Pioneering search engine AltaVista opened its service to the public 30 years ago. The original fast and clean internet search destination launched on December 15, 1995, with an enormous (for the time) 16 million pages indexed. Within a year of its establishment, it scaled from a day-one workload of handling 300,000 user queries to tens of millions of requests every day. That’s impressive, given that the service went live ostensibly as a tech demo for DEC’s Alpha server hardware.

AltaVista rises - propelled by powerful hardware

A big part of the initial success story of AltaVista was indeed due to the hardware that powered it. As a showcase project created by Digital Equipment Corporation's Network Systems Laboratory and Western Research Laboratory, it isn’t surprising that this search engine’s performance was propped up by some of the most powerful servers of the era.

Specifically, AltaVista was launched as an Internet search service powered by a DEC Alpha 8400 Turbolaser system, say some sources. We think credit to that precise server model might be uncertain, due to upgrades over the years and exact specs being lost in the sands of time. The 8400 servers came with up to 14 CPUs running at up to 612 MHz, up to 28GB of RAM, and had 144 PCI slots.

We’ve already sketched out the explosive but almost accidental success that the youthful AltaVista would see. Its architecture, mixing a web crawler dubbed Scooter and a back-end index server called TurboVista, delivered fast and accurate results in the early days of the public adoption of the World Wide Web.

At its inception, AltaVista stood apart from the dominant Internet directories, which had become the default home pages of many. Instead of some kind of curated directory, surfers could tap into the quickly expanding full extent of the Internet thanks to Scooter and TurboVista tirelessly beavering away.

Illustrative of its rapid climb to being a top-tier Internet company, in 1996, AltaVista became the exclusive provider of search results for Yahoo! That’s the year after it launched.

Google arrives with its PageRank algorithm

Describing the rise of Google is another topic in its own right. However, to cut a long story short, its origins are found in Larry Page and Sergey Brin’s BackRub Stanford research project. That’s a good project name, as it almost encapsulates an algorithm that became the jewel in Google’s crown – PageRank.

With PageRank at its heart, Google was founded in 1998 and enjoyed explosive early growth in 1999. People liked the AltaVista-like, simple, clean search UI Google offered, and generally warmed to its weighted, relevant results, served by the PageRank algorithm’s analysis of over 50 million pages in 1999.

In 2000, Google made its business breakthrough, becoming the default search engine for one of the earliest Internet icons, Yahoo!

AltaVista falls - Changes of ownership, and years of decline

If you’ve read all the above, you can see a crossover or collision occur, as AltaVista declines and Google rises. AltaVista sought to fend off Google in the early 2000s with interface and indexing relevance tweaks. However, between 1999 and 2001, Google stole the momentum, knocking the wind out of AltaVista’s sails. An oft-quoted stat puts AltaVista vs Google user share at 17% vs 7% in the year 2000, but the tables were turned very shortly after that.

Famously exerting further downward pressure on AltaVista were a string of acquisitions, where it changed hands from DEC, to Compaq, to CMGI, to Overture Services, and then by acquisition of Overture to Yahoo! Along the way, AltaVista moved away from the clean search results first UI into becoming an all-singing all-dancing portal, helping nail its coffin shut (Hi Google).

Though it was formally shut down by Yahoo! in 2013, nearly 18 years after it first made WWW waves, many of us remember AltaVista fondly. It pioneered the fast and uncluttered search results model users loved, before Google stole its clothes and its thunder. It also introduced genuinely helpful online extras like advanced search operators, translations, and free ISP-agnostic webmail for those who didn’t want Hotmail. All this, before it was killed by mismanagement and becoming bloated.

Search has always been the Internet’s most important utility. Before Google became dominant, there were many contenders for the search throne, from Altavista to Lycos, Excite, Zap, Yahoo (mainly as a directory) and even Ask Jeeves. The idea behind the World Wide Web is that there’s power in having a nearly infinite number of voices. But with millions of publications and billions of web pages, it would be impossible to find all the information you want without search. 

Google succeeded because it offered the best quality results, loaded quickly and had less cruft on the page than any of its competitors. Now, having taken over 91 percent of the search market, the company is testing a major change to its interface that replaces the chorus of Internet voices with its own robotic lounge singer. Instead of highlighting links to content from expert humans, the “Search Generative Experience” (SGE) uses an AI plagiarism engine that grabs facts and snippets of text from a variety of sites, cobbles them together (often word-for-word) and passes off the work as its creation. If Google makes SGE the default mode for search, the company will seriously damage if not destroy the open web while providing a horrible user experience.

A couple of weeks ago, Google made SGE available to the public in a limited beta (you can sign up here). If you are in the beta program like I am, you will see what the company seems to have planned for the near future: a search results page where answers and advice from Google take up the entire first screen, and you have to scroll way below the fold to see the first organic search result.  

For example, when I searched “best bicycle,” Google’s SGE answer, combined with its shopping links and other cruft took up the first 1,360 vertical pixels of the display before I could see the first actual search result. 

For its part, Google says that it’s just “experimenting,” and may make some changes before rolling SGE out to everyone as a default experience. The company says that it wants to continue driving traffic offsite.

“We’re putting websites front and center in SGE, designing the experience to highlight and drive attention to content from across the web,” a Google spokesperson told me. “SGE is starting as an experiment in Search Labs, and getting feedback from people is helping us improve the experience and understand how generative AI can be helpful in information journeys. The experiences that ultimately come to Search will likely look different from the experiments you see in Search Labs. As we experiment with new LLM-powered capabilities in Search, we'll continue to prioritize approaches that will drive valuable traffic to a wide range of creators." 

By “putting websites front-and-center,” Google is referring to the block of three related-link thumbnails that sometimes (but not always) appear to the right of its SGE answer. These are a fig leaf to publishers, but they’re not always the best resources (they don’t match the top organic results) and few people are going to click them, having gotten their “answer” in the SGE text.

For example, when I searched for “Best CPU,” the related links were from the sites Maketecheasier.com, Nanoreview and MacPaw. None of these sites is even on the first page of organic results for “Best CPU” and for good reason. They aren’t leading authorities in the field and the linked articles don’t even provide lists of the best CPUs. The MacPaw article is about how to choose the best processor for your MacBook, a topic that does not match the intent of someone searching for “best CPU,” as those folks are almost certainly looking for a desktop PC processor.

A Plagiarism Stew

Even worse, the answers in Google’s SGE boxes are frequently plagiarized, often word-for-word, from the related links. Depending on what you search for, you may find a paragraph taken from just one source or get a whole bunch of sentences and factoids from different articles mashed together into a plagiarism stew. 

When I searched “which is faster the Ryzen 7 7800X3D or the Core i9-13900K,” the Google SGE grabbed an exact phrase from our Tom’s Hardware article comparing the two CPUs, writing “The Ryzen 7 7800X3D is 12% faster than the Core i9-13900K at 1080p gaming and 9% faster at 1440p.” It then rephrased two sentences from this article on Hardware Times. The original copy read as:

“The Core i9-13900K snags a win in “A Plague Tale” both with and without ray-tracing. It’s marginally faster than the Ryzen 7 7800X3D with similar lows. The tables get turned in Assassins’ Creed Valhalla as the 7800X3D edges past the 13900K in Ubisoft’s latest title.”

And Google’s AI wrote it as:

“The Core i9-13900K is marginally faster than the Ryzen 7 7800X3D in ‘A Plague Tale’. However, the Ryzen 7 7800X3D edges past the Core i9-13900K in Assassins' Creed Valhalla.”

You can even clearly see in our screenshot that our sentence is quoted word-for-word in Google’s “featured snippet” box but not in the SGE box (which will likely replace the featured snippets in the future since SGE does basically the same thing). Yes, both the Hardware Times article and the Tom’s Hardware article that Google’s bot copied data from are listed as related links on the right side of the box. 

When I asked Google about the fact that its SGE answers are frequently word-for-word copies drawn from the related links articles, the company said that it picks those links because they “corroborate” the responses.

“Generative responses are corroborated by sources from the web,” the spokesperson said. “And when a portion of a snapshot briefly includes content from a specific source, we will prominently highlight that source in the snapshot.”

It’s pretty easy to find sources that back up your claims when your claims are word-for-word copied from those sources. While the bot could do a better job of laundering its plagiarism, it’s inevitable that the response would come from some human’s work. No matter how advanced LLMs get, they will never be the primary source of facts or advice and can only repurpose what people have done. LLMs are relatively good at generating “creative” works that are designed to be a mashup of existing ideas (ex: “write me a haiku about farts”) but, until they are connected to robotic bodies that go out and gather information first-hand, they will never be a source of truth.

The company also said that “you can expand to see how the links apply to each part of the snapshot.” There’s an expand icon that sits inconspicuously in the upper right corner of the SGE box, above the third related link. And, if you decide to click it, you will see a clunky interface which puts the thumbnails for related links inline with the pilfered text.

Whether you click the expand button or not, SGE’s related links are not presented as citations, but recommendations for further reading. If I start singing “Thriller” then tell you that it’s an original song I wrote, it doesn’t matter if I also say “you might want to listen to a guy named Micheal Jackson because he also makes some nice songs like this.” That’s still plagiarism and, even if it were not, we’d have a problem. 

Plagiarism is a moral and academic term, not a legal one, and simply giving credit is not a defense against copyright infringement. You can’t run a business selling pirated Blu-ray discs and then, when busted, say “it’s all good, because I listed George Lucas as the director of Star Wars rather than substituting my own name in the credits.”

In answering my questions, Google’s spokesperson also compared the SGE box to featured snippets, noting that publishers today usually want their articles to appear in featured snippets because those links drive traffic back. While both experiences use content directly from publishers, featured snippets are short quotes with direct attribution and a very prominent link directly to the source. They do not pretend to be generated by an all-knowing AI and they often give you just enough information to want to click-through for more.

No Authority, No Trust

From a reader’s perspective, we’re left without any authority to take responsibility for the claims in the bot’s answer. Who, exactly, says that the Ryzen 7 7800X3D is faster and on whose authority is it recommended? I know, from tracing back the text, that Tom’s Hardware and Hardware Times stand behind this information, but because there’s no citation, the reader has no way of knowing. Google is, in effect, saying that its bot is the authority you should believe. 

The fallacy underlying Google SGE is the false belief that a bot can have authority in the first place. Until the bot grows a pair of hands and opens its own lab space, it will never test CPUs. Until it opens a kitchen, it will never have its own family recipes. The only thing it can cook up is a plagiarism stew. 

Relying on an unsourced bot as the end-all, be-all authority stands in direct contradiction to Google’s stated emphasis on E-E-A-T (Expertise, Experience, Authority and Trust), a standard it uses to decide which websites and authors should rank highly in organic search. 

It makes total sense that someone who has been reviewing CPUs for 15 years on a website that specializes in CPUs should have their AMD Ryzen review rank higher than someone with no authority on the topic. Unfortunately, when it comes to Google’s own AI author – a faceless entity that has no experience doing anything – the rules go out the window.

Mish-Mash Plagiarism Leads to Poor Answers

At least the result we got when asking which CPU was faster was an accurate one. However, by mashing up text from different sources and then not sharing what the source for each sentence or bullet point is, Google is offering incorrect information that often contradicts the source material it’s copied from, or contradicts itself.

For example, I searched for “ThinkPad X13 AMD Review,” because I was interested in seeing what reviewers thought of Lenovo’s ThinkPad X13 laptop with AMD processor inside. The Google bot wrote its own mini-review, complete with bulleted pros and cons for the ThinkPad X13, while grabbing sentences and bullet points from at least four different articles, including a review from Laptop Mag, a review from Tom’s Hardware, another review from Notebook Check and a blog post from LaptopOutlet – which is a store that had about 100 words on the product. 

The image below shows the result, along with pointers to where the SGE took its content from.

Aside from it being plagiarism and a slap in the face to the writers who did the actual work of testing and using this laptop, Google’s answer has a lot of issues. First of all, the answer refers to the ThinkPad X13 Gen 3 (the latest version with AMD CPU) but the reviews it draws from are from the Gen 1 and Gen 2 versions of the product, which are not the same.

While Laptop Mag and Tom’s Hardware both praised the laptop’s keyboard and durable design, both sites described the battery life as “lackluster” or “subpar,” while Google lists “Long battery life” as a pro. The bot clearly got the battery life pro from another site, but by mixing advice from different sources, Google is presenting readers with a very inaccurate picture. 

Also, since the bot doesn’t cite sources, the reader has no way to know who thought it had long battery life, whether that came from a reputable outlet and how they tested. One of the sources, LaptopOutlet, is a store that sells laptops and doesn’t do any benchmark testing. Should its claims be given equal weight to those journalists who actually do test and aren’t actively trying to sell the product? Like most LLMs, Google’s SGE bot doesn’t seem to care whether it’s giving you the truth or just mashing sentences together in a way that seems convincing.

Giving Faulty Medical Advice

The Google SGE bot is so careless in its plagiarism mashups that it also gives incorrect medical advice that has been drawn from a variety of sources. For example, I asked: “do I need a colonoscopy?” and it gave me the following answer:

I highlighted the text in blue because it is dangerously wrong. Google’s bot says that “the American Cancer Society recommends that men and women should be screened for colorectal cancer starting at age 50.” However, the American Cancer Society’s own website says that screenings should start at age 45, so this misleading “fact” probably came from elsewhere.

There’s also a bulleted list of “reasons to have a colonoscopy” that don’t include “routine screening,” hence it’s implying that you should only get the procedure if you have symptoms. The bulleted list is copied word-for-word from an article on an Australian Government health site called BetterHealth. The article actually lists “screening and surveillance for colorectal cancer” as a reason, but Google’s bot decided not to copy that fact. 

Even if all the facts in the colonoscopy answer were clear and correct, they are not attributed to anyone. So why on earth should you trust them and whom do you blame when you follow this advice – for example, delaying your screening to age 50 – and something bad happens? By claiming content as its own, Google is acting as a publisher, which likely opens it up to lawsuits.

Keeping You On Google.com, Killing the Open Web

Though Google is telling the public that it wants to drive traffic to publishers, the SGE experience looks purpose-built to keep readers from leaving and going off to external sites, unless those external sites are ecomm vendors or advertisers. In some queries – “screenshot in windows” for example – there is a detailed answer but no related links at all. Nevermind that there are tons of articles that give you a lot more detail about how to take a screen shot.

If Google were to roll its SGE experience out of beta and make it the default, it would be detonating a 50-megaton bomb on the free and open web. Many publishers, who rely on Google referrals for the majority of their visits, would fold within a few months. Others would cut resources and retreat behind paywalls. Small businesses that rely on organic search placement to sell their products and services would have to either pay for advertising or, if they cannot afford it, close up shop. 

Eventually, even hobbyists who either run not-for-profit websites or post advice on forums would likely stop doing it. Who wants to write, even for fun, if your words are going to be stolen and no one is going to read your copy? Would you answer someone’s programming question on Stack Overflow if your contribution would just be reworded and spat out by Google, without ever mentioning your name or the post itself?

Not an AI Issue: An Anti-Competitive Issue

This isn’t a case of artificial intelligence outsmarting human writers or providing a better experience. In fact, the method of publishing is incidental to the problem. If it rolls the current SGE experience out, Google would be leveraging its monopoly position to push its own content over and above everyone else’s. The company could hire an army of unskilled writers to copy and paste content from third-party websites, sometimes rewording it, instead of using an AI. The outcome would be the same.

There’s no doubt that Google’s AI will get better, but get better at what exactly? It will likely do a better job of rephrasing content so that it’s harder to find the original source it copied from. It will do a better job of offering information that’s up-to-date and logically consistent with itself. However, by just grabbing other peoples’ ideas and not citing the source, there’s no authority behind anything it says.

The end result of Google SGE going live as the default search experience would be a weaker, more siloed Internet, but likely a wealthier Google. The company would increase its time-on-site, ad revenue and ecommerce referrals. It would also please investors, who want to see it compete with OpenAI and Bing. Some readers may grouse about the quality of the information, which can be outdated, false or word-for-word plagiarized, but taking up the entire first screen of results will be enough for Google to grab a huge percentage – if not the majority – of its current outbound clicks.

Many people I have talked to about and shown Google SGE can’t believe that the company would roll such a dangerous, poor-quality and web-breaking experience out to everyone. We can hope that the final product won’t take up as much screen real estate as what we’re seeing today. But Google is already making this the daily search experience for anyone who, like me, signs up for the beta. And it has every economic incentive to make this the new default experience for 91 percent of the web’s searches.

What Publishers Can Do, What Users Can Do

Anyone who publishes on the web and needs people to actually read their work is in a precarious position, because of Google’s SGE. Almost every publication desperately needs to keep getting referrals from Google, so they can’t opt out of being indexed and having their data scraped. But if Google makes SGE the default search experience, the amount of Google referrals may fall so sharply that they can’t keep the lights on. 

