One Reddit user discovered that Chromecast owners can play any video from their hard drives as well. Simply open the Chrome browser, type in C:/ in the address bar, and navigate to any locally stored video. Actually, this should work on any mapped hard drive.

Getting a new $35 Chromecast may be a bit difficult for now. Various reports point to stock selling out quickly both online and offline. Google Play is now showing a three to four week delay in shipments, and Amazon is currently listing it as "out of stock." Best Buy's product page says it's sold out online.

Besides Windows 8.1, another big topic at Microsoft Build 2013 is Internet Explorer 11. Not surprisingly, IE11 was designed with touch technologies heavily in mind, given the new focus of Windows 8 and the new generation of devices. IE11 will also allow users to pin active and live tiles to the Start Screen, rather than just a static link. Websites that still use mouse-over hover features, such a Ebay's navigation tabs, rarely worked well on tablets, but IE11 preserves that functionality.

Under the hood, IE11 has further speed improvements. Microsoft boasts that current testing has IE11 performing better on the SunSpider benchmark better than the rest of the pack. Microsoft further demonstrated its speed leadership by showing off a WebGL page with a rotating Windows logo. On IE11, the animations were smooth, while running the same demo on Firefox was very slow and laggy. A similar grass growing demo called Lawn Mark also showed IE11 as being faster than the latest Google Chrome.

While we're sure that the engineering team has done what it can to optimize performance in software, a the performance delta shown between IE11 and the rest is all thanks to hardware acceleration. All the demonstrations were GPU accelerated. Not only did the video acceleration make multimedia smoother, but also the rendering of text, the scrolling of web pages, and the entire JPEG pipeline. Microsoft claims that IE11 renders text 30% faster than the competition.

Other improvements behind the scenes include web pre-fetching, pre-render, and instant back navigation. This means less waiting and could be a boon to those on slower connections. IE11 will also support adaptive streaming, which will make for a better YouTube experience. Microsoft also demonstrated Netflix running inside the browser in HTML5 -- no Silverlight plugin needed.

Just as how Windows 8.1 allows for more multi-window option, so too does IE11. Other new features include tabs displaying in the modern app mode, as well as syncing of tabs, favorites and frequently visited sites across devices -- if the user chooses to. Taking a page from other browsers, IE11 offers a feature called Reading List that can save a webpage for future reading.

IE11 is shaping up to be a browser that will change people's perceptions of Internet Explorer. To reach as big a reach as possible, IE11 will also be available on Windows 7.

Those interested in checking out a preview of IE11 right now can find it on the Windows Store.