safari
Auto Added by WPeMatico
Auto Added by WPeMatico
Year after year, phishing remains one of the most popular and effective ways for attackers to steal your passwords. As users, we’re mostly trained to spot the telltale signs of a phishing site, but most of us rely on carefully examining the web address in the browser’s address bar to make sure the site is legitimate.
But even the browser’s anti-phishing features — often the last line of defense for a would-be phishing victim — aren’t perfect.
Security researcher Rafay Baloch found several vulnerabilities in some of the most widely used mobile browsers — including Apple’s Safari, Opera and Yandex — which if exploited would allow an attacker to trick the browser into displaying a different web address than the actual website that the user is on. These address bar spoofing bugs make it far easier for attackers to make their phishing pages look like legitimate websites, creating the perfect conditions for someone trying to steal passwords.
The bugs worked by exploiting a weakness in the time it takes for a vulnerable browser to load a web page. Once a victim is tricked into opening a link from a phishing email or text message, the malicious web page uses code hidden on the page to effectively replace the malicious web address in the browser’s address bar to any other web address that the attacker chooses.
In at least one case, the vulnerable browser retained the green padlock icon, indicating that the malicious web page with a spoofed web address was legitimate — when it wasn’t.
An address bar spoofing bug in Opera Touch for iOS (left) and Bolt Browser (right). These spoofing bugs can make phishing emails look far more convincing. (Image: Rapid7/supplied)
Rapid7’s research director Tod Beardsley, who helped Baloch with disclosing the vulnerabilities to each browser maker, said address bar spoofing attacks put mobile users at particular risk.
“On mobile, space is at an absolute premium, so every fraction of an inch counts. As a result, there’s not a lot of space available for security signals and sigils,” Beardsley told TechCrunch. “While on a desktop browser, you can either look at the link you’re on, mouse over a link to see where you’re going or even click on the lock to get certificate details. These extra sources don’t really exist on mobile, so the location bar not only tells the user what site they’re on, it’s expected to tell the user this unambiguously and with certainty. If you’re on palpay.com instead of the expected paypal.com, you could notice this and know you’re on a fake site before you type in your password.”
“Spoofing attacks like this make the location bar ambiguous, and thus, allow an attacker to generate some credence and trustworthiness to their fake site,” he said.
Baloch and Beardsley said the browser makers responded with mixed results.
So far, only Apple and Yandex pushed out fixes in September and October. Opera spokesperson Julia Szyndzielorz said the fixes for its Opera Touch and Opera Mini browsers are “in gradual rollout.”
But the makers of UC Browser, Bolt Browser and RITS Browser — which collectively have more than 600 million device installs — did not respond to the researchers and left the vulnerabilities unpatched.
TechCrunch reached out to each browser maker but none provided a statement by the time of publication.
Powered by WPeMatico
Far from Apple’s troubles in emerging markets and China, the company is attracting the ire of what should really be a core supporter demographic naturally aligned with the pro-privacy stance CEO Tim Cook has made into his public soapbox in recent years — but which is instead crying foul over perceived hypocrisy.
The problem for this subset of otherwise loyal European iPhone users is that Apple isn’t offering enough privacy.
These users want more choice over key elements such as the search engine that can be set as the default in Safari on iOS (Apple currently offers four choices: Google, Yahoo, Bing and DuckDuckGo, all U.S. search engines; and with ad tech giant Google set as the default).
It is also being called out over other default settings that undermine its claims to follow a privacy by design philosophy. Such as the iOS location services setting which, once enabled, non-transparently flip an associated sub-menu of settings — including location-based Apple ads. Yet bundled consent is never the same as informed consent…
6/ and @Apple also defaults to ON, approx 13 location settings the moment a user enables location settings
that includes using YOUR location to support APPLE’s advertising business interests & $$$. By ‘enabling location based services’ you give your consent to this
@tim_cook pic.twitter.com/scYSg94QgY
— Privacy Matters (@PrivacyMatters) October 19, 2018
As the saying goes you can’t please all of the people all of the time. But the new normal of a saturated smartphone market is imposing new pressures that will require a reconfiguration of approach.
Certainly the challenges of revenue growth and user retention are only going to step up from here on in. So keeping an otherwise loyal base of users happy and — crucially — feeling listened to and well served is going to be more and more important for the tech giant as the back and forth business of services becomes, well, essential to its fortunes going forward.
(At least barring some miracle new piece of Apple hardware — yet to be unboxed but which somehow rekindles smartphone-level demand afresh. That’s highly unlikely in any medium term timeframe given how versatile and capable the smartphone remains; ergo Apple’s greatest success is now Apple’s biggest challenge.)