Bing took only a few months to go from having its AI Chat in a limited beta to it being available to everyone. If Google follows a similar timeline, it could go from being a search engine to a zero-click, plagiarism engine by this fall.

Publishers and publishing associations are still grappling with what AI plagiarism could do to their businesses. The News / Media Alliance, an industry group that represents magazines and newspapers, published a set of AI principles that states “The unlicensed use of content created by our companies and journalists by GAI systems is an intellectual property infringement: GAI systems are using proprietary content without permission.”

Getty Images is suing Stability AI to prevent the company from using its copyrighted images in training data. The image library has even asked a UK court to block sales of the AI system in that country. IAC Media Chairman Barry Diller has advocated for media companies to sue AI vendors over the unauthorized use of training data.

Will publishers sue Google over what it’s doing with SGE? There’s an argument that the word-for-word copying of information from websites without permission is a form of copyright infringement, even if the source was cited. However, we haven’t seen this litigated in court yet. And many companies, needing whatever traffic they will still get from Google, would want to avoid getting on the company’s bad side.

Companies could band together, through trade associations, to demand that Google respect intellectual property and not take actions that would destroy the open web as we know it. Readers can help by either scrolling past the company’s SGE to click on organic results or switching to a different search engine. Bing has shown a better way to incorporate AI, making its chatbot the non-default option and citing every piece of information it uses with a specific link back (the links aren’t very prominent, however). 

In the end, if Google follows through with its current iteration of SGE, it will damage the quality of its own service. The content that the bot trains on would get worse and worse as more quality publishers left the open web. Eventually, users would start looking for a service that provides better answers. But by that time, the damage done to the entire web information ecosystem could be irreparable.

Note: As with all of our op-eds, the opinions expressed here belong to the writer alone and not Tom's Hardware as a team. 

What is Mastodon?

Mastodon is an alternative social media platform which uses individual servers, each independently run by an administrator, to create a larger network (often called the "Fediverse," a combination of "federated" and "universe") where users can post messages. 

Each Mastodon instance is independent of others, in much the same manner as an email server. You may sign up for one instance, but you can send and receive messages with others. The example given on the Mastodon GitHub page is that when we sign up for an email account with Gmail, Yahoo or Outlook, we are not limited to just sending emails to users on the same server.

Unlike Twitter, Mastodon has two timelines, local and federated. The local timeline is every post with a public status from users on the same instance as you. The exceptions are posts (which were called toots) which are replies to others. The federated timeline is every post with a public status from other instances which are known to your instance. Both of these timelines can be busy, with posts flying up the screen. A new term to learn is “boost” which is analogous to Twitter’s retweet. Of course, you can also follow a feed made of accounts that you have subscribed to, much like Twitter.

How can you move from Twitter to Mastodon and which is the right instance for you? In this how-to we will cover exactly that and learn how to cross post from Mastodon to Twitter and search for our Twitter followers on the many Mastodon instances.

Moving from Twitter to Mastodon

The first task when moving from Twitter to Mastodon is choosing the correct instance. With Twitter, there is just one instance and timeline. But with Mastodon you first have to choose an instance (server). There are two things to consider. Firstly, the size of the server. A larger server is more likely to be backed by a group / organization that can financially support it. Smaller servers may be quiet havens in a busy world, but they run the risk of being the folly of a well-intentioned and eager admin. Secondly, try and select an instance for a subject you are interested in. This means that your posts will merge seamlessly with the posts in the local timeline. If you are interested in Raspberry Pi, but others are not, then your posts may not get the attention they deserve.

1. Open a browser to this wizard to select the correct server for you, click Start to begin. If you know which instances you're interested in, you can also go to them directly.

2. Set your preferred language(s) and click Next.

3. Select the number of users that you would like on an instance. Smaller instances are quieter, but you run the risk of the instance disappearing. We chose “It does not matter”.

4. Set your moderation rules for each of the criteria and click Next. The moderation rules are used to filter instances that support your choices.

5. Use the search bar to filter the instances for your chosen subject. We searched for retro computing hardware and found two instances that supported our interest.

6. Click on your preferred instance and follow the sign-up process. The sign up process is generally straightforward, requiring you to provide a username, password and email details. Some instances are invite only. Popular instances, such as mastodon.social have periods where sign-ups are paused. This is to reduce the load on the server. Before signing up it is wise to read the rules / terms for that server.

Your First Post

In Mastodon a message can be sent to your followers, and, in this case, anyone on the local and federated timelines. 

1. In the web interface type, in your message and click "Publish" to send a message to all of your followers, local and federated timelines.

2. Type @ and then the first few letters of a follower name to send a post directly to a follower.

Sending a DM

1.  Search for / select the person who you wish to DM. There is a search box in the top left of the Mastodon page.

2. On the recipient's profile click on the three vertical dots and select Direct Message.

3. In the dialog box on the left side of the screen, type your message and click Publish to send. Note that the message starts with @ and the name of the recipient. Also note that the Publish button has a padlock. Indicating that the message is private.

4. Alternatively, click on the globe icon and select “Mentioned People Only” then type in the handle of the recipient. Direct messages will still appear in your home timeline; this is normal and does not mean that it has been sent to all of your followers. Not that the timestamp (top right) is altered to show @ rather than a globe. This means the message is private.

5. Messages can also be posted as Unlisted, visible to all (but opted-out of discovery) or only for Followers.

Finding Your Followers

You’ve made the move, but have your Twitter followers? That carefully curated group of followers are mostly likely in the same boat as you. So how do we find our followers and the people we follow?

The simplest way is to use a tool that checks your follower list and searches for them on the many Mastodon instances. Debirdify by Manuel Eberl is just such a tool and we will use it to find our followers on Mastodon. Hat tip to Drew Fustini (https://mastodon.social/@pdp7) for pointing us to this tool.

1. Open a browser and go to the Debirdify website.

2. Click on "Authorise With Twitter."

3. Authorize Debirdify to use your Twitter account. This provides read only access to Twitter, enabling the tool to scan your followers and the people you follow, and use the data to search Mastodon’s instances.

4. Click on Search Followed Accounts to search for the accounts that you follow on Twitter.

5. Scroll down the page and download the CSV export. Graphs and a list of followed accounts (grouped by instance) show how they are spread across the many instances of the fediverse.

6. Click on Search Followers to find those that follow you on Twitter.

7. Scroll down the page and download the CSV export. Graphs and a list of followers (grouped by instance) show how your followers are spread across the many instances of the fediverse.

8. Open a browser to your Mastodon account and click on Preferences. Our instance is on mastodon.social, opening this in a browser will open a columned display similar to Tweetdeck.

9. Click on Import and Export.

10. Click on Import and then set the import type to Following list and then select the CSV file containing the accounts that you followed on Twitter. Ensure that Merge is selected before pressing Upload. This will merge the list of CSV contacts with your current Mastodon contacts.The process can take some time, depending on the instance's current load and the number of users in your list.

11. Optionally, import the list of the accounts that follow you on Twitter. 

The import will take some time and will happen in the background, over the next few hours you will see many notifications confirming that you are now following the accounts.

Cross-posting Between Mastodon and Twitter

Cross-posting is where we can post from one service to another. It is normally used when either migrating one service to another, or for growing your presence across multiple services. Setting up cross posting is a simple matter of authorizing an application to act as a bridge between the two services.

1. Open a browser to Mastodon Twitter Crossposter. This project was created by Renato Lond Cerqueira.

2. Click on Twitter and authorize the Crossposter app to access your account.

3. Click on Mastodon and authorize the Crossposter app to access your account.

4. Check that both accounts are now linked. This provides the basic bridge between the two services.

5. Click on Options >> Options overview. Using this menu we can further tweak the settings at a granular level to create a bespoke bridge between the services.

6. Select to send your posts to Twitter, and Tweets to Mastodon then click Update User. Now we have set up the basic bridge between Twitter and Mastodon. In our example we have decided not to post our Tweets to Mastodon, but our posts will go to Twitter. You may want to experiment with this and consider which messages are appropriate for which platform.

7. Click on From Mastodon to Twitter. Here you can optionally configure which messages are sent to Twitter. Tweak your settings accordingly and click Update User to save.

8. Click on From Twitter to Mastodon. Here you can optionally configure which messages are sent to Mastodon. Tweak your settings accordingly and click Update User to save.

Mastodon Clients

Mastodon can be used via the browser, and for the first few days of using Mastodon that is exactly how we used it. 

The basic UI is pleasant and easy to use. Power users can unlock a Tweetdeck inspired UI via Preferences >> Advanced > Appearance > Enable Advanced Web Interface. 

But there are alternative clients for the desktop and mobile devices, including official apps, which provide a better user experience.

For Windows, macOS and Linux users, Whalebird is an excellent application which uses a Slack-inspired layout to enhance your Mastodon experience. The layout is clear, with a series of tabs along the left side of the interface offering quick access to notifications, direct messages and the local / public timeline.

For Android users, Tusky has proven to be a good client in the time that we have been using it.

The interface is clear, with a top row for quick links to our timeline, notifications, local and federated timelines. Posting, boosting etc are all within easy reach and the user interface feels responsive.

Intel revealed in a filing with the U.S. Securities and Exchange Commission that it has a stake in Coinbase, the cryptocurrency exchange operator that went public in April.

The company said it owns 3,014 Class A shares of Coinbase, with a total value of approximately $763,000. This disclosure only applies to a reporting period that ended on June 30, however, so Intel's stake in Coinbase may have changed by now.

Barron's noted that Intel didn't make a similar disclosure at the end of the first quarter, so either it owned less than a 5 percent stake in Coinbase before the initial public offering, or it purchased the shares after they were made publicly available.

Coinbase's listing on the Nasdaq stock exchange helped push the price of Bitcoin to an all-time high of roughly $64,000, as crypto enthusiasts and institutional investors celebrated the latest sign that digital assets were becoming more mainstream.

Yahoo Finance data showed Coinbase's share price reaching about $430 the day it went public, but its value dropped shortly after, and it's currently trading at roughly $254. But Intel could still enjoy a return on its investment. Its 3,014 shares are currently worth $767,063; that's $4,063 more than the value cited in its SEC filing.

But that probably isn't the point. Coinbase was among three companies included in that filing, which suggests Intel sees its potential, even if the market isn't hyping up the cryptocurrency exchange as much as it did when Bitcoin was at its peak.

Not that Intel's been shy about its interest in cryptocurrency. The company has been granted patents related to Bitcoin mining, for example, and it joined the Enterprise Ethereum Alliance to work on digital currency with other leading companies.

AMD's stock has closed at record-breaking prices for the last five days following its most recent earnings report, which revealed that quarterly sales reached an all-time high of $3.85 billion in 2Q21, and chief executive Lisa Su's commitment to shipping next-gen processors heading into 2022 despite the ongoing chip shortage.

Yahoo Finance data showed that AMD's stock closed at a record $97.93 on July 28, and set another record at $112.56 on August 3. The price has continued to rise so far today: It peaked at $118.82 this morning and settled at roughly $119 at the time of writing. The tool still marks the stock as undervalued, too, and predicts strong long-term performance.

The market appeared to be responding to AMD's strong earnings in the second quarter. The highlight was the revelation that its sales had nearly doubled year-over-year despite the challenges imposed by the coronavirus pandemic and the global chip shortage that's left many companies unable to satisfy demand for their wares.

AMD's rising share price could also have benefitted from Intel's repeated warnings that the consumer chip shortage would continue into the third quarter. The company said in its most recent earnings call that margins have suffered as supply chain costs have risen because it hasn't passed those increases on to consumers.

Intel continues to lead in terms of market share, especially when it comes to consumer processors, but AMD has eaten away at the high-value data center business with its EPYC lineup. That increased competition might persuade some investors that AMD can truly challenge Intel's dominance in at least one sector.

MarketWatch noted that investors could also have been responding to a Bloomberg report claiming UK regulators would block Nvidia's acquisition of Arm over national security concerns. That could make it more difficult for the company to extend its lead in the graphics market to the other sectors in which it competes with AMD.

Gigabyte has apologized for a comment it made about Chinese manufacturing that prompted social media outrage, led several marketplaces to remove its products from their platforms, and caused a $550 million drop in its market value.

According to Bloomberg, the company published a blog post on Monday slamming its competitors for outsourcing production to Chinese manufacturers that make products in a "low-cost, low quality way." (The blog post has since been deleted.)

That comment was seen as an indictment of Chinese manufacturing writ large instead of a targeted criticism of Gigabyte's rivals— which is what prompted the removal of its products from the JD.com and Suning.com e-commerce platforms.

The market's response was also swift. Gigabyte's share price had fallen by nearly 10% when the market closed in Taipei, according to Yahoo Finance, which means its market value has dropped by about $550 million since the blog post's publication.

All of which led Gigabyte to publish an apology for that blog post.

"A few days ago, part of the text content published on our official website is seriously inconsistent with the facts," Gigabyte said, per Google Translate. "It is caused by poor internal management of the company. We sincerely apologize for the discomfort caused to you."

The company also said it will "strengthen internal management and training to ensure that all employees are aware of the problem and pay attention to it."

It's hard to imagine such a strict response to a single blog post, but it's also hard to accept that a throwaway comment about the quality of its competitors' products led Gigabyte's market value to plummet by over half a billion dollars, so we'll call it even.

Yahoo has proposed a $117.5 million settlement to a class-action lawsuit involving multiple data breaches between 2013 and 2016. The company originally thought 1 billion people were affected by those breaches; it raised that number to 3 billion in October 2017. But the number of people who participated in the lawsuit is significantly lower, with Reuters today reporting that the settlement could be split between 194 million people.

The proposed settlement requires approval from U.S. District Judge Lucy Koh, who denied a previous offer because it wasn't “fundamentally fair, adequate and reasonable." Reuters said the new proposal is much more specific: it's offering "at least $55 million for victims’ out-of-pocket expenses and other costs, $24 million for two years of credit monitoring, up to $30 million for legal fees and up to $8.5 million for other expenses."

This settlement would also see Verizon, Yahoo's parent company, up its spending on security to $306 million between 2019 and 2022. Yahoo spent one-fifth that amount between 2013 and 2016. Verizon also said it would quadruple Yahoo's security staff in that timeframe to bolster its defenses and make sure it can better respond to breaches after they occur. 

As a reminder, Verizon was originally supposed to acquire Yahoo for $4.83 billion, but the amount was reduced to $4.48 billion after Yahoo revealed more information about the breaches. It's not hard to guess why. Yahoo disclosed the largest data breach in history after it agreed to be acquired by Verizon. Verizon wrote off Yahoo's value in December 2018, and now it's going to have to spend hundreds of millions of dollars as part of this settlement.

That number could always rise, too, depending on whether or not Koh accepts the proposed settlement. One of the plaintiffs' lawyers already said $117.5 million is the "biggest common fund ever obtained in a data breach case," according to Reuters. But that doesn't mean it'll be enough. Compromising information about nearly 40 percent the global population shouldn't be taken lightly.

A mysterious Coffee Lake Refresh (CFL-R) processor claiming to be the Intel Core i9-9900T, was up for auction on Yahoo! Auctions two days ago. The “T” suffix suggests the chip is a low-power variant of the Intel Core i9-9900K octa-core processor.

The processor listed was said to be an engineering sample (ES). Accompanying photos show a QQC0 identifier on its integrated heatsink (IHS). The Intel Core i9-9900T is expected to be produced under Intel's 14nm++ process and inherit the Core i9-9900K's eight cores, 16 threads and 16MB of L3 cache. However, being a T-series chip, it should come with slower clock speeds to earn the 35W TDP (thermal design power) badge.

See how the specs listed for the alleged Core i9-9900T compare to the Core i9-9900K and i9-9900KF in the table below:

According to the marking on the IHS seen in the auction's photos, the Core i9-9900T features a 1.7GHz base clock. The seller specified a 3.8GHz boost clock, but that's likely the single-core and dual-core boost. We think the all-core boost for the Core i9-9900T could be around 3.3GHz. The seller also claimed that the processor is faster than the Intel Core i7-8700K.

Intel Core i9-9900T Price

The high-end and unlocked Core i9-9900K retails between $488 and $499, while the Core i9-9900KF, which lacks the integrated Intel UHD Graphics 630 (GT2) iGPU, goes for $499. The auction had the Core i9-9900T listed for 35,000 yen (about $319.39). Theoretically, the Core i9-9900T should carry a lower price tag than the Core i9-9900K or Core i9-9900KF. However, with Intel, that's not always the case, as we saw with the Core i9-9900KF, which everyone thought would cost much less than the Core i9-9900K.