With smartphone hardware replacement cycles slowing, the pressure on Cook to accelerate services revenue naturally steps up — which could in turn increase pressure on the core principles Cupertino likes to flash around.
Yet without principles there can be no brand premium for Apple to command. So that way ruin absolutely lies.
It’s true that controlling the iOS experience by applying certain limits to deliver mainstream consumer friendly hardware served Apple well for years. But it’s also true iOS has grown in complexity over time having dropped some of its control freakery.
Elements that were previously locked down have been opened up — like the keyboard, for instance, allowing for third party keyboard apps to be installed by users that wish to rethink how they type.
This shift means the imposed limit on which search engines users can choose to set as an iOS default looks increasingly hard for Apple to justify from a user experience point of view.
Though of course from a business PoV Apple benefits by being able to charge Google a large sum of money to remain in the plum search default spot. (Reportedly a very large sum, though claims that the 2018 figure was $9BN have not been confirmed. Unsurprisingly neither party wants to talk about the terms of the transaction.)
The problem for Apple is that indirectly benefiting from Google eroding the user privacy it claims to champion — by letting the ad tech giant pay it to suck up iOS users’ search queries by default — is hardly consistent messaging.
Not when privacy is increasingly central to the premium the Apple brand commands.
Cook has also made a point of strongly and publicly attacking the ‘data industrial complex‘. Yet without mentioning the inconvenient side-note that Apple also engages in trading user data for profit in some instances, albeit indirectly.
In 2017 Apple switched from using Bing to Google for Siri web search results. So even as it has stepped up its rhetoric around user privacy it has deepened its business relationship with one of the Western Internet’s primary data suckers.
All of which makes for a very easy charge of hypocrisy.
Of course Apple offers iOS users a non-tracking search engine choice, DuckDuckGo, as an alternative choice — and has done so since 2014’s iOS 8.
Its support for a growing but still very niche product in what are mainstream consumer devices is an example of Apple being true to its word and actively championing privacy.
The presence of the DDG startup alongside three data-mining tech giants has allowed those ‘in the know’ iOS users to flip the bird at Google for years, meaning Apple has kept privacy conscious consumers buying its products (if not fully on side with all its business choices).
But that sort of compromise position looks increasingly difficult for Apple to defend.
Not if it wants privacy to be the clear blue water that differentiates its brand in an era of increasingly cut-throat and cut-price Android -powered smartphone competition that’s serving up much the same features at a lower up-front price thanks to all the embedded data-suckers.
There is also the not-so-small matter of the inflating $1,000+ price-tags on Apple’s top-of-the-range iPhones. $1,000+ for a smartphone that isn’t selling your data by default might still sound very pricy but at least you’d be getting something more than just shiny glass for all those extra dollars. But the iPhone isn’t actually that phone. Not by default.
Apple may be taking a view that the most privacy sensitive iPhone users are effectively a captive market with little option but to buy iOS hardware, given the Google-flavored Android competition. Which is true but also wouldn’t bode well for the chances of Apple upselling more services to these people to drive replacement revenue in a saturated smartphone market.
Offending those consumers who otherwise could be your very best, most committed and bought in users seems short-sighted and short-termist to say the least.
Although removing Google as the default search provider in markets where it dominates would obviously go massively against the mainstream grain that Apple’s business exists to serve.
This logic says Google is in the default position because, for most Internet users, Google search remains their default.
Indeed, Cook rolled out this exact line late last year when asked to defend the arrangement in an interview with Axios on HBO — saying: “I think their search engine is the best.”
He also flagged various pro-privacy features Apple has baked into its software in recent years, such as private browsing mode and smart tracker prevention, which he said work against the data suckers.
Albeit, that’s a bit like saying you’ve scattered a few garlic cloves around the house after inviting the thirsty vampire inside. And Cook readily admitted the arrangement isn’t “perfect”.
Clearly it’s a trade off. But Apple benefitting financially is what makes this particular trade-off whiff.
It implies Apple does indeed have an eye on quarterly balance sheets, and the increasingly important services line item specifically, in continuing this imperfect but lucrative arrangement — rather than taking a longer term view as the company purports to, per Cook’s letter to shareholders this week; in which he wrote: “We manage Apple for the long term, and Apple has always used periods of adversity to re-examine our approach, to take advantage of our culture of flexibility, adaptability and creativity, and to emerge better as a result.”
If Google’s search product is the best and Apple wants to take the moral high ground over privacy by decrying the surveillance industrial complex it could maintain the default arrangement in service to its mainstream base but donate Google’s billions to consumer and digital rights groups that fight to uphold and strengthen the privacy laws that people-profiling ad tech giants are butting hard against.
Apple’s shareholders might not like that medicine, though.
More palatable for investors would be for Apple to offer a broader choice of alternative search engines, thereby widening the playing field and opening up to more pro-privacy Google alternatives.
It could also design this choice in a way that flags up the trade-off to its millions of users. Such as, during device set-up, proactively asking users whether they want to keep their Internet searches private by default or use Google?
When put like that rather more people than you imagine might choose not to opt for Google to be their search default.
Non-tracking search engine DDG has been growing steadily for years, for example, hitting 30M daily searches last fall — with year-on-year growth of ~50%.
Given the terms of the Apple-Google arrangement sit under an NDA (as indeed all these arrangements do; DDG told us it couldn’t share any details about its own arrangement with Apple, for e.g.) it’s not clear whether one of Google’s conditions requires there be a limit on how many other search engines iOS users can pick from.
But it’s at least a possibility that Google is paying Apple to limit how many rivals sit in the list of competitors iOS users can pick out an alternative default. (It has, after all, recently been spanked in Europe for anti-competitive contractual limits imposed on Android OEMs to limit their ability to use alternatives to Google products, including search. So you could say Google has history where search is concerned.)
Equally, should Google actually relaunch a search product in China — as it’s controversially been toying with doing — it’s likely the company would push Apple to give it the default slot there too.
Though Apple would have more reason to push back, given Google would likely remain a minnow in that market. (Apple currently defaults to local search giant Baidu for iOS users in China.)
So even the current picture around search on iOS is a little more fuzzy than Cook likes to make out.
China is an interesting case, because if you look at Apple’s growth challenges in that market you could come to a very different conclusion vis-a-vis the power of privacy as a brand premium.
In China it’s convenience, via the do-it-all ‘Swiss army knife’ WeChat platform, that’s apparently the driving consumer force — and now also a headwind for Apple’s business there.
At the same time, the idea of users in the market having any kind of privacy online — when Internet surveillance has been imposed and ‘normalized’ by the state — is essentially impossible to imagine.
Yet Apple continues doing business in China, netting it further charges of hypocrisy.
Its revised guidance this week merely spotlights how important China and emerging markets are to its business fortunes. A principled pull-out hardly looks to be on the cards.
All of which underscores growing emerging market pressures on Apple that might push harder against its stated principles. What price privacy indeed?
It’s clear that carving out growth in a saturated smartphone market is going to be an increasingly tricky business for all players, with the risk of fresh trade-offs and pitfalls looming especially for Apple.
Negotiating this terrain certainly demands a fresh approach, as Cook implies is on his mind, per the shareholder letter.
Arguably the new normal may also call for an increasingly localized approach as a way to differentiate in a saturated and samey smartphone market.
The old Apple ‘one-sized fits all’ philosophy is already very outdated for some users and risks being caught flat-footed on a growing number of fronts — be that if your measure is software ‘innovation’ or a principled position on privacy.
An arbitrary limit on the choice of search engine your users can pick seems a telling example. Why not offer iOS users a free choice?
Or are Google’s billions really standing in the way of that?
It’s certainly an odd situation that iPhone owners in France, say, can pick from a wide range of keyboard apps — from mainstream names to superficial bling-focused glitter and/or neon LED keyboard skins or indeed emoji and GIF-obsessed keyboards — but if they want to use locally developed pro-privacy search engine Qwant on their phone’s native browser they have to tediously surf to the company’s webpage every time they want to look something up.
Google search might be the best for a median average ‘global’ (excluding China) iOS user but in an age of increasingly self-focused and self-centred technology, with ever more demanding consumers, there’s really no argument against letting people who want to choose for themselves.
In Europe there’s also the updated data protection framework, GDPR, to consider. Which may yet rework some mainstream ad tech business models.
On this front Qwant questions how even non-tracking rival DDG can protect users’ searches from government surveillance given its use of AWS cloud hosting and the U.S. Cloud Act. (Though, responding to a discussion thread about the issue on Github two years ago, DDG’s founder noted it has servers around the world, writing: “If you are in Europe you will be connected to our European servers.” He also reiterated that DDG does not collect any personal data from users — thereby limiting what could be extracted from AWS via the Act.)
Asked what reception it’s had when asking about getting its search engine on the Safari iOS list, Qwant told us the line that’s been (indirectly) fed back to it is “we are too European according to Apple”. (Apple declined to comment on the search choices it offers iOS users.)
“I have to work a lot to be more American,” Qwant co-founder and CEO Eric Leandri told us, summing up the smoke signals coming out of Cupertino.
“I understand that Apple wants to give the same kind of experience to their customers… but I would say that if I was Apple now, based on the politics that I want to follow — about protecting the privacy of customers — I think it would be great to start thinking about Europe as a market where people have a different point of view on their data,” he continued.