The ACLU announced this week that the NSA’s PRISM program, revealed by national security whistleblower Edward Snowden in 2013, will be reviewed in court. The PRISM program allows the NSA, as well as other U.S. intelligence agencies, to access U.S. citizens’ international emails, internet calls and chats without a warrant.

U.S. Government Taken To Court

Most of the post-Snowden-revelations lawsuits against the NSA have failed because the courts have said that the civil rights organizations, such as the ACLU, “don’t have standing” to sue the NSA. However, this time, the ACLU is helping an individual who claims to have been personally harmed by the NSA’s surveillance.

The U.S. government accused Agron Hasbajrami from Brooklyn of attempting to provide material support to a designated terrorist organization in Pakistan. After Hasbajrami pleaded guilty to one of the charges against him, the government admitted that it had been reading his emails illegally without a warrant.

Now, Hasbajrami is asking the Second Circuit Court of Appeals to throw out the tainted evidence. The ACLU has filed a brief in favor of Hasbajrami arguing that the government’s actions violated the Fourth Amendment when it exploited an American’s communications through the PRISM program.

PRISM’s Relationship With Tech Companies

Snowden revealed that a number of major technology companies, including Microsoft, Google, Yahoo, YouTube, AOL, Skype and Apple, were part of the PRISM program. He revealed that NSA was accessing emails, chats, video calls and other types of private content from these companies.

Back in 2013, PRISM was believed to be a program through which the NSA could gain direct access to those companies’ servers. However, all of the involved companies denied this at the time. The NSA supposedly uses secret FISA orders to request data that is normally encrypted from tech companies.

U.S. Government’s "Backdoor Searches"

The U.S. government has insisted that it uses PRISM and other similar programs, such as Upstream, to target foreigners’ communications. However, the government’s interpretation of that mission seems to be quite broad. Some Senators have criticized it in the past for being a “backdoor” into Americans’ private communications. The NSA has also admitted to including millions or tens of millions of people into such investigations, for instance, by intercepting all three-hop phone records.

This broad interpretation allows the NSA to capture and then access the internet data of virtually all Americans. A rule change by former U.S. President Barack Obama allowed the NSA to share this data with 16 other agencies, including the CIA, FBI, DEA and IRS.

The passing of the recent FISA extension codified the change into law and has given these agencies permission to read all Americans’ data that passes through the internet without a warrant. The law says that the government only needs to obtain a warrant after the fact and if it would like to use that data in court, long after the government could have used it to fish for crimes (something that, some could argue, is supposed to be banned by the Fourth Amendment).

Circumnavigating the Fourth Amendment?

The ACLU noted that FBI agents have already been running PRISM searches on captured data using only names and email addresses without first obtaining a warrant. The civil rights group believes allowing the government to have easy access to emails, chats and other personal communications without requiring an individualized warrant from a judge is an “end-run around the Fourth Amendment.”

On Monday, the ACLU plans to explain to a three-judge panel why the government should be required to seek a warrant before doing such searches in order to obey the Constitution.

Verizon Communications subsidiary Oath, which oversees the AOL and Yahoo brands as well as the company's other digital content interests, announced that it would shutter the Yahoo Messenger service in just over a month. That's right: Yahoo Messenger just received a July 17 execution date.

In recent years, Verizon Communications has made a couple significant moves in the internet media space. It acquired AOL in June 2015, and in June 2017, it took over Yahoo! Inc's primary assets. Along with purchase of Yahoo, Verizon created Oath Inc to oversee both of the brands it had just bought.

For the first few months, Oath let AOL and Yahoo operate as they did before, but in October 2017 the company announced that it would close AOL’s long-running AOL Instant Messenger (AIM) service. Oath discontinued AIM on December 15, 2017, and now it’s gearing up to do the same with Yahoo’s competing Yahoo Messenger app.

Oath acknowledged that Yahoo Messenger has many loyal fans, but the company wants to move away from antiquated messaging platforms and “focus on building and introducing new, exciting communications tools that better fit consumer needs.”

Yahoo already offers a replacement messaging application called Yahoo Squirrel. The app is still in beta, and it requires an invite to gain access (you can request an invite at squirrel.yahoo.com). It’s unclear when Squirrel will be available to everyone, but Yahoo wants to transition Yahoo Messenger users to Yahoo Squirrel in due time, and with Yahoo Messenger closing soon, we estimate Squirrel should leave closed beta sooner rather than later.

After July 17, the Yahoo Messenger app will cease to function. Oath said that your chat history would remain accessible for six months, but the desktop app would serve no other function during that timeframe. The change will have no effect on your Yahoo ID for other Yahoo services, such as Yahoo Mail.

Manuel Caballero, a security researcher that lately seems to have been focusing on finding flaws in Microsoft’s Edge browser, uncovered a new bug that would allow an attacker to steal users’ passwords from popular web services.

Bypassing Same Origin Policy

A same origin policy (SOP) is an important security concept for web applications that prevents malicious code on one web page from gaining access to sensitive data on another web page. Without SOP, an attacker could modify the contents of a web page in the user’s browser and steal personal information.

Caballero found an SOP bypass in the Edge browser that would allow an attacker to tweet in the name of a logged user by executing malicious code with the help of a data uniform resource identifier (URI), meta refresh tags, and domainless pages such as "about:blank."

For the attack to work, the attacker would first have to trick the target victim into clicking a malicious link. In the demos presented on his website, Caballero was able to execute malicious code on the Bing home page, tweeted on behalf of another user, and stole the password and cookies from a Twitter account.  

Attack Exploits Edge’s Password Autofill Feature

The stealing of the password was possible due to Edge’s built-in password manager, which autofills users’ passwords after they’ve been logged out. This makes it possible for the attacker to capture the password, once the victim has already loaded malicious code in the browser, by clicking on the attacker’s link.

According to Caballero, this vulnerability is currently still unpatched. We contacted Microsoft about it and asked whether or not it will be patched soon, and a spokesperson gave us the following reply:

Windows has a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible. Our standard policy is to provide solutions via our current Update Tuesday schedule.

Caballero added that this attack could be automated through malvertising (malicious ads) to obtain passwords from thousands of users of Facebook, Amazon, and other services, too.

“If an attacker is hosted inside a Yahoo banner and the user is logged in into her Twitter account, she will be owned with no interactions, at all,” warned Caballero.

The SOP bypass vulnerability affects only the Edge browser because SOP implementations are different for each browser. Edge was recently the most hacked browser at the Pwn2Own hacking competition, but it looks like researchers can still find major bugs in it. Microsoft recently promised some significant security improvements for Edge, but it remains to be seen how useful they'll be in practice.

Google announced that the “End-to-End” email browser extension project it started three years ago is no longer a “Google project,” and that the community is invited to take it over because the project “has left the nest.” The company also renamed the End-to-End project “E2EMail.”

“End-to-End” Project Abandoned

Back in 2014, Google announced the OpenPGP-based End-to-End project to bring easier to use end-to-end encryption to Gmail and other email services. Yahoo later joined the project as well, but eventually abandoned it, probably for different reasons.

Google started the project to win back the trust of Gmail users, after being accused of being part of the NSA PRISM program, and to show that it cares about its users’ privacy. End-to-end encryption would make email readable only to the users sending each other emails, but not to Google, as it is now the case.

The company developed the project for two years; last year, though, the code contributions seemed to have suddenly stopped. The project has remained untouched on the GitHub repository for almost a year. We’ve contacted Google before to ask if the project has been abandoned or not, but we haven’t gotten clear answers.

Google has now published a blog post in which it renamed “End-to-End” to “E2EMail” and said that it’s no longer a Google product, but a “fully community-driven open source project.”

Key Transparency

Google also mentioned that it recently announced a separate “Key Transparency” project, which could end up being a critical component of E2EMail in the future. One of the problems that appears when you try to make PGP easier to use is that you have to have everyone’s public keys so that the users don’t have to share those keys with each other. However, you also have to ensure that those keys aren’t changed by malicious actors, so you need a system that can be easily audited.

The Key Transparency project, which at least for now seems to be developed and maintained by Google, takes innovations from the Certificate Transparency project and from CONIKS, a new type of key management system developed by Princeton and Stanford researchers, to create a secure key server.

Despite already working on both projects, Google doesn’t seem to have integrated Key Transparency into the E2EMail project yet, and it’s leaving that up to the community. It’s possible the company didn’t integrate it because the Key Transparency project itself is quite new and unproven, or it could be because Google simply didn’t want to expend more resources working on E2EMail.

The company did mention in the blog post that it’s "looking forward to working alongside the community to integrate E2EMail with the Key Transparency server, and beyond." However, it’s not clear what that means exactly, considering there haven’t been any serious code commits to the End-to-End project from the company in almost a year.

End-To-End Encrypted Emails

Although Google tries not to show it, it does seem that the company is not as focused on bringing end-to-end encryption to its services as it was immediately after the Snowden revelations.

Although the abandonment of the End-to-End tool was evident from the lack of contributions, it was confirmed when the company chose to adopt S/MIME for enterprise users over OpenPGP. Google turned even that end-to-end encryption technology into a centralized/hosted one where Google knows the private key of the users and therefore can read the contents of their emails.

Google seems to be removing itself from all end-to-end encryption projects, as it continues to focus on artificial intelligence and more advanced tracking and mining of user data. That means if you want end-to-end encrypted email, you may have to look elsewhere.

Cloudflare revealed that a memory leak in its parser made sensitive information, such as HTTP cookies or authentication tokens, publicly available. Some of this private data was cached by search engines (Google, Yahoo, Bing, and others), but all have reportedly purged the info from their services.

Cloudflare provides a number of services, ranging from distributed denial of service (DDoS) attack mitigation to email obfuscation, to more than 5.5 million websites. The company said this memory leak affected only a small number of users--roughly 0.00003% of HTTP requests made between February 13-18 could have potentially resulted in memory leakage--but the bug still has a vast reach because of Cloudflare's runaway popularity.

Here's the gist of the bug's impact, as Cloudflare explained in its blog post:

More concerning was that fact that chunks of in-flight HTTP requests for Cloudflare customers were present in the dumped memory. That meant that information that should have been private could be disclosed. [...] This included HTTP headers, chunks of POST data (perhaps containing passwords), JSON for API calls, URI parameters, cookies and other sensitive information used for authentication (such as API keys and OAuth tokens).

Worse still was the fact that search engines cached some of this data. Cloudflare said it found 770 unique URLs covering 161 unique domains cached on Google, Yahoo, Bing, and others. The company worked with each search provider to purge the sensitive information before this bug was made public. This should prevent interested parties from trolling search engines to find some of the private data that could have been exposed by the memory leak.

Cloudflare also had to address the bug itself. Here's what that involved:

Having a global team meant that, at 12 hour intervals, work was handed over between offices enabling staff to work on the problem 24 hours a day. The team has worked continuously to ensure that this bug and its consequences are fully dealt with. One of the advantages of being a service is that bugs can go from reported to fixed in minutes to hours instead of months. The industry standard time allowed to deploy a fix for a bug like this is usually three months; we were completely finished globally in under 7 hours with an initial mitigation in 47 minutes.

The incident and Cloudflare's response highlight the importance of companies sharing information with each other. This bug was originally found by a researcher at Google's Project Zero, which is devoted to finding vulnerabilities in online services and making their creators aware of them. Project Zero gives companies 90 days to address the problem before it's disclosed to the public; not everyone (ahem, Microsoft) responds within that timeframe.

Cloudflare did. Sharing information might not be a silver bullet, but at least in this case, it helped shorten the reach of a potentially disastrous bug. Hopefully the formation of threat-sharing groups like the IoT Cybersecurity Alliance and the Cyber Threat Alliance will encourage other companies to take warnings about their security as seriously as Cloudflare did. (Or, at the very least, cut the average response time down from three months.)

Recorded Future revealed that 60 universities and government agencies were targeted by a Russian-speaking hacker dubbed Rasputin. The security company said Rasputin used SQL injection, a common vulnerability found in many popular websites, in a likely bid to steal personal information.

Recorded Future previously identified Rasputin as the hacker selling access to a U.S. Election Assistance Commission (EAC) database in December 2016. Rasputin has now gone after Cornell University, New York University, and other prominent colleges in the United States and UK; U.S. cities and states; and federal agencies such as the U.S. Department of Housing and Urban Development and National Oceanic and Atmospheric Administration.

Here's how Recorded Future connected the dots between these victims:

The EAC database breach was the result of SQL Injection (SQLi), an attack that is technically easy, but expensive to defend. Recorded Future continues to monitor Rasputin’s campaigns, which are now sequentially targeting specific industry verticals. These are intentional targets of choice based on the organization’s perceived investment in security controls and the respective compromised data value. Additionally, these databases are likely to contain significant quantities of users and potentially associated personally identifiable information (PII).

SQLi attacks have "been around since databases first appeared on the internet," Recorded Future said, but they're also "simple to prevent through coding best practices." The problem is that many groups--from tech companies like Yahoo and LinkedIn to the universities and government organizations implicated in this report--don't bother to defend against these attacks. This is the digital equivalent to leaving a door unlocked at night.

So how will this problem be solved? Recorded Future has a few ideas:

An opt-in program for partial corporate tax abatement could be a starting point. Program participation should require quarterly code audits by an approved vendor. Robust governance, risk, and compliance (GRC) programs (e.g., financial services companies) already mandate periodic code reviews, but all verticals need some type of incentive regardless of specific industry regulations. Unfortunately, government fines and/or loss from lawsuits may be the only incentives to prioritize code audits.

The problem echoes the many security vulnerabilities found in Internet of Things (IoT) devices. Manufacturers know how to keep these devices safe, or at least mitigate their risk of being compromised, yet they fail to do so because they lack any financial incentive. People will keep buying IoT products just like they'll keep trusting personal information to sites vulnerable to SQLi attacks. Government regulations might be a potential fix to that problem.

Recorded Future didn't reveal what kind of information might have been compromised by the attacks on these universities and government organizations, but given the amount of personal data these institutions hold, chances are good that Rasputin, whose hacks Recorded Future said are financially motivated, got whatever they were looking for.

Jouko Pynnönen, a Finnish researcher from the Klikki Oy security firm, uncovered a vulnerability in Yahoo Mail that could allow malicious hackers to eavesdrop on users’ emails. The researcher uncovered a similar flaw in Yahoo Mail a year ago.

The Cross-Site Scripting (XSS) vulnerability in Yahoo’s email service could’ve allowed attackers to embed malicious code in people’s emails and infect their computers with malware. No interaction from the users, such as clicking on a link or opening a file, would have been necessary. The infection would have happened automatically as the users opened a malicious email.

How The Flaw Was Found

Pynnönen decided to take another go at looking for bugs in Yahoo Mail after finding an XSS vulnerability in the service last year. However, he didn’t expect to find another problem in the service’s basic HTML filtering.

He noticed the additional attachment options in Yahoo Mail, such as adding an attachment link through a third-party cloud storage provider, which he thought he could exploit. He ended up taking advantage of these additional options because Yahoo failed to properly filter any malicious code that can be embedded into these HTML emails.

“What caught my eye were the data-* HTML attributes. First, I realized my last year’s effort to enumerate HTML attributes allowed by Yahoo’s filter didn’t catch all of them,” Pynnönen said.“Second, since data-* HTML attributes are used to store application-specific data typically for JavaScript use, it seemed there was a new potential attack vector here. It would be possible to embed a number of HTML attributes that are passed through Yahoo’s HTML filter and treated specially,” he noted.

Impact

As a proof of concept, the researcher provided Yahoo with an email that, when viewed, would use AJAX to read the users’ inbox emails and send them to an attacker’s server. He also said that last year’s concept virus, which could automatically install itself on users’ computers when viewing an email, would’ve also worked using the same technique.

Pynnönen said the flaw was reported to Yahoo’s security team through the HackerOne bug bounty platform on November 12. The vulnerability was fixed on November 29. The researchers were rewarded with a $10,000 bounty.

Over the past few weeks, it’s been uncovered that half a billion Yahoo Mail accounts were exposed in a record-breaking data breach and that Yahoo may have scanned its users' emails on behalf of the U.S. government, too. In both situations, end-to-end encryption would’ve protected users’ information.

Protection Against Data Breaches

End-to-end encryption (E2EE) encrypts the data locally on the device before it's sent over the network, so it usually doesn’t matter whether the communications channel has strong encryption, weak encryption, or no encryption at all. Without cryptographic signature verification, an attacker could still pretend he’s the person that you’re trying to reach, but even then, there could be other ways to protect against it.

An email service such as Yahoo Mail can’t expose user communications in a data breach if the data has end-to-end encryption, because even the company itself can’t access the data. The pro, as well as the con, to E2EE (done over OpenPGP in the case of email) is that the user is responsible for email encryption.

On one hand, that means nobody else should be able to access the data, but on the other hand, the user also needs to keep the private encryption key safe (ideally on a physical USB security key that has support for OpenPGP). If someone steals the key, they can decrypt the communications.

Protection Against Spying

Not surprisingly, many of the same reasons why E2EE protects against data breaches also apply when trying to protect against spying, with or without the service provider’s involvement. A spying tool can’t decrypt the E2EE email going through Yahoo’s servers for the same reason the company can’t decrypt email for data mining purposes.

The reason many governments oppose end-to-end encryption is because they can’t treat companies with millions or hundreds of millions of users as a one-stop spy shop anymore. If the governments want the data, they would have to go to the owners of the data, not the third-party companies that handle the communications.

When the data does not have end-to-end encryption, governments can issue warrants to legally request the individuals' data from third-party service providers. They can also use the same tactic that the U.S. government allegedly used with Yahoo: Install malware that provides almost total access to any data contained on the infected servers while also ordering the company to hand over information using more legitimate systems.

The latter may, at the very least, be in a legal gray area, but it may violate constitutional and international privacy rights due to the “indiscriminate” and “non-proportional” aspect of this type of surveillance.

End-To-End Encrypted Email

Google announced its “End-To-End” browser extension, which aimed to make OpenPGP encryption more mainstream by making it easier to find your friends’ public keys so you can send emails over OpenPGP. Alex Stamos, who ran Yahoo security (and now works at Facebook), quickly jumped on board and said the company would also support the extension.

A year later, Yahoo even demoed a preview version of the extension ahead of Google. However, we haven't heard much on the topic from the company since then. However, we do know from a recent report that Yahoo’s CEO, Marissa Mayer, allegedly clashed with the security team often and didn’t give it the necessary budget to secure the company’s infrastructure.

Google doesn’t appear to have contributed to its End-To-End public project over the past six months, and it hasn't made any other public announcements since 2014. During our talks with the company, Google said that it’s still interested in developing end-to-end encryption for Gmail, but refused to go into further details about the implications.

For users who want end-to-end encrypted email, it may be time to stop waiting around for Google or Yahoo to deliver it and start using services or tools that offer it by default. If you’re a Yahoo user, and you feel like Yahoo betrayed your trust both by how it handled the data breach and by the reports that it has been allowing the U.S. government to search through everyone’s emails, now may be a great time to switch from Yahoo to a service that supports end-to-end encryption.

ProtonMail

ProtonMail, developed by a group of former CERN scientists and engineers based in Switzerland, is perhaps is the best-known end-to-end encrypted email service to appear in the post-Snowden era.

The company says it uses OpenPGP to encrypt users’ emails end-to-end. ProtonMail aims to make it easier to use OpenPGP, which means the company manages the users’ public and (encrypted) private keys.

The service encrypts the emails in the browser, but you still have to trust that the email you send is paired with the contact you send it to. You also have to trust that ProtonMail’s servers won’t be hacked, or that the Swiss government won’t try to impose a backdoor inside the company.

However, Swiss privacy laws are among the strongest in Europe, and the company has said that even the recent surveillance law passed by the government won’t affect the privacy of its users, as it doesn’t target encrypted communications that the providers can’t decrypt. Because you still encrypt the email in the browser with OpenPGP, that means ProtonMail can’t read them.

As an additional protection, the email inbox (mailbox) is also AES-encrypted with a user-assigned password. Therefore, even if an attacker hacks ProtonMail’s servers and somehow gets your private key, they would still need your second password to decrypt your mailbox data.

Because OpenPGP is required for end-to-end encrypted email, and because ProtonMail has a custom system for handling OpenPGP emails, that means you can use E2EE emails only with other ProtonMail users. When you send emails to users of other email services, you can also encrypt the emails with a password (different from the mailbox one) and then share that password through another secure channel with your contact so they can decrypt the email on their end.

Mailvelope

Mailvelope is a Chrome and Firefox browser extension that can encrypt emails with OpenPGP and is compatible with Gmail, Outlook, GMX, Yahoo Mail, and many other email services. The extension encrypts the emails in the browser, and users are responsible for taking care of their private keys.

That means that if you format your computer without saving the private keyword, you will lose it, and you would need to create a new private and public key that you need to share with others all over again.

It also means that you need to get all of your contacts’ OpenPGP public keys one by one. There are some ways to make the process easier, such as encouraging all of your friends to use a keyserver such as Keybase. This service ties identities to OpenPGP public keys. Mailvelope also announced its own key server recently, which means that it should be easier to find your friends’ public keys straight from Mailvelope.

One recommendation would be to always write messages in the external windows Mailvelope presents when you want to send a new message, because services such as Gmail and Yahoo can save copies of the emails as you write them. When that happens, the message is already “leaked” before you even get a chance to press the Mailvelope encrypt button.

Mailvelope uses standard OpenPGP encryption, so the messages could also be decrypted in other OpenPGP email clients, as long as you import the private key in them. The same is true in reverse: Mailvelope can also decrypt messages encrypted by other OpenPGP clients.

Other Options

There are multiple other OpenPGP-based email services out there, but for most users, ProtonMail is probably one of the more modern-looking, as well as the easiest to use, given that the company manages public keys automatically and syncs your (encrypted) private keys across devices. The company is based in Switzerland, where privacy laws are stronger and more respected than in most other countries, which may also help you feel more trusting of the service.

ProtonMail supports all modern browsers as well as Android and iOS. For users looking to leave Yahoo Mail, ProtonMail would be a good alternative, as it works just like any other modern email service, but it also gives users the option to encrypt their emails end-to-end.

For those who still can’t switch away from their favorite email service (whether it’s Gmail, Outlook, or even Yahoo Mail), Mailvelope is a sound and easy way to communicate privately with friends. It’s not quite as easy to use as ProtonMail because you still have to manage public and private keys, but after the initial setup, things should go much more smoothly. It’s also still significantly easier to use than most traditional PGP applications.

When the Court of Justice of the European Union (CJEU) ruled that the Safe Harbor agreement between the EU and the U.S. was invalid, it did it because the agreement didn’t do anything to protect EU citizens against U.S. mass surveillance. The European Commission then scrambled to create the new agreement, called “Privacy Shield,” meant to significantly improve privacy protections for citizens of EU member states.

However, many criticized it since the beginning, including Maximilian Schrems, whose lawsuit ultimately led to the demise of the Safe Harbor agreement, for not having enough teeth to ensure indiscriminate mass surveillance (illegal under the Charter of Fundamental Rights of the European Union) doesn’t happen anymore.

"Privacy Shield" Litmus Test

One of the main criticisms of the Privacy Shield agreement is that it doesn’t even make European authorities the ones responsible for ensuring EU citizens’ rights are protected against privacy violations by the American companies or government. It’s the U.S. Department of Commerce, an agency in charge of helping American business interests, that needs to audit the U.S. companies for violating EU laws. If that seems like it doesn’t make much sense to you, it’s because it doesn’t. It’s a little like asking the fox to guard the hen house.

Another criticism is that it’s unclear just exactly how it would protect against mass surveillance. European Union citizens mainly have to trust that the European Commission (EC) would act accordingly if it finds any evidence that the U.S. wasn’t keeping its word. However, it’s also not clear how the EC would know if the U.S. government were illegally spying on EU citizens, other than trusting the word of the U.S. intelligence agencies.

The recent scandal accusing Yahoo of allowing U.S. intelligence agencies to scan through all of its users’ emails, including those of EU citizens, could be the litmus test to decide whether the Privacy Shield agreement is effective at all when it comes to protecting EU citizens against U.S. mass surveillance (its main purpose).

Mechanisms For Redress Against Yahoo/NSA Spying

The Privacy Shield brought two main improvements over the Safe Harbor agreement. The first is the annual EU review of how effective the Privacy Shield is in doing its job of protecting EU citizens’ interests, with the ability to modify the agreement in new negotiations. The second gives EU citizens the ability to sue the U.S. government if they’ve been spied upon, enabled by the Judicial Redress Act, which passed this year in the United States.

However, the chances are that unless there are some egregious violations, the EU won’t engage in new rounds of negotiations with the U.S. government to make the Privacy Shield agreement stronger. The good news, or perhaps the bad news (depending on how you look at it), is that the NSA spying on all Yahoo users, including all EU users, should activate new negotiation rounds.

However, this will depend largely on the public, and perhaps the European Parliament, putting enough pressure on the European Commission (the executive body) to restart the negotiations, and do it right this time.

The Judicial Redress Act should also allow Yahoo users that are EU citizens to sue the U.S. government over indiscriminate surveillance of their accounts, but it remains to be seen if any European Yahoo user is willing to start such a trial.

Yahoo Called Accusations “Misleading,” Not False

Yahoo hasn’t said the accusations of allowing U.S. intelligence agencies to search across its whole user emails database are false, just that the initial Reuters article was “misleading,” without giving any specifics for why that is.

Another recent report backed by at least two sources also says that Yahoo allowed a “rootkit-like” backdoor on its systems. If true, this may have given the NSA or FBI much more free reign on Yahoo’s systems than the initial Reuters article implied (just the ability to search for certain words across the email database). The rootkit-like backdoor was also reportedly quite "buggy," which means other attackers could have taken advantage of it to enter Yahoo's systems.

This was one of the reasons why we wanted Yahoo to confirm whether NSA's program was actually installed in 2015, or in 2014 when the recently announced data breach supposedly happened. The data breach may have happened in 2015 after Yahoo installed the backdoor, but the company said it happened in 2014 to avoid having anyone make a connection between the two. However, until we know more information about the data breach as well, this is just speculation.

Whether it was a scanning tool that only allowed searches across all emails, or a rootkit malware with much more expansive capabilities, either method seems to allow indiscriminate surveillance of all Yahoo users, including the European ones. If the Privacy Shield agreement doesn’t protect against this then it may be time to admit the agreement is ineffective for its purpose of protecting EU citizens’ privacy, and it still requires significant improvements.

We've contacted the European Commission and several national Data Protection authorities for comments on this issue.

Hold Security, a company specializing in information security assessment, risk management and incident response, announced that it has discovered a cache of over 1.17 billion stolen online credentials from a Russian hacker that collected the data from a variety of breached sources, including Gmail, Yahoo and Microsoft.

To Catch A Hacker, Like Their Social Media Page

Hold Security was able to track down the hacker taking credit for the stolen information, and it wasn’t as hard as you might think. The Russian cybercriminal was openly bragging about his lifted stash of data in an online forum, and they even provided the company with the files to prove it in exchange for votes or likes to their social media pages.

The initial database consisted of 917 million records totaling over 10 GB, but the first batch of stolen credentials the hacker provided seemed unimpressive from a breach standpoint; the majority of the information was already identified, and appropriate measures were likely already taken to secure the companies or individuals affected. Only 0.45 percent of this data was considered new. What should you expect from a hacker that initially asked for only 50 rubles (less than $1.00 USD) for his talked-up treasure trove and then caved for a few likes on Facebook?

The Bad News

However, after digging deeper, Hold Security discovered the hacker was holding something significant back from the company’s undercover agents: a cache of 1.17 billion stolen email accounts from Yahoo, Gmail and Microsoft, in addition to Mail.ru accounts. The Russian cybercriminal provided this new and potentially more-damaging data set after some further investigation by Hold Security in exchange for (you guessed it) more praise on their social media pages.

The new batch of stolen credentials seemed to hit the three major players in the email game, with nearly 57 million Mail.ru, 40 million Yahoo Mail, 33 million Hotmail and 24 million Gmail accounts compromised. Thousands of credentials from German and Chinese email providers, in addition to logins for employees of some of the largest banking, manufacturing and retail companies located in the U.S are also listed in the stolen data.

The Good News

The company is still working to identify the specific breaches or vulnerabilities that allowed the hacker to gain access to the mega-sized data dump of stolen email logins, but Hold Security also determined that only 272 million of the 1.17 billion pilfered credentials were unique. The company estimated this translates to roughly 42.5 million viable credentials, which is about 15 percent of the total, something Hold Security says it has never seen before.

Despite the high amount of possibly-vulnerable email accounts, Microsoft has issued a statement to Reuters to assure its customers that they have little to fear.

“Microsoft has security measures in place to detect account compromise and requires additional information to verify the account owner and help them regain sole access," read the statement.

Other companies such as Google and Yahoo have yet to comment on the breach. Mail.ru stated that it would warn potentially affected users once they have enough information, but the company’s initial checks found no live combinations of user names and passwords that match existing emails.

Hold Security also doubts the integrity of the stolen data, citing that the credibility and value of the stolen information may not be as impactful as the hacker boasts if they are willing to give up the data for some conversation and social media acclaim.

“50 rubles is what the hacker wants for this incredibly large set of data,” stated Hold Security. “He can’t be serious; based on today’s exchange rate, it is less than one U.S. dollar. This greatly impacts the data’s credibility and value, similar to an expensive sports car being sold for pennies at auction.”

It's Time For A Change (Of Passwords)

Despite what the eventual findings may be, if you are using an email account from one of the affected providers, you could (and should) save yourself from potential unauthorized access by changing your password right now. This time, just make sure it’s something more unique than “password.”

Derek Forrest is an Associate Contributing Writer for Tom’s Hardware and Tom’s IT Pro. Follow Derek Forrest on Twitter. Follow us on Facebook, Google+, RSS, Twitter and YouTube.

A group of five major tech companies, including Google, Facebook, Microsoft, Twitter, and Yahoo, provided written evidence to United Kingdom's Parliament criticizing the new Investigatory Powers Bill (IPB), which promises to expand the mass surveillance and hacking capabilities of the government and weaken the security of technology products.

As members of the Reform Government Surveillance (RGS) coalition, we believe the best way for countries to promote the security and privacy interests of their citizens, while also respecting the sovereignty of other nations, is to ensure that surveillance is targeted, lawful, proportionate, necessary, jurisdictionally bounded, and transparent. These principles reflect the perspective of global companies that offer borderless technologies to billions of people around the globe.

Trust

The companies emphasized the point that user trust is very important for them, and that trust can be greatly degraded if the companies are forced to weaken their security to make government surveillance easier. They are also worried that if the UK passes such a law, then other countries will use that framework as a role model for its own legislation.

Jurisdiction

These mass surveillance-friendly laws could also create a conflict for companies, which would then have to decide whose country’s laws they should violate. For instance, the recent ruling from EU’s top court made it clear that mass surveillance is illegal under EU law, so the UK could pass a law that is in conflict with that decision. It would then put companies in the difficult position of choosing between the UK law and the EU law, or it could force them to leave the UK and possibly even stop offering their services there.

The companies said that the IPB should at least specify that where there is conflict with other jurisdictions, the companies would not be obligated to follow that law. Right now, the companies claim this part of the bill is confusing. They also say that countries should create an international agreement where they clarify the jurisdiction issue.

Encryption

The companies are concerned with the following line from the IPB, which says they have "obligations relating to the removal of electronic protection applied by a relevant operator to any communication or data". Although the UK’s Home Secretary, Theresa May, said that the government will not force companies to weaken their encryption, that’s exactly what that line seems to imply, along with the potential weakening of other security solutions.

The companies want the bill to make it clear that they won’t be forced to weaken their systems to provide the requested data. They also said they shouldn’t be forced to track or keep any additional information about the users that isn’t already part of the companies’ services or business model.

The tech companies want all data requests to be obtained with proper warrants from an independent judge that reviews the actual merits of the matter and not just the process through which the Home Secretary granted the warrant. The data request should withstand the full scrutiny of the Court.

Mass Surveillance

Mass surveillance, or “bulk collection,” as it’s called in the Investigatory Powers Bill, should not be allowed to happen, according to the principles the “Reform Government Surveillance” alliance of companies agreed to promote. All surveillance should be targeted, and all additional information should be destroyed, even if it’s accidentally collected.

More Clarity

The group of companies wants the bill to be more clear in general, so that it’s easy for any intelligent reader to understand exactly the kind of powers the bill gives law enforcement and spy agencies. There shouldn’t be any room for interpretation. This would also make oversight more effective, which should be desirable in any democratic country.

User Notifications

The companies believe that as a general rule, their users should be notified when there’s a warrant on their name. This affords the users the right to protect their own legal rights, and it’s also useful for transparency purposes to see to what extent the government is using its surveillance and data requesting powers. This would make both citizens and members of Parliament more informed about the executive’s actions in the future.

Warrant Recipients

The tech companies also want the UK government to first go to the intended target, and only if it can’t obtain the data this way, it should go to the most proximate source that has access to that data. For instance, if someone uses a smaller email provider that uses Microsoft’s Azure servers, law enforcement should first present the warrant to the user, then to the email provider, and if it can’t be obtained there for whatever reason, then it should go to Microsoft.