“Apple has done a lot of work to, for example, not let applications give data to each by a very strict [anti-tracking policy]; Apple has done a lot of work to guarantee that cookies and tracking is super difficult on iOS; and now the last problem of Apple is Google search.”
“So I hope that Apple will look at our proposal in a different way — not just one-fits-all. Because we don’t think that one-fits-all today,” he added.
Qwant too, then, is hoping for a better Apple to emerge as a result of a little market adversity.
Powered by WPeMatico
Most of the data around web browser market share puts Google Chrome or Safari at the top – with their percentage of the market varying by platform and region. But new research from analytics provider Mixpanel finds that many sources are overlooking a major contributor of mobile web browser events here in the U.S.: Facebook.
According the firm’s new study involving millions of users and billions of events across its platform, Facebook has grown to become a significant browser on U.S. mobile devices. In some states, it’s even accounting for a sizable number of mobile browser events – like Washington (13.74%), Rhode Island (13.14%), and Montana (12.64%), for example.
While Facebook’s use as a mobile browser was still far outweighed by Safari in most cases, due to the dominance of Apple’s iOS in the U.S., the social networking app has achieved mobile browser market share of around 10 percent in many states, Mixpanel found.
This includes: Texas (10.12%), Hawaii (10.94%), New Hampshire (10.52%), Indiana (11.93%), Missouri (11.49%), Pennsylvania (10.92%), South Carolina (10.16%), North Carolina (11.8%), Oregon (9.73%), North Dakota (9.9%), West Virginia (9.95%), Minnesota (11.81%), and Delaware (9.94%), in addition to Washington, Rhode Island, and Montana, as noted above.
This is notable because it means many people in those states are using Facebook as their main point of consuming online content – whether it’s news or entertainment, or anything else.
It’s also indicative of the threat that Google has been facing for some time as users shift their web searches to mobile devices. With more people using Facebook as their portal to the web, Google has had to rely more heavily on partnership deals – like its integration in Apple’s Safari browser where it pays to be the default search engine, creating much heftier traffic acquisition costs.
Facebook’s growth as a mobile browser is also of concern because it means it has an outsized influence on shaping the flow of news and information, without having a news media background or experience – or even, any longer, an editorial staff who curates the way news reaches Facebook users.
Instead, it has for years over-relied on its algorithms to customize the News Feed, which allowed fake news, hoaxes, and clickbait to spread. This is something the company has only recently come to terms with, and is trying to correct through punitive measures like downranking fake news, as well as by implementing fact-checking programs.
Those course corrections are long overdue, and are increasingly critical to get right, as this new data shows.
Thankfully, Facebook’s portion of the mobile browser market share is still small compared with Safari, which has the majority market share in almost all the U.S. states, where it claims anywhere from the mid-50’s to mid-60’s in terms of mobile browser market share percentages.
On average across all U.S. states, Safari claims 58.06 percent of mobile browser market share, Chrome has 32.48 percent, and Facebook has 8.82 percent. All other browsers account for the remaining 0.64 percent, Mixpanel reports.
Related to Safari’s dominance, the study also found iOS topped Android usage in the U.S. with 65.5 percent of American using iOS versus 34.46 percent on Android.
In some states, iOS’ usage was very high – around three-quarters or more of the population are using Apple’s OS – including: Alaska (77.88% iOS vs 22.12% Android), Connecticut (76.94% vs 23.06%), and Rhode Island (75.50% vs 24.5%). New York (72.57% vs 27.43%) and California (66.72% vs 33.28%) were high as well, on that front.
And every single state had over 50 percent of their users on iOS.
The highest penetration by Android was in Nevada (58.33% iOS vs 40.44% Android), West Virginia (56.95% iOS vs 43.05% Android) and Wyoming (55.5% iOS vs 44.5% Android). But only in one case did this also equated to higher Chrome usage: in Wyoming, 65.94% of the mobile browser market share was Chrome, versus 30.07% Safari.
Powered by WPeMatico
Apple and Google could be the biggest frenemies in tech. While they both compete like there’s no tomorrow, they also partner on some very specific deals. For instance, Google is paying a ton of money to remain the default search engine on iOS.
As CNBC first reported, according to a Bernstein analyst, Google could pay as much as $3 billion a year just to remain the default option in… Read More
Powered by WPeMatico
Browser extensions change the way we work. They alter facets of your job by changing the experience of the apps on which you rely so they conform to your workflow — versus having to open 17 separate browser tabs just to complete a simple task. Historically, browser extensions were a little wild as far as how they were built. Read More
Powered by WPeMatico