Cloud providers shouldn’t become the automatic one-stop shop for data requests from law enforcement just because that would be easier. After all, it’s not Microsoft or even that small email provider’s data - it’s the users’ own data, and they should be the ones targeted with the data request. The companies believe that if things were handled this way, it would accelerate the adoption of cloud services, and the UK could lead the world on this.

Government Hacking

The tech companies urge the UK government to reconsider allowing its spy agencies to hack into their networks or to introduce new vulnerabilities that would put all users at risk. This would make everyone less safe, and it would also deteriorate the trust those users can have in their services, if some other actors find those vulnerabilities and exploit them.

The Investigatory Powers Bill is now undergoing scrutiny by UK's Parliament, and it should be put up for a vote later this year.

Lucian Armasu is a Contributing Writer for Tom's Hardware. You can follow him at @lucian_armasu. 

Follow us on Facebook, Google+, RSS, Twitter and YouTube.

Late last month, researchers from the Universities of Michigan and Illinois, along with Google, discovered that in many parts of the world the opportunistic STARTTLS encryption for email can be easily broken. Following that result, the company decided it will start warning Gmail users when the emails they deliver to other email providers are sent unencrypted.

The new venture is part of the company's quest to improve email encryption. Google started on the path about a year ago when it launched the Safer Email campaign to encourage other email providers to use STARTTLS encryption. Google can encrypt its own emails, but not everyone uses Gmail. If other providers don't support STARTTLS encryption, then those emails, even from Gmail users, will be sent unencrypted to their destinations.

Since then, multiple providers have begun supporting STARTTLS, but according to Google, the biggest boost in email encryption was offered by Microsoft's and Yahoo's adoption of the protocol. However, many smaller providers still don't offer it to their users, so now Google is taking the step to warn its Gmail users when they send an email to a provider that doesn't properly support STARTTLS.

Google discovered that in some places of the world, such as Tunisia, attackers were tampering with the requests to initiate encryption for email. It also uncovered some malicious DNS servers publishing bogus routing information to email servers looking for Gmail. This type of attack can be used to censor or modify messages before they reach their destination. The company said it will be working with other partners from the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) to strengthen the opportunistic email encryption with technologies already used in Chrome to protect websites against interception.

Gmail users should start seeing the unencrypted email warnings in a few months. Google has also been working on an "End-to-End" encryption browser extension ever since the Snowden revelations in 2013, but it hasn't mentioned any progress on it in about a year.

______________________________________________________________________

Lucian Armasu joined Tom’s Hardware in early 2014. He writes news stories on mobile, chipsets, security, privacy, and anything else that might be of interest to him from the technology world. Outside of Tom’s Hardware, he dreams of becoming an entrepreneur.

You can follow him at @lucian_armasu. Follow us on Facebook, Google+, RSS, Twitter and YouTube.

During Yahoo's annual shareholders meeting, the company announced that it has entered into a partnership with Oracle to make Yahoo the default search provider for Java.

Although Google is the world's most popular search engine today, the company is certainly not running unopposed. Bing, AOL, Baidu and Yahoo are all trying their best to take a larger piece of the search engine market.

Though Microsoft's Bing can rely on the popularity of the Microsoft ecosystem of products to help it grow and expand, companies like Yahoo instead need to rely on strategic partnerships to help grow their business.

To that end, Yahoo has signed a new partnership with Oracle to make Yahoo the default search provider of Java for the next three years. The Java installer has already been updated and will now by default set your search engine, your default homepage, and your default New Tab page to Yahoo.

This only applies to users of Google Chrome and Internet Explorer, however. If you are wondering why it's not true of Firefox, it's because Yahoo already has a separate agreement with Mozilla to make Yahoo its default search provider. The Yahoo/Mozilla partnership was signed back in November 2014 and will continue for at least a five year period.

According to Yahoo CEO Marissa Mayer, the partnership with Mozilla has already been profitable for Yahoo and has dramatically increased its search distribution. Undoubtedly, this Oracle deal will help increase Yahoo's share of the search engine market further, but it might also be a bother to some users who don't know how to change their default search engine back to Google and don't like the experience of using Yahoo.

Fortunately, for those who really don't want to use Yahoo, they can simply just uncheck a box and avoid all of this entirely.

Follow Michael Justin Allen Sexton @LordLao74. Follow us @tomshardare, on Facebook and on Google+.

Less than a year ago, Google announced that it's going to develop a browser extension that uses PGP encryption and is easier to use than current PGP tools so that more people can benefit from end-to-end encryption for email. Not long after that, Yahoo's new Chief Information Security Officer (CISO), Alex Stamos, announced that Yahoo is going to join the project and develop the extension to work for Yahoo Mail, as well.

Today, the company unveiled how the End-to-End plugin will work with Yahoo Mail and compared it to GPG Tools, which is a GPG application for Mac OS X. GPG is the "free" (as in freedom) alternative to the proprietary PGP program.

"Just a few years ago, e2e encryption was not widely discussed, nor widely understood," said Alex Stamos, Yahoo's CISO. "Today, our users are much more conscious of the need to stay secure online. There is a wide spectrum of use for e2e encryption, ranging from the straightforward (sharing tax forms with an accountant), to the potentially life-threatening (emailing in a country that does not respect freedom of expression). Wherever you land on the spectrum, we've heard you loud and clear: We're building the best products to ensure a more secure user experience and overall digital ecosystem."

Setting up the Yahoo Mail End-to-End plugin seems to be quite a straightforward process, despite the relatively high number of initial steps:

Install the Yahoo Mail End-to-End plugin from the Chrome web store.Choose whether to generate a new private key or restore an old one (yes, if a new user).Enter the email address you intend to use for encrypted email.Save the backup code somewhere safe (preferably printed or written down on paper).Set a password for your private key.You can click on the extension icon and then "Lock keying" to block anyone else that uses or hacks your computer from getting your private key.Open the Compose window.Click the Lock icon.Write your email in the encrypted Compose window.Click to encrypt.

After the setup process has finished, it's even easier to use the plugin:

Click Compose.Write contact name or email address in the appropriate field.Send protected message.

It's important to remember that only the message content is encrypted, but not who's sending or receiving the email. The subject of the email is also sent unencrypted.

Yahoo hasn't released the plugin for use by regular users yet, as it's still in preview mode. However, the source code is available on Yahoo's Github account, where other developers can contribute. The company also hopes other email providers will build compatible solutions so that when a Yahoo Mail user sends an encrypted email to other email providers, the users of those services can read what the Yahoo Mail user sent.

Until then, the new plugin works only with Yahoo Mail addresses, and it may also work with Gmail in the future, as both come from the same source code. All it needs to enjoy relatively wide adoption is good collaboration between Yahoo and Google.

Follow us @tomshardware, on Facebook and on Google+.

Ghostery was one of the earliest, and has been one of the most popular, anti-tracking tools for desktop web browsers, helping Internet users stop advertisers from tracking their online habits without their consent.

The tool works quite well on the desktop. However, on mobile platforms such as Android, most browsers don't have extension support. It seems Ghostery thought it would be easier for people interested in blocking ad tracking to just install its privacy-friendly browser, which is now available for Android.

The Ghostery browser seems to be built on top of Android's WebView (which is based on Chromium), and it has a standard tab-based interface. The browser gives you a range of options to block all trackers by default or not, or to selectively block or whitelist some of them.

The Ghostery browser also comes with the DuckDuckGo search engine set as default, which is another nice privacy-friendly feature. If you'd rather use Google, Yahoo or Bing, you can select any of them as well.

Ghostery has another feature called "GhostRank," which users can enable to send anonymous information about the trackers being blocked. According to Ghostery, this can be used to improve the anti-tracking service. However, there are voices that say Ghostery gives this (anonymous) data to advertisers as well, and thus those entities can then use the data either to improve their ads so they don't have to be blocked by users anymore, or as some say, to create ads that are Ghostery-blocking resistant.

Users who block all trackers by default may want to be careful, because it may cause incompatibilities with some sites. Users should at least be aware that when a site isn't working, the problem may be caused by Ghostery.

For now, Ghostery remains a tool that can only stop web ad tracking, but not tracking from mobile ads. As Disconnect Mobile has learned recently, Google isn't willing to make that easy for such tools, and it has been trying to limit what anti-tracking tools can do to mobile ads.

Blocking intrusive tracking from web ads is still a step in the right direction for mobile, as well as Ghostery and other tools like it, and it's a good thing for users who don't like being tracked that they're focusing their investment in mobile right now.

The Ghostery browser is available in the Google Play Store.

Follow us @tomshardware, on Facebook and on Google+.

In recent years, cloud computing has been as visible as any topic in IT. Its front-page news status has been accelerated by Amazon, Salesforce.com, Yahoo, and Microsoft®, among other firms aggressively vying for leadership in providing cloud infrastructure or services. However, this race for mindshare has obscured cloud computing facts. Many admit to the haze surrounding cloud computing. This white paper separates fact from fiction, reality from myth, and, in doing so, will aide senior IT executives as they make decisions around cloud computing. While dispelling cloud computing myths, we will answer tough questions: How hard is it to adopt a private or hybrid cloud? How difficult is it to maintain and secure a cloud? How will the cloud transform my business? Do I have the right skill sets in place? What are some of my cost considerations? HP is committing extensive resources to helping customers with all of their questions and concerns around cloud computing.

HP is the sponsor of this material. By submitting your information you agree to be contacted by HP on topics of interest. Before deciding please review HP’s privacy statement. (http://www8.hp.com/us/en/privacy/privacy.html).

Since the Snowden revelations a little more than a year ago, more people have become aware of how little privacy they have on the Internet and that their own governments try to spy on them much more than they thought they would within the limits of the law.

While every single person should try to use more privacy-focused tools to protect themselves, it's not just spy agencies they need to worry about, but also “regular” hackers who can more easily gain their information if it’s not properly encrypted. Ultimately this is a lot to ask from normal Internet users. Ideally, encryption would be something totally invisible to the end-user, happening in the background.

This is where the big tech companies can do a lot to protect their huge userbases without the users themselves doing much at all. Otherwise, it’s going to be an uphill battle to get people to use encryption, especially when using a certain encryption technology means your friends have to use it, too, therefore creating a chicken-and-egg problem.

The good news is that some of the biggest Internet companies have started to focus more on security, with the more notable ones being Google, Yahoo, Microsoft--and even Facebook.

Google

Google is associated with the Internet these days in multiple ways, and it hasn’t taken that responsibility lightly. Back in 2010 the company was among the first mainstream e-mail providers to offer HTTPS encryption by default for its Gmail users. That means all Gmail traffic was being encrypted between the user and the Gmail servers.

Google actually pushed the option for Gmail encryption two years before that, back in 2008, but at the time HTTPS encryption was a significant overhead for Google’s servers, so it was left up to the users. Google presumably knew that the vast majority of them likely wouldn’t enable it, but those who cared a lot about their e-mails being protected would enable the option.

Between 2011 and in 2012 Google also enabled HTTPS encryption by default on its search engine. People look for all sorts of information on Google, some of it being very private information, and much of it is data that the average person wouldn’t want others to know about. In some cases, like in China, people’s lives could be put in danger just for using certain search queries. 

The year 2013 was the year of the Snowden revelations, some of which specifically named Google and its users as being targeted by the NSA. The NSA was hacking into Google’s internal network and getting all data in plain-text because Google wasn’t encrypting the data transfers within its internal network, thinking no one could get access to it in the first place.

This incident caused Google to want to secure its services even more than before, and since then it’s been rolling out security changes a lot faster. Some of the major changes since then include: encrypting the traffic within its internal network, encrypting its serving of ads to web pages, and the more recent change to boost search ranking for websites that enable HTTPS by default.

All of the above changes have been about HTTPS encryption, which is far from being unhackable, and at the same time it does nothing to stop (abusive) government requests for user data.

Perhaps this wouldn’t be a major problem for Google in US, since that’s the law of the land, and ultimately it’s technically US citizens that decide whether they want to restrict the government from making those requests or not. It is, however, a major problem for Google and other US companies when it comes to servicing foreign customers.

If foreign customers don’t trust Google and the US government with their data anymore, then they will simply move to another service. To alleviate this trust issue, Google has recently been working on bringing an improved version of PGP (Pretty Good Privacy) to encrypt emails on the client side. What that means is that nobody, not even Google, can look at those emails except for the sender and the receiver of that email.

This has been regarded as a great move by privacy advocates and could help restore some trust in Google abroad, if it provides this option to both regular users and enterprise users.

Yahoo

Unlike Google, Yahoo isn’t a company that’s known for its security prowess, and in fact, several of the Snowden revelations have named Yahoo users as an easy target for both NSA and GCHQ, the UK spy agency. This must’ve made Yahoo’s new CEO, Marissa Mayer, very uneasy, because soon after that Yahoo announced that it’s going to enable HTTPS by default for its mail, too.

Yesterday, the company also announced that it’s going to be implementing a version of Google’s End-to-End protocol for encrypting email on the client side, making it the second major email company to announce end-to-end encryption for its mail service. It looks like Yahoo wants to follow in Google’s footsteps and become more security focused in the near future, too.

Microsoft

Microsoft has also recently begun to strengthen the security of its online services, and the company has announced that it will allow its Office 365 customers to send encrypted emails to other Office 365 customers as well as to external email accounts such as those from Yahoo, Gmail, Exchange Server, Lotus Notes, GroupWise, Squirrel Mail, and others.

Microsoft thinks this type of encryption can be used for the following purposes:

• A bank sending credit card statements to customers over email.
• An insurance company providing details about the policy to clients.
• A mortgage broker requesting financial information from a customer for a loan application.
• A healthcare provider using encrypted messages to send healthcare information to patients.
• An attorney sending confidential information to a client or another attorney.
• A consultant sending a contract to a client.
• A therapist providing a patient diagnosis to an insurance company.

Facebook

Facebook is known for its privacy issues, but it’s actually one of the first big Internet companies to adopt HTTPS by default, which it did as early as 2011. Privacy and security are not necessarily interchangeable, although they do go together very well. For example, a company could keep its users secure against hackers but still know everything about those customers. So even though Facebook hasn’t been the best in terms of privacy, it has been pretty good at adopting new security standards.

After the Snowden revelations, Facebook has also committed to adopting Perfect Forward Secrecy in its HTTPS encryption, which is a feature Google has adopted since the beginning in 2011 for its Google searches. What PFS does is that it rotates the encryption keys much more often, so if some hacker or spy agency somehow manages to get a key, it won’t be able to decrypt years of data; instead, it can only dig since the last recently used key. Thus, it’s a technique that’s meant to minimize the damage from a major hack.

Facebook has also just recently acquired a server security company called PrivateCore that will help it protect its servers against malware threats, unauthorized physical access, and malicious hardware devices.

What's Next?

While all of these companies have shown some laudable willingness to protect its users as well as possible against surveillance and hacking/data loss, this should be only the beginning. Much more can and must be done before we can truly say that we have a safe and privacy-friendly Internet.

Google

We haven’t yet seen how Google will implement its E2E email encryption, but it needs to be as user-friendly as possible, and as easy as possible to find by Gmail users. If it’s hidden three levels deep in settings, then not a lot of people would even know about it, let alone use it. Google has a business to run here, so we understand them not making this option the default for all emails, but we expect them to make it at least easy to use for people who want to use it.

There’s much more Google could do in regards to Hangouts, too. End-to-end encrypted voice calls and even videos calls are now possible, and end-to-end encrypted texts have been possible for some time now. These technologies are open source, so Google just needs to implement them. All Google needs to do is look at Open WhisperSystems’ TextSecure and RedPhone/Signal apps for great end-to-end encryption for texts and voice.

When it comes to cloud storage, Google should also be offering a way for users to encrypt their data client-side, before it leaves their computers and goes into Google’s cloud. Again, it doesn’t need to happen by default for every user, in part because it’s a little harder from a user experience point of view, but it should be available as a main feature.

If Google would enable all of the above, then even people who don’t trust Google could continue to use Google’s services. If implemented correctly, they wouldn’t need to trust Google because all the data would be encrypted on their side, before it leaves their devices, and then only decrypted by the recipient, with Google being only the channel for delivery.

Yahoo

As previously mentioned, Yahoo announced that it would offer end-to-end encrypted email sometime next year. Yahoo also offers an IM client with voice and video chat capabilities, which could be encrypted end-to-end as well. Yahoo could continue to shadow Google’s security features, and it should be enough to get Yahoo some positive media--something the company has been lacking for years.

Yahoo could, however, go one step further and actually get ahead of Google on some features, such as the end-to-end encryption for their IM conversations (both text and voice/video). That would force Google to respond with a similar feature, so it would be a major win for both of these companies’ users.

Microsoft

Perhaps more than anyone else in this group, Microsoft will respond swiftly to enterprise feedback--or in other words, if lack of trust in Microsoft abroad could cause them to lose billions in revenues, we expect that they would try and fix that as soon as possible.

Where Microsoft needs to turn its attention immediately is Skype, which is used by hundreds of millions of people. Skype used to have a secure, anti-surveillance P2P architecture until Microsoft bought it. Microsoft has said it changed the architecture in order to make Skype more suitable for mobile use and also more scalable. That’s a believable technical reason, but at the same time the changes also made it much easier to be snooped upon by spy agencies, whether legally or illegally, and not just in US, either. If Microsoft wants Skype to regain trust as a private communication app, then it needs to implement some form of end-to-end encryption, too.

As a cloud storage provider, through its OneDrive service, Microsoft also needs to offer an option for encrypting the data on the client side, before it's uploaded to its cloud.

Facebook

Facebook has one of the most popular messaging clients on Earth, and it has just acquired another very popular one in Whatsapp. But neither of them use end-to-end encryption, nor do they offer the option. If implemented, encryption could bring huge privacy benefits to Facebook’s users, and it could alleviate some of the trust issues Facebook has been having lately, too.

I believe all of these companies' latest security efforts are genuine, not just because they want to do what’s best for their users, but also because they risk losing a lot of business in other countries--countries that may not trust US tech companies as much anymore. Some could even ban them from doing business within their respective borders.

At the same time, they should also be encouraged to continue improving their security infrastructures and continue to adopt stronger and safer encryption protocols that can better protect users against mass surveillance and hacking.

Follow us @tomshardware, on Facebook and on Google+.

INTRODUCTION/REQUIREMENTS

At some point we all have dreamed of building a website but have done research into the subject and found out some...let's say "dodgy" stuff about it. These were something along the lines of having to pay for a domain or for hosting, worrying about how much bandwidth your site is going to use up and whatnot. In this tutorial, I will show you how to set up your own domain with unlimited hosting, for free.

To do this, you are going to need:

A computer or tablet (preferably a computer)
A basic understanding of how websites work
An email address (If you don't have one, read the first paragraph in the Step By Step Tutorial section.)
Some experience in coding (optional)
And that's it.

STEP BY STEP TUTORIAL

Part One: Registering a domain

The first step is to register our domain name. To do this we are going to need an e-mail address (you can get one of these from companies like Google or Yahoo [other email providers are available], click Here or Here to set one up) as we need it to register our domain.

To register a domain, first open a new tab in your browser and go to www.dot.tk, where you should see something like this:

Dot.tk is a site where you can register free domain names, but unfortunately, we are restricted to the single ".tk" domain name as it is free; "you get what you are given," effectively.

If you wanted a top level domain, you would have to register a domain with a registrar such as GoDaddy where you can see the prices of domains, but we won't be doing that in this tutorial.

What we want to do now is register our domain, but choose wisely, because we don't want to make a big mistake like Pen Island Pens did with their domain (penisland.net); I think you can figure that one out by yourselves, but anyway, simply enter your desired domain name into the box and press "Go."

You should end up with something like this:

As you can see, I am registering Napkins.tk (as there is a napkin on my desk for some reason).

If you don't, and it says "Domain Name Already Taken," or if it says something about it being a special domain, choose a different one.

We want to sign up, so enter all of the required information. Where it says "Use your new domain," simply find a random image on Google images and copy-paste the image location into the redirect, then register as we are going to change the DNS of the domain later on.

To register, click "Sign Up" and click the service you want to sign up with, such as Facebook, Twitter or Google.

Then click "Login to My Dot Tk" at the top right as shown:

Next, Login with a social account (again) or sign up using your own e-mail address and password as shown:

Then you should end up here:
 

And that's our domain registered. Please note: it may take a while before you can actually go to your domain (up to 48 hours or so).

Part Two: Web Hosting

Now, do not close that page. Instead, open another tab and navigate to hourb.com.

When on that page, you should see this:

We want to click "Sign Up."

Fill out the required information. When you are done with the process, check back here with the next step.

We want to select "Free Hosting" as opposed to Super Freemium with ads as shown below:

After filling out the required information and creating the site, press "Switch" on your domain in the control panel.

You will then get this message:

This means that we need to point our .tk domain to the nameservers of our webhost.

Therefore, we need to go to accounts and click "Details" (both are circled in the image below):

You should end up with this:

So we need to go back to our my.dot.tk tab and modify our domain.

We need to enter in the Name Servers like so:

And press "Save Changes."

Now, we should be able to go to our domain and see the result:

Again, it may take up to 48 hours to actually get the domain working. Don't worry though; in the meantime, you can build your website using HTML, PHP or if you don't know any of those languages, use a package like Wordpress or Joomla.

It's really that simple.

Enjoy your new domain and unlimited webspace!

Social networking sites like Facebook have a spam filter in place to try to reduce the number of phishing sites, so you may need to enter a code into Facebook to share your new site.

Please note that I am in no way being paid or bribed to advertise any companies, all services used in this tutorial are strictly used because they are what I use for my personal purposes. Boy that's a tongue twister.

The above content was adapted from our Tom's Hardware Tutorials Forum contributed by community member IllusoryLawyer1.

Back in November of last year, Microsoft announced that its Windows and Windows Live President, Steven Sinofsky, would be leaving the company.  Sinofsky was at the helm of Office products and lead the teams on the development of Windows 7 and 8 products. To say he had a pretty big role at Microsoft would be an understatement. In December, Sinofsky announced that he would be returning to Harvard Business School for a teaching position in the spring of 2013. Sinofsky, a 23-year vet at Redmond, no doubt has a lot to teach students at Harvard Business School, but will he stay? According to his Twitter profile, he's currently on sabbatical, and recent reports suggest Sinofsky's options for employment will open up considerably come December. 

Mashable points to an SEC filing from Microsoft that lists the seven companies named in Sinofsky's non-compete agreement. According to the filing, under the terms of his departure, Sinofsky is not allowed to accept 'direct or indirect employment' with Amazon, Apple, EMC, Google, Facebook, Oracle, or VMware.

Not exactly surprising that Microsoft would want to prevent a former employee that spent nearly a quarter century at the company from working for the competition. More interesting, though, is what Sinofsky will do once the non-compete expires. According to the filing, that will happen on December 31 of this year. Where will Sinofsky be in 2014?

Lenovo said on Wednesday that Yahoo co-founder and former CEO Jerry Yang is now serving as an observer on its Board of Directors. He will not only attend board meetings, but share his experience and perspective as an Internet and technology pioneer. He will not be able to vote or have any of the rights given to directors.

While studying Electrical Engineering at Stanford, Yang and co-creator David Filo launched a website called "Jerry and Dave's Guide to the World Wide Web" in April 1994. Shortly thereafter it was renamed as Yahoo! and became quite popular, thus leading the two to co-found Yahoo Inc. as a business in April 1995. Yang finally left the company in January 2012 after being replaced by Carol Bartz as CEO in 2009.

Lenovo said Yang's appointment as an observer on the board further strengthens the company's reputation as a transparent international entity. His perspective, experience and "proven entrepreneurial spirit" will help Lenovo continue to drive growth and expand its business, the company said.

"I am honored to join Lenovo as a board observer at an exciting time in its growth," Yang said. "I look forward to leveraging my past experience as a technology entrepreneur and innovator to provide advice as Lenovo looks at new areas of growth.  I believe that Lenovo's strong leadership team, coupled with their innovative strategy positions them well for continued success as a global leader in technology."

Lenovo will reportedly pay Yang $61,875 per year to serve as an observer. The Hong Kong-listed company will also offer him equity rights with a value of $135,000. In return, he will be required to attend board meetings and provide his views.

Lenovo is currently battling HP for the top spot as the world's leading PC maker. In early February, Lenovo reported that it continued to outgrow the market in all geographies with record sales, earnings and global PC market share. The company saw a quarterly sales record of $9.4 billion, a 12-percent year-over-year increase. Lenovo's smartphone business also finally became profitable in China, shipping 9.4 million phones, 9 million of which were smartphones.

_{Contact Us for News Tips, Corrections and Feedback}

In a circumstance that is really only possible in Hollywood, Vince Vaughn & Owen Wilson score an internship at a company that many - at least those of us who lived through the dotcom boom and bust - perceive to be synonymous with Internet stardom - Google.

The film appears to be heavily drawing from the clichés the general population imagines Google to look like: Self-driving cars in front of a monstrous headquarter, food, and an organization that is flooded with computer geniuses in their mid-20s displaying awkward humor.

So, can "The Internship" be funny? I don't know. The movie won't be released until summer, but the trailer suggests that Google is mainstream enough to be the anchor for a movie. Some may scratch their head and wonder why Google was picked over Facebook.

_{Contact Us for News Tips, Corrections and Feedback}

Google's Gmail has overtaken Hotmail as the world's most-used email service, according to website traffic tracker ComScore.

Data released by ComScore confirmed that Gmail experienced 287.9 million unique worldwide visitors last month, while Microsoft's Hotmail received 286.2 million unique visitors during the period. Following Hotmail in third place was Yahoo, boasting 281.7 million unique visitors, according to ComScore.

Comparatively, Yahoo enjoyed 76.7 million unique visitors in the United States, while Gmail was second with 69.1 million and Hotmail with 35.5 million.

ComScore's figures quashes any doubt that Google is the world's top email service provider. In the summer of 2011, Google claimed to be the largest email service based on internal numbers, but the search engine giant didn't back up its claim with third-party data.

_{Contact Us for News Tips, Corrections and Feedback}

New Yahoo CEO Marissa Mayer has acquired her first startup for the Internet firm in the form of Stamped, a recommendations engine built by former Google colleagues.

Stamped, a smartphone app that launched last November, enables users to recommend books, movies, restaurants, among others to friends through giving them a virtual stamp of approval. The technology utilizes a social graph which allows you to follow recommendations stemming from friends and celebrities.

According to Crunchbase, Stamped raised around $3 million from investors, including aspiring venture capitalist Justin Bieber, Bain Capital Ventures and Google Ventures.

The predominant reason Mayer acquired Stamped is said to be only for its talent, which consists of nine former Google employees. The Stamped app will be discontinued, confirmed Yahoo.

"Robby, Kevin, Paul, Bart, and the entire Stamped team are a natural fit for us," Adam Cahan, Yahoo's senior vice president of emerging products and technology said. "Their experience building fun, useful, personalized mobile products aligns well with Yahoo's vision to create the best everyday mobile experience for our users. They will be a great asset as we expand Yahoo's mobile efforts and build a world-class mobile development organization."

_{Contact Us for News Tips, Corrections and Feedback}

Web Browser Grand Prix: iOS Circuit

Before we begin, we have to touch on one key fact that makes iOS unlike any other popular operating system today: the strict walled garden. You see, Apple mandates that any third-party Web browser sold in the App Store must use the stock WebKit rendering and JavaScript engines.

That's right folks, they're all WebKit browsers. And not just different WebKit browsers like Chrome and Safari on the desktop, either, but complete mobile Safari clones. Think of third-party iOS-based Web browsers as Safari wearing different clothes. Sure, some of them have totally different syncing features, bookmark mechanisms, on-screen keyboards, and even user interfaces. But when it comes to a Web browser's primary function of rendering Web pages, they are all just re-spins of Apple's stock, default mobile Safari.

So all iOS Web browsers are going to be the same then, right? Not entirely.

While Apple demands that third-party browsers use the stock engines, Safari has access to the newer Nitro JavaScript engine, while the rest are left with Safari's old JS engine. Apple's mandate doesn't even the playing field; it stacks the deck in Safari's favor.

As recently as this August, Opera aired its opinion regarding the App Store rules to The Times of India:

"Opera believes the Web is best when consumers can freely choose the browser they use. We wish that the rules are changed in the future to allow Opera Mobile (our full-fledged mobile browser) in iOS store, just as it is possible on other platforms like Android.”"Right now we offer Opera Mini on the iOS platform. The way Opera Mini gets around this issue is that all the processing is actually done on a proxy server and not on the iOS device. If we had not used a proxy-based solution in Opera Mini, then we would have been required to use the native browser engine."Shwetank Dixit, Opera Web Evangelist

We have to imagine that everyone else in the business of creating Web browsers is in agreement. After all, iOS is still the tablet platform.

Unfortunately, Opera Mini and the other “mini browsers”, such as Dolphin Mini and Skyfire, are resistant to most traditional benchmarks due to the manner in which they function. Unless the benchmarks are nearly instantaneous, the remote server times out mid-test.

Although the differences between Safari and third-party browsers is going to be the key match-up on this platform, we've seen that page load times and HTML5 performance don't always fall into rendering and JavaScript engine expectations. So, perhaps we'll see one of the third-party browsers rise to the top.

But before we can move onto the benchmarks, let's take a quick look at the iOS-based contenders, and then go over how the desktop Web Browser Grand Prix benchmark suite has changed to accommodate mobile tablet computing.

Axis, Chrome, Dolphin, Maxthon, Safari, Sleipnir

iOS Web Browser Grand Prix Competitors

Vendor:Yahoo!Layout Engine:WebKitCurrent Version:1.1.3Supported Platforms:iOSDownload Axis on the App Store

Chrome

Vendor:GoogleLayout Engine:WebKitCurrent Version:21.0.1180.82Supported Platforms:Android (4.0+), ChromeOS, iOS, Linux, OS X, WindowsDownload Chrome on the App Store

Dolphin

Vendor:MoboTapLayout Engine:WebKitCurrent Version:5.4.1Supported Platforms:Android, iOSDownload Dolphin for Android

Maxthon

Vendor:Maxthon InternationalLayout Engine:WebKitCurrent Version:1.3 build 5Supported Platforms:Android, iOS, OS X, WindowsDownload Maxthon on the App Store

Safari

Vendor:AppleLayout Engine:WebKitCurrent Version:6.0Supported Platforms:iOS, OS X

Sleipnir

Vendor:Fenrir IncLayout Engine:WebKitCurrent Version:2.1.2Supported Platforms:Android, iOS, OS X, WindowsDownload Sleipnir on the App Store

New operating system, new CPU architecture, new browsers. It's no surprise that the usual Web Browser Grand Prix test suite required an overhaul, too. Now let's take a quick look at the updated test setup and benchmark suite.

Test Setup And Benchmark Suite

Victims of the Transition to Mobile

Our start time test is now scaled back to just a single tab, started "hot". Tablet operating systems only load the page in the active tab, and additional background tabs do not load until they're selected, making the eight-tab start-up time difficult to accurately measure and basically irrelevant. Likewise, most people never actually power down their tablets, making “cold” start times irrelevant as well.

Current mobile operating systems also handle memory and multi-tasking in a very different manner than PC operating environments, with a focus on suspending background applications and single-tasking. Therefore, the memory efficiency tests from the desktop suite are also not needed.

With the loss of the 40-tab memory test and the inability to load all tabs simultaneously, the page load reliability and responsiveness tests cannot be applied to mobile platforms either. While we could include "smoothness" and/or "usability" indicators, because this is the first time we're running the WBGP on iOS, we want to see how the raw numbers stack up before injecting any subjective metrics into the equation.

Because tablets do not have on plug-ins like desktops do, the Flash, Java, and Silverlight tests from the desktop WBGP test suite are gone, too. And finally, mobile platforms do not yet support WebGL, so those tests from the regular WBGP suite were dropped as well.

Test Setup And Benchmark Suite

Display9.7" LED-Backlit IPS Retina Display (2048x1536)ProcessorApple A5X ARM Cortex-A9 @ 1 GHz (dual-core)Memory1 GB LP-DDR2Storage16 GBNetworking802.11 a/b/g/nLocal Web Server SpecsOperating SystemUbuntu 12.04.1 LTS Server Edition "Precise Pangolin" (32-bit)ProcessorIntel Pentium 4 @ 2.41 GHzMotherboardBiostar P4M80-M4Memory768 MB DDR @ 333 MT/sGraphicsNvidia GeForce FX 5500 128 MB DDR (AGP)StorageWestern Digital Caviar SE WD1600AAJD, 160 GB EIDE, 7200 RPMExtra PackagesApache2, MySQL Client, MySQL Server, PHP5, PHP-GD, PHP5-MySQL, PHPMyAdmin, SSH, Node.js, NPMNetwork SpecsISP ServiceCox Preferred (18 Mb/s down, 2 Mb/s up)ModemMotorola SURFboard SBS101URouterLinksys WRT54G2 V1Benchmark SuitePage Load TimeStart Time (Yahoo! homepage, Cached)Uncached Load Time (Eight Test Pages)Cached Load Time (Eight Test Pages)JavaScriptRIABench JavaScript (Nine Tests)Apple SunSpider v0.9.1 (Google Mod)Mozilla Kraken v1.1Google Octane v1FutureMark Peacekeeper v2RightWare BrowserMarkDOMMozilla Dromaeo DOM CoreCSSKaizoumarkHTML5GUIMark2 HTML5 (Four Tests)Asteroids HTML5 Canvas 2D And JavaScriptHTML5 Canvas Performance TestImpact HTML5 BenchmarkMandelbrot Set in HTML5 (FHD)Hardware AccelerationWebVizBenchStandards ConformanceHTML5Test.comThe CSS3 TestEcmascript Language test262Facebook ringmarkSecurityBrowserscope Security

The iPad, local Web server, and all software were updated as of midnight (Eastern Standard Time) on October 15th, 2012.

Now, let's break some new ground and see how the iOS Web browsers stack up against each other.

Benchmark Results: Page Load Time

Page Load Time Composite Score

Our page load time composite score is the geometric mean of the start time, uncached, and cached page load results. All test pages are saved and hosted from our local Web server, resulting in steadier iterations than live webpages.

Safari steals first place with the only page load time under two seconds. Maxthon surprisingly rides ahead of the pack at just over two seconds to become the runner-up. Dolphin takes third place at nearly 2.2 seconds, followed closely by Chrome and Sleipnir in fourth and fifth place, respectively. Yahoo! Axis is the last-place finisher, with a time of nearly 2.4 seconds.

Start Time

The Yahoo! homepage serves as the test page in our start time test. The test page is loaded in cache and each browser was started and stopped prior to testing. The start time test results are the average of three iterations.

Start times go to Apple Safari, followed by Maxthon in second place. Axis, Dolphin, Sleipnir, and Chrome all essentially take the same amount of time to start up and finish loading their homepages, tying for last place.

A page on BBQ brisket from About.com, the Computer Parts & Components category on Amazon, a random popular question on Ask.com, the "free" section for Los Angeles on craigslist, my LinkedIn profile, and the Wikipedia entry for "Tom's Hardware" round out our page load time test pages. All page load time results are achieved by averaging five iterations.

Uncached

In order to achieve the uncached page load times, each browser's history and cache is cleared, and the browser closed then reopened between iterations.

Maxthon manages to beat out Apple's own Web browser by a slim margin in uncached page loads. Axis, Dolphin, and Sleipnir all basically tie for third place, with Google Chrome bringing up the rear about 0.35 seconds behind the pack.

Cached

When loading pages that are already in the browsing history, Chrome takes the lead at 1.3 seconds. Maxthon, Dolphin, and Safari practically tie for second place, running between 1.4 and 1.5 seconds. Sleipnir places third at 1.65 seconds, with Axis taking last place.

Drill Down

The charts below contain the uncached and cached page load times of all eight individual test pages for each browser.

Notes: Chrome's stand-out losses in uncached page loads are from About, Amazon, and, ironically, Google! Meanwhile, Yahoo! Axis has extra trouble loading Amazon, LinkedIn, and Wikipedia from cache.

Benchmark Results: JavaScript Performance

JavaScript Composite Score

The JavaScript composite score is the geometric mean of the results from RIABench JavaScript, Google's modified version of Apple SunSpider, Mozilla Kraken, Google Octane, FutureMark Peacekeeper, and RightWare BrowserMark.

Safari absolutely wrecks the competition with its unsporting Nitro JavaScript engine advantage, nearly tripling the scores of the other iOS-based browsers. The third-party iOS browsers, which all share Safari's old JS engine, essentially tie for second place.

Drill Down

The charts below contain the individual results for each JavaScript performance benchmark.

Note: The single RIABench score that gets factored in to the JavaScript composite is derived from the geometric mean of all nine JavaScript RIABench tests.

Benchmark Results: DOM And CSS Performance

DOM (Document Object Model)

We use the DOM Core subsection of the Dromaeo DOM tests to represent DOM performance in our final scoring. The Dromaeo results are an average of two iterations.

Again taking advantage of the off-limits Nitro JavaScript engine, Apple Safari smashes the competition in core DOM performance, nearly doubling the competing results. As with the JavaScript benchmarks, the third-party iOS-based Web browsers all essentially tie for second place.

CSS

Kaizoumark is a newcomer to the Web Browser Grand Prix. This CSS performance test outputs a collection of frame-per-second scores, one for each test and workload level. Our final Kaizoumark score is the sum of all FPS scores.

The CSS performance results are more or less a wash, with Axis showing a negligable lead and Chrome showing an indistinguishable loss. Due to the shared rendering engine of all iOS browsers (WebKit), CSS performance is basically going to be the same across the board.

Benchmark Results: HTML5 Performance

HTML5 Composite Score

The HTML5 composite score is the geometric mean of the results from GUIMark HTML5, Asteroids HTML5 Canvas 2D Rendering And JavaScript Benchmark, HTML5 Canvas Performance Test, Impact HTML5 Benchmark, and Mandelbrot Set in HTML5.

Once again, Safari has a strong lead over the third-party browsers, nearly doubling their results. Only Maxthon shows a slight lead over the remaining third-party browsers, but even it cannot touch Safari. The rest of the competition practically ties for third place, though Dolphin lags behind a bit.

Drill Down

The charts below contain the individual HTML5 performance benchmark results.

Notes: We had to drop GUIMark2's Vector Charting Test because, for some reason, those tests will not run on Chrome. We substituted the GUIMark3 Vector Test in its place. A single GUIMark HTML5 score, which is included in our HTML5 composite score, is derived from the geometric mean of the three GUIMark HTML5 tests. We test using the FHD image setting in the Mandelbrot Set in HTML5 benchmark.

Benchmark Results: HTML5 HWA And Security

HTML5 Hardware Acceleration

We had to use WebVizBench as the sole hardware acceleration benchmark for iOS because Pyschedelic Browsing and JSGameBench fail to run properly. These results are the average of two iterations.

Maxthon and Sleipnir tie for first place with a very minor lead over second-place finishers Axis, Chrome, and Safari. Dolphin again displays a very minor disadvantage, placing third. For all intents and purposes, HTML5 hardware acceleration performance will be the same on any iOS browser, although with all other factors being equal, Safari would most likely have an advantage on any real-world HTML5 pages due to the Nitro JavaScript engine.

Security

The BrowserScope Security test appears to still be valid, as most browsers continue to fail at least one of its 17 security checkpoints.

Not much happens, though. Again, since each iOS browser is essentially Safari in different clothes, it's no surprise that all iOS-based browsers earn the exact same score: 14.

Benchmark Results: Standards Conformance

Conformance Composite Grade

Our conformance composite grade is achieved by dividing the results of each browser by the maximum score in each test, multiplying by 100, and averaging the different benchmark scores together.

Every iOS-based browser has identical conformance composite grades, save for Sleipnir. The Japanese browser would not get past ring zero on Facebook's ringmark, earning the unfortunate distinction of last place in standards conformance on iOS.

Drill Down

The charts below contain the results of each standards conformance benchmark.

Notes: The highest score in Ringmark is determined by the highest number of tests conducted among the competing browsers. All iOS-based browsers finish the conformance tests with the exact same result, except for Sleipnir.

Final Placing And The iOS Winner's Circle

With the mobile Web Browser Grand Prix, we've dropped the placing tables, brackets, and point system entirely. Since we lost so many categories of testing in the transition from the desktop to mobile, the remaining categories are mostly from the Essential bracket: CSS, DOM, JavaScript, and Standard Conformance. At the same time, the remaining categories from the Important bracket are upgraded due to the slower time scale on mobile devices: HTML5, Page Load Times, and Security. Only hardware acceleration (HWA) remains. But, due to the slow progression of titles able to exploit HWA, even that will arguably play a bigger role for casual gaming on mobile devices long before supporting hardcore games on the desktop.

Our new final scores are the geometric mean of all eight mobile WBGP composite scores, which makes creating the placing table and applying a point system unnecessary.

Drum roll, please. And the winner is...

Surprise, surprise, it's Apple's own Safari.

Safari's access to Nitro really pushes it way ahead of the other browsers designed for iOS. While Dolphin, Axis, Chrome, and Sleipnir all have slightly different scores, they are basically equals. With page load times and a smoothness nearly equal to Safari, Maxthon is really the only third-party iOS browser that stands out. But, in the end, any third-party Web browser on iOS is essentially tantamount to using an older version of Safari with a slightly different user interface and additional features. Therefore, if for whatever reason you decide against using Safari on your iOS-based device, you're best off simply going with the browser that you like the best.

Due to Apple's App Store mandate that all third-party iOS browsers utilize Safari's stock engines, browser competition on this mobile operating system is practically non-existent. Unless Apple reverses course, allowing other developers to compete using their own unique rending and JavaScript engines, we really only need to check in with iOS every time the platform receives a substantial upgrade.

But Tom's Hardware, I hate Apple. What about Android?

We're already working on it, folks. With Chrome, Firefox, and Opera providing their own unique engines, distinct from the stock Android browser, and Dolphin, Maxthon, and Sleipnir providing their own take on WebKit, Android is where the real mobile Web browser action is. That mobile operating system should be just as vibrant and competitive as any on the desktop. Stay tuned next week for the Android Web Browser Grand Prix.

Follow Adam on Twitter

The Top Four Browsers, Tested And Ranked

But before we find out, let's get everyone caught up on the latest happenings in the world of Web browsers.

Recent News And Events

07/17/12: MSFT Faces EU Probe Over Browser Ballot Compliance
07/25/12: Apple releases Safari 6 along with OS X 10.8 'Mountain Lion'
07/25/12: RockSalt Could Pave Way to Safe Native Apps in Browsers
07/26/12: Did Apple Just Kill Safari for Windows?
07/28/12: Firefox Add-ons Reach 3 Billion Downloads
07/31/12: Google releases Chrome 21
08/02/12: Mountain Lion: Three Million Downloads in Four Days
08/02/12: Opera updates to 12.01
08/06/12: Microsoft Finally Intros Its Own WebRTC Proposal
08/09/12: Microsoft Sticks to 'Do Not Track' Plans for IE in Windows 8
08/15/12: Mozilla's Firefox OS Ported to Raspberry Pi
08/16/12: Google Increases Rewards for Bug Catchers...Again
08/20/12: Break Google's Chrome, Get Up to $2 Million
08/20/12: Mozilla Rechallenges Google in Browser Speed Race
08/23/12: Google Introduces Octane Browser Benchmark
08/28/12: Mozilla releases Firefox 15
08/29/12: Mozilla Ports Full FPS Engine to WebGL; Playable Demo
08/27/12: Google Patents WYSIWYG Printing for Web Apps
09/02/12: Google's Chrome Browser is Now 4 Years Old

And Then There Were Four...

While the latest version of Safari for Windows (v5.1.7) is available for download on the Apple support pages, links to any mention of a Windows version have been completely removed from the Safari product pages on Apple's website. Notably, Apple no longer attempts to bundle Safari with the iTunes and QuickTime downloads either. And although Apple refuses to comment on Safari for Windows, the writing is on the wall.

I want to take a moment to relate our experience with Apple Safari, which unfortunately, never saw the light of day.

Web Browser Grand Prix 0: Safari's Finest Hour

In the months of preliminary testing and benchmark gathering, which eventually coalesced into the first Web Browser Grand Prix, Safari was the front-runner. Before Chrome 4 and Opera 10 came along, Safari dominated the Windows landscape in terms of performance. In fact, Safari 3 becoming available for Windows was the real catalyst for the browser speed wars we've seen over the past few years, and not the debut of Google Chrome, as most people seem to think.

Mere weeks before the first Web Browser Grand Prix published, Safari had a lock on the (then) purely speed-based test suite. It was looking like a landslide. In the end, though, it all came down to unfortunate timing for Apple, as Chrome 4 and Opera 10 emerged just before we began testing. In my mind, Safari 4 is the Champion of the Web Browser Grand Prix that never was.

If you're one of the few Windows users who loved Safari, our sincere regards. Even if you only liked the browser in order to hate on it, the loss of one of the five major players is a loss for all. The more competition between Web browsers, the better. The more browsers, the more fractured the market. The more fractured the market, the better and more important standards become. And when you have open, universally-recognized standards, new players can compete more readily, and any company looking to impose vendor lock-in on the Web will have a much harder time doing so.

Let us observe a quick non-denominational moment of silence in honor of Safari for Windows...

OK, that was enough. Let's ditch this funeral and hit the track!

Chrome, Firefox, IE9, Opera, Safari

Web Browser Grand Prix Champions

The table below lists all of the previous Web Browser Grand Prix winners, with links to their respective articles.

Web Browser Grand Prix 2: The Top Five Tested And RankedWeb Browser Grand Prix 2: Running The Linux CircuitWeb Browser Grand Prix 3:  IE9 Enters The RaceWeb Browser Grand Prix 4: Firefox 4 Goes Final

Web Browser Grand Prix 5: Opera 11.50, Firefox 5, And Chrome 12

Web Browser Grand Prix VI: Firefox 6, Chrome 13, Mac OS X LionWeb Browser Grand Prix 7: Firefox 7, Chrome 14, Opera 11.51

Web Browser Grand Prix VIII: Chrome 16, Firefox 9, And Mac OS XWeb Browser Grand Prix 9: Chrome 17, Firefox 10, And UbuntuWeb Browser Grand Prix: Chrome 18, Firefox 11, Windows XP

Web Browser Grand Prix: Chrome 20, Opera 12, Firefox 13

Web Browser Grand Prix Contenders

ChromeVendor:GoogleDebut:9/02/2008Current Version:21Layout Engine:WebKitJavaScript Engine:V8Supported Platforms:Windows, OS X, Linux, Android, iOSHTML5 Hardware Acceleration:NoWebGL:Windows & OS X-OnlyWBGP Wins:6 (4 Windows 7, 2 Linux)Download Chrome!

FirefoxVendor:MozillaDebut:11/09/2004Current Version:15Layout Engine:Gecko 2.0JavaScript Engine:JaegerMonkeySupported Platforms:Windows, OS X, Linux, Android, iOSHTML Hardware Acceleration:YesWebGL:YesWBGP Championships:3 (Windows 7)Download Firefox!

Internet ExplorerVendor:MicrosoftDebut:8/16/1995Current Version:9Layout Engine:TridentJavaScript Engine:ChakraSupported Platforms:Windows (Vista and 7)HTML5 Hardware Acceleration:YesWebGL:NoWBGP Championships:2 (Windows 7)Download Internet Explorer!

OperaVendor:Opera SoftwareDebut:12/09/1996Current Version:12Layout Engine:PrestoJavaScript Engine:CarakanSupported Platforms:Windows, OS X, Linux, Android, iOSHTML5 Hardware Acceleration:NoWebGL:NoWBGP Championships:2 (Windows 7, Windows XP)Download Opera!

SafariVendor:AppleDebut:1/07/2003Current Version:6Layout Engine:WebKit 2JavaScript Engine:NitroSupported Platforms:OS X, iOSHTML5 Hardware Acceleration:YesWebGL:NoWBGP Championships:2 (OS X)Download Safari!

Test System Specs And Software Setup

Hardware Setup

The following table contains the system specs of the local Web server used for our Start and Page Load tests, as well as JSGameBench.

The table below holds additional information on the test network.

Software Setup

Both test installations were freshly installed and fully updated as of midnight on August 25^th, 2012. Power management and automatic updates were disabled before testing.

All the software we installed, including the exact version number of the browsers tested, is listed in the table below.

Test Suite And Methodology

Changes

The Start and Page Load test pages are updated to current versions, with the exception of the Tom's Hardware Wikipedia page, which has not changed since the last update. We say goodbye to YouTube, eBay, and The Huffington Post. In their place is an About.com page on barbeque, a randomly-selected popular question on Ask.com, and my own LinkedIn profile page. The Google homepage is replaced with the search results page for "Tom's Hardware", and craigslist is now the "free stuff" results page for Los Angeles. Amazon remains as the Computer Parts & Components page, though we update it. And finally, the Yahoo homepage is updated and now serves as the single-tab test page in place of the old Google homepage.

We're introducing the remaining RIABench JavaScript, Flash, Java, and Silverlight tests. RIABench JavaScript consists of eight tests, Java has seven tests, while Flash and Silverlight have all ten tests. The final RIABench scores are now the geometric mean of individual tests, instead of simple averages.

CSS Stress Testing & Performance Profiling is now performed on the CSS version of the CSS3 Speed Test demo page. Microsoft's Maze Solver CSS3 benchmark is being retired in favor of the bookmarklet applied to the CCS3 version of the very same CSS3 Speed Test demo page.

We're also adding The CSS3 Test to our standards conformance tests. It replaces the HTML5 Capabilities section of Futuremark Peacekeeper 2.0. HTML5Test.com is now the sole HTML5 conformance test in the standards conformance composite, providing an even split between JavaScript, HTML5, and CSS3 in our final standards conformance grade.

Last but not least, the JavaScript Composite score is also being switched to geometric mean instead of the inverse averages we used in the previous installment.

Web Browser Grand Prix Test Suite v12

The table below lists all 34 benchmarks (consisting of 77 individual tests) currently in our suite, along with the version number and link (where applicable), and the number of iterations performed.

Methodology

We restart the computer and allow it to idle before benchmarking. Most individual benchmark final scores are an average of several iterations. More iterations are run for tests that have short durations, lower scales, and/or higher variance. Any obvious outliers (usually network hiccups) are removed and retested.

We switched most of the composite scores from arithmetic mean (average) to geometric mean in order to ensure that every test in each category is given equal weight, regardless of absolute value. The exceptions are the Standards Conformance grade and Memory Efficiency score, which are achieved differently, as well as the Reliability, Responsiveness, and Security composites, each of which only contains a single test.

Individual detailed methodologies and information regarding composite scoring is described on the corresponding benchmark pages.

Start Time

Start times are recorded right after a fresh boot (cold) and again after the browser has already been launched (hot). We time both a single home tab and an eight-tab group. Yahoo! serves as the test page for our single-tab tests, while pages from About, Amazon, Ask, craigslist, Google, LinkedIn, and Wikipedia round out the test pages of the eight-tab measurement. All test pages are hosted on our local Web server and cached in the Web browsers.

Composite Scoring

The start time composite score is the geometric mean of the hot and cold times for the single-tab and eight-tab tests.

Google Chrome takes a slight lead over Safari on Apple's own operating system, at two and 2.2 seconds (respectively). Firefox places third with just under 2.5 seconds, followed by Opera at three seconds.

All of the Windows 7 times are significantly lower than OS X, with Chrome again taking the lead at just 0.8 seconds. This time, Chrome is followed by Opera at just under one second. Internet Explorer is in third place at just over 1.2 seconds with Firefox placing fourth, mere tenths of a second behind IE9.

Drill Down

The charts below contain results for cold and hot single-tab start times, followed by the cold and hot eight-tab times.

Chrome is the clear winner at start time, with the only exception being a longer single-tab cold start than the other competitors. Firefox and IE9 also display irregularities. Mozilla's browser has a slight advantage starting with a single-tab cold versus hot, while IE9 takes an incredible amount of time to open a single tab cold versus any other situation.

Page Load Time

The page load time tests are the same eight pages in our start time tests: About, Amazon, Ask, craigslist, Google, LinkedIn, Wikipedia, and Yahoo.

Composite Scoring

Composite scores are the geometric mean of the uncached and cached page load times.

Chrome is in first place on OS X, followed closely by Safari, at 0.65 and 0.7 seconds (respectively). Opera places third at just over three-quarters of a second, with Firefox placing last with a time just over 0.8 seconds.

The page load times are also lower across the board on Windows 7 than OS X. Here, Microsoft's own IE9 takes the lead at just 0.4 seconds. Close behind in second place is Chrome at 0.44 seconds, followed by Opera in third with a time of almost 0.47 seconds. Firefox comes in last place at nearly 0.6 seconds.

Drill Down

The charts below contain the geometric mean for uncached and cached page load times, as well as the individual page load time averages.

Opera seems to have more trouble than the rest of the OS X browsers at uncached page loads of About and Ask. However, this behavior goes away when loading from cache.

Firefox for Windows also reveals longer load times for About and Ask, but when loading from cache. In a reversal of what we observe on OS X, Opera for Windows 7 displays an advantage over the other browsers when performing an uncached page load on About and Ask.

JavaScript Performance

Composite Scoring

The JavaScript composite is the geometric mean of the four JavaScript performance test results (RIABench, Peacekeeper, Kraken, and SunSpider), multiplied by one thousand (to create nice, whole number scores).

Predictably, Chrome takes the lead in JavaScript performance, followed closely by Safari in second place. Firefox grabs third place, with Opera taking last.

Once again, the Windows 7 scores all dwarf the OS X scores. Chrome remains the leader on Windows, followed by Firefox. About 200 points behind Firefox is Opera in third place, followed by last-place finisher IE9.

Drill Down

The charts below contain the individual JavaScript benchmarks, Peacekeeper, Kraken, and SunSpider, followed by RIABench JavaScript for OS X and Windows 7.

All of the JavaScript performance tests place Chrome in the lead, with the exception of Peacekeeper, where Safari wins by a hair. In OS X, Firefox has a poor showing in Run-length Encoding, while Opera has a disadvantage in the Focus test. IE9 exhibits considerably lower scores than the other browsers in the Focus test and MD5 Hashing

Google Octane

About a week ago Google introduced its new JavaScript performance benchmark, dubbed Octane. This new benchmark contains the eight tests that make up the older V8 JavaScript benchmark, along with five new tests. Unfortunately, IE9 cannot run Octane, and the IE10 RTM build cannot finish the test. Therefore, Octane will not be included in the JavaScript composite until it functions with the current version of Internet Explorer.

Chrome takes the lead in both operating systems, followed by Safari on OS X and Firefox on Windows 7. Firefox snatches third place on OS X, while Opera takes third on Windows and fourth on OS X.

While Chrome dominates the Windows 7 results, the OS X results are a lot more in line with the other JavaScript performance benchmarks.

DOM And CSS Performance

DOM

Mozilla's Dromaeo DOM tests began working with Chrome for Windows again just a few days before publication, so Acid3 is no longer needed as a substitute.

Safari takes the lead at 1140 runs per second. Chrome earns a respectable second-place finish with 840 runs per second, followed closely by Firefox with 746 runs per second. Opera finishes a distant last place with just 227 runs per second.

Chrome takes the lead in Windows 7, followed closely by Firefox. Opera finishes in third place, but with just half the runs per second as Firefox. IE9 places last at just 373 runs per second.

CSS

Composite Scoring

The CSS composite is the geometric mean of the CSS Stress Testing & Performance Profiling bookmarklet applied to both the CSS and CSS3 versions of the CSS3 Speed Test demo pages.

With no more Microsoft Maze Solver exposing its bugs, Firefox takes a strong lead on both operating systems. Chrome places second on both OS X and Windows, and is the only browser to do better in this test on OS X than Windows. Safari places third on OS X, while IE9 takes third on Windows. Opera places dead last on both operating systems, showing scores that are significantly slower than the third-place finishers.

Drill Down

The charts below contain the results of the CSS Stress Testing & Performance Profiling bookmarklet applied to the CSS and CSS3 versions of the CSS3 Speed Test.

Opera's scores are relatively terrible, whether in Windows or OS X, CSS or CSS3. We're seeking another set of CSS/CSS3 demo pages to see if this results is valid, since previous CSS performance tests show Opera to be pretty average.

HTML5 Performance

Composite Scoring

The HTML5 composite is the geometric mean of GUIMark 2 HTML5, Asteroids HTML5 Canvas 2D and JavaScript, and the HTML5 Canvas Performance Test.

The native browsers have a lock on HTML5 performance, with Safari grabbing an easy victory on OS X, and IE9 taking the lead on Windows 7. Chrome places second on OS X, while Firefox is the Windows 7 runner-up. Google and Mozilla trade places for third , while Opera finishes last on both OSes.

Drill Down

The charts below contain the geometric mean and average results of the individual GUIMark2 HTML5 tests, followed by Asteroids and the HTML5 Canvas Performance Test.

Hardware Acceleration Performance

Facebook JSGameBench v0.4.1

JSGameBench measures both native HTML5 hardware acceleration as well as WebGL.

Safari takes the lead in overall hardware acceleration with Firefox being the only other reasonable option on OS X. Chrome places a very distant third, followed by an equally meager score for fourth-place finisher Opera.

On Windows 7, Chrome takes the lead, doubling Safari's winning OS X score. Firefox is again the second-best choice in overall hardware acceleration, followed by Internet Explorer in third, and Opera again in last place.

HTML5 Hardware Acceleration

Composite Scoring

The HTML5 Hardware Acceleration composite is the geometric mean of the average WebVizBench and Psychedelic Browsing scores.

Safari is the big winner on Mountain Lion, followed by Chrome in second place. While Firefox technically places third, it and Opera are equally poor for HTML5 hardware acceleration on OS X.

On Windows 7, Firefox regains its lead over arch-rival Internet Explorer. Chrome manages a respectable third-place finish, followed far behind by Opera in last place.

Drill Down

The charts below are for Psychedelic Browsing and WebVizBench.

Psychedelic Browsing obliterates Opera on both OSes and handicaps Firefox for OS X versus WebVizBench, Chrome 21 comes out of nowhere to claim victory in WebVizBench on both operating systems. A slight lead by Firefox 15 over IE9 in WebVizBench is what allows Mozilla to regain the HTML5 hardware acceleration crown on Windows 7.

WebGL

Chrome and Firefox remain the only stable browsers with default WebGL implementations on either operating system.

Composite Scoring

The WebGL composite is the geometric mean of the average results from Mozilla's WebGL FishIE Tank and WebGL Solar System from Chrome Experiments.

Firefox beats Chrome on OS X Mountain Lion by just seven frames per second, 24 to 17. Firefox 15 takes the lead on Windows 7 with 48 FPS, followed by Chrome 21 with 31 FPS.

Drill Down

The charts below contain the average results for WebGL FishIE Tank and WebGL Solar System.

Both Google and Mozilla do quite well in the WebGL FishIE Tank benchmark, but Chrome has a clear disadvantage in the WebGL Solar System test.

Plug-In Performance: Flash, Java, Silverlight

Composite Scoring

The Flash, Java, and Silverlight composites are the geometric mean of the individual RIABench tests for each plug-in. The Java score includes the millisecond results of Primetest, Prime Factorization, JPEG Encoding, MD5 Hashing, Random Key Generator, Run-length Encoding, and Focus Test. The Flash and Silverlight scores also include the frames per second results of 3D Test, 2D Test, and Memory Management.

Flash

Safari, Opera, and Firefox are in a practical tie for first place on OS X. Chrome, with its special built-in version of Flash, performs slightly worse than the other contenders. The same results are seen on Windows 7, although the scores are nearly double the OS X scores.

Java

Java is a complete four-way tie on both operating systems, with Windows 7 more than doubling the OS X scores.

Silverlight

Silverlight performance is another four-way tie on Mountain Lion, however Firefox is shown to be a cut above the competition on Windows 7.

Drill Downs

The charts below contain the detailed view of each RIABench test for Flash, Java, and Silverlight.

Chrome is usually slightly behind in Flash performance due to its sand-boxed Flash player, the only real surprise here is Firefox for Windows having a small advantage in Silverlight performance.

Memory Efficiency

Composite Scoring

Overall memory efficiency is gauged by the difference between a browser's single-tab memory usage and final -39-tab memory management total. The browser with the lowest score is able to return the most physical memory back to the operating system without actually closing the application itself, but simply by decreasing workload (closing tabs).

Chrome takes the lead for memory efficiency on both operating systems, as Firefox takes second place on OS X and IE9 takes second under Windows 7. Third place on OS X goes to Safari, while Firefox takes third on Windows 7. Opera finishes last on both platforms.

Drill Down

The charts below are for the single-tab and 40-tab memory usage tests, followed by the -39-tab and -39-tab plus two-minute memory management tests.

The three cross-platform browsers all report approximately double the memory usage on OS X than on Windows 7. Firefox only gives back about one-third of its 40-tab memory usage total on OS X, a sharp increase from Windows 7.

Reliability, Responsiveness, And Security

Reliability

Our reliability test is conducted after loading 40 tabs. We open them all simultaneously and record how many pages require a reload due to broken formatting or missing elements. The best score a browser can achieve here is zero, and the worst is 40.

Once again, Opera shows itself to be the rock-solid option, with only one reload required on each OS. Safari takes second place on Mountain Lion with an average of eight reloads, followed by Firefox in third with ten and Chrome in fourth with a whopping 21 reloads on OS X. The second-place finisher for Windows 7 is IE9 with 12 failures, followed by Chrome and Firefox in a tie for third, each requiring 13 reloads.

Responsiveness

The responsiveness of each browser is gauged by its behavior during the 40-tab memory usage tests. While we're not timing how long each browser can load all 40 tabs, we are looking to see how quickly we can use the browser without scroll lag and other hang-ups while the tabs are still loading.

IE9 is once again the only browser to actually crash during the 40-tab load. Opera again is speediest to become responsive, followed by Firefox, then Chrome. Chrome is noticeably worse on OS X than Windows 7, while Safari is about equal to Firefox. We're calling Opera the winner on both platforms, followed by Firefox and Safari with strong finishes. Chrome is merely acceptable, while IE9 is clearly weak.

Security

BrowserScope Security contains 17 pass/fail security checks.

Chrome takes first place by passing 16 out of the 17 tests. Safari earns second place with 14 out of 17 tests passed. Internet Explorer passes 13 tests to place third, followed by Firefox in fourth place with 12 tests passed. Opera passes 10 of the 17 tests, earning the Norwegian Web browser another last-place finish.

Standards Conformance

Composite Scoring

The standards conformance composite is determined by dividing the results of each test by the maximum score of that test, then multiplying by 100 to get a percentage. The percentage results of the three tests are then averaged together to achieve a composite grade.

Chrome takes first place on both operating systems with a B-. It is followed by Safari in second place on OS X with Opera and Firefox caught up in a tie for last, both achieving an equal C. Opera manages an extra percentage point on Windows 7 to place second with Firefox close behind in third. Last place in Windows 7 goes to Microsoft's own IE9 with the only failing grade.

Drill Down

The charts below are for the three standards conformance tests: Ecmascript Language test262, HTML5Test.com, and The CSS3 Test.

IE9 is significantly behind the curve in all three disciplines, while Chrome's better-than-average HTML5 and CSS3 scores allow Google to dominate standards conformance.

Test Analysis

Finishes

Each category of testing has four columns: Winner, Strong, Average, and Weak. The Winner is obviously the browser that achieves the highest scores in that category. The Strong column is for browsers exhibiting superior performance, but not achieving a first-place victory. Average is for browsers that perform adequately or in-line with a majority of their competitors. A Weak finish is assigned to browsers that perform poorly, or substantially lower than their competitors.

Brackets

In order to reflect how each category of testing affects the average end-user Web browsing experience, we need to create brackets (or levels of importance) to place the different categories of testing into.

The Essential bracket contains those categories of testing that are indispensable to rendering the vast majority of Web pages online today. The Important bracket is for categories not quite essential to browsing the Web, yet still affect the user experience to a great degree. The Nonessential bracket contains the popular plug-ins Java and Silverlight. While these plug-in technologies are nowhere near as ubiquitous as Flash, certain applications like corporate intranet apps and Netflix simply will not work without them. Finally, the Unimportant bracket is for emerging technologies, such as HTML5 Hardware Acceleration and WebGL, which still don't really exist outside of testing/demo sites.

Points

Now that the brackets are all sorted out, we can apply a numerical point system to the finishes of each bracket.

As you can see, we decided to apply negative point values to the Weak finishes and start the Average performances at zero for the Unimportant bracket. The Winner has also been de-emphasized over Strong finishes, with just a small tie-breaking bonus going to Winner.

OS X 10.8 Analysis Table

Now, let's see how the Windows 7 Web browsers compare to each other.

Windows 7 Analysis Table

And the winners are...

OS X And Windows 7 Winners' Circle

OS X 10.8 Placing

Safari 6 places first on its native platform of OS X Mountain Lion, followed closely by Chrome 21 just two and a half points behind. Firefox 15 takes third place, trailing Chrome by just another two and a half points. Opera 12.02 loses big time on OS X, earning just a fraction of other OS X browser's point totals.

Congratulations, Apple!

Windows 7 Placing

Chrome manages to fend off Firefox once again, keeping its Window 7 Web Browser Grand Prix Championship. However, Firefox 15 is right on the heels of Chrome 21, and upcoming version 17 might change Google's luck if preliminary benchmarks of the new IonMonkey JIT compiler carry through to the final release.

For the first time in the history of the Web Browser Grand Prix, we have a tie in final scoring. Fortunately, it's just a tie for third, or in this case, last place. Opera is feeling the pain of losing Safari for Windows in a real way, with the low-end now totally vacant, Opera is comparatively worse versus the strong scores of Chrome and Firefox. Holding onto reliability and responsiveness is what keeps the Norwegian Web browser from succumbing to even IE9. Meanwhile, strong page load times and HTML5 performance scores are the only thing keeping Internet Explorer from the being the biggest loser on its own platform.

Congratulations, Google!

Follow Adam on Twitter.