Score one for a more secure internet

With computational power at its current state, encryption should be more commonplace.

Original URL: http://www.theregister.co.uk/2011/11/25/google_secure_search/

Scareware slingers stumped by Google secure search

Scam sites can't game search results

By John Leyden

Posted in Malware, 25th November 2011 15:16 GMT

Google made secure search the default option [1] for logged in users last month – primarily for privacy protection reasons [2]. But the move has had the beneficial side-effect of making life for difficult for fraudsters seeking to manipulate search engine rankings in order to promote scam sites, according to security researchers.

Users signed into Google were offered the ability to send search queries over secure (https) connections last month. This meant that search queries sent while using insecure networks, such as Wi-Fi hotspots, are no longer visible (and easily captured) by other users on the same network.

However Google also made a second (under-reported) change last month by omitting the search terms used to reach websites from the HTTP referrer header, where secure search is used. The approach means it has become harder for legitimate websites to see the search terms surfers fed through Google before reaching their website, making it harder for site to optimise or tune their content without using Google's analytics service.

But the change in the referrer header makes life proportionately much more difficult for black hat SEO operators, who commonly use link farms and other tactics in an attempt to manipulate search results so that links to scareware portals appear prominently in the search results for newsworthy searches. Surfers who stray onto these sites will be warned of non-existent security problems in a bid to coax them into paying for fake anti-virus software of little or no utility.

Black hats thwarted

Fraudsters normally set up multiple routes through to scam sites. The changes introduced by Google when it launched secure search will leave them clueless about which approaches are bringing in prospective marks and which have failed. David Sancho, a senior threat researcher at Trend Micro, explains that it is very useful for black hat SEO-promoted sites to know which search term they have successfully hijacked, information that Google's changes denies them.

"When these sites receive visits from search engine visitors, they will have no idea what search sent them there," Sancho writes [3]. "They won’t have a clear idea which search terms work and which don’t, so they are essentially in the dark. This can have a lot of impact on the effectiveness of their poisoning activities. This is, of course, good for Google as their search lists are cleaner but it’s also good for all users because they’ll be less likely to click on bad links from Google."

Regular no-padlock HTTP searches remain unaltered. Search terms are only concealed where secure search is applied, which means surfers are already logged in to Google’s services.

"Given how many people already use Google Mail and Google+, this may not be such a big obstacle – but it still poses one," Sancho explains. "If people keep using regular no-padlock HTTP searches, they will keep disclosing their search terms and keeping things unchanged."

"The more people use HTTPS, the less information we’re giving the bad guys ... one more reason to use secure connections to do your web searching," he concludes.

Google introduced encrypted search last year but changes that came in last month that make it a default option for logged-in users will inevitably mean that it becomes more widely used, rather than the preserve of security-aware users who are unlikely to fall victim to scareware scams in the first place. ®

Links
http://googleblog.blogspot.com/2011/10/making-search-more-secure.html
http://www.theregister.co.uk/2011/10/19/google_default_ssl/
http://blog.trendmicro.com/google-secures-searches-shuts-out-bhseo-scammers

Remember, there are engineers behind these products

Why Steve Jobs, Bill Gates, Sergey Brin, and Larry Page are overrated

http://www.forbes.com/sites/panosmourdoukoutas/2011/11/25/why-steve-jobs-bill-gates-sergey-brin-and-larry-page-are-overrated/

In the years of bitter struggle between capitalism and socialism, young generations around the world were obsessed with Karl Marx and his socialist ideas. Posters of celebrated revolutionaries like Che Guevara, Fidel Castro, and Mao Zedong decorated university walls, while red banners and anti-capitalist, antibusiness slogans colored and enlivened popular demonstrations.

Today, with the triumph of capitalism over socialism, with unionism on the retreat, and with another Renaissance of individual freedoms and liberties, younger generations are no longer obsessed with socialist ideas and antibusiness slogans. Their heroes and idols are no longer celebrated revolutionaries. They are entrepreneurs like Steve Jobs, Bill Gates, Mark Zuckerberg, Sergey Brin, Larry Page, who have been the revolutionaries in their own industries, delivering the world new products and businesses and creating enormous wealth for themselves, their associates, stockholders, and society at large.

In some sense, today’s admiration for entrepreneurs parallels Mark Twain’s and Charles Dudley Warner’s Gilded Age with its own celebrated entrepreneurs, like Andrew Carnegie and John D. Rockefeller, at least before public opinion turned against them. Yet unlike the Gilded Age, today’s admiration of individual entrepreneurs may be exaggerated. Behind the success of Apple (NYSE:AAPL), Microsoft (NASDAQ:MSFT), Facebook, and Google, and hundreds and thousands of successful high-tech companies aren’t just the visible and the famous individual entrepreneurs who started them, but the hundreds of thousands of unknown individual entrepreneurs who collectively share the risks and rewards from the discovery and exploitation of new products and business. The many versions of Windows, for instance, wasn’t developed and marked by Bill Gates alone. For all practical reasons, he could not have either the time or the technical experience and and the expertise to write the millions of lines of software code behind the flushing screens and the eye-catching images; neither would have the marketing skills and time to persuade computer vendors and manufacturers to install a copy of the software in almost every PC that came off the manufacturing line. The same is true for Google ‘s (NASDAQ:GOOG) search engine, and Apple’s MacBook, iPhone, and iPad.

Microsoft’s, Google’s, and Aplle’s products were develop and marketed by hundreds of engineers and marketers both inside and outside their corporate boundaries paid on the basis of performance, mostly in stock options, rather than on a flat wage basis. In this sense, each and every member of these corporations and their partners and alliances is part of a collective entrepreneurship rather than part of a hierarchical organization that divides its members into stockholders, managers, and workers, into insiders and outsiders. Each member plays a role in the activities of these entrepreneurial networks and shares the risks and the rewards from the discovery and exploitation of new products.

The bottom line: Steve Jobs, Bill Gates, Sergey Brin, Larry Page have drawn a great deal of admiration these days for their pioneering successes that changed the world we live in. While well deserved, this admiration may be overrated, as the accomplishments of these celebrated entrepreneurs is a collective rather than an individual act.

So now I'm going to see ads before I even hit the internet?

I hope this is as far as the ads go in Chrome.

Google's new ad space: Chrome

http://news.cnet.com/8301-30685_3-57331212-264/googles-new-ad-space-chrome/

by Stephen Shankland  November 25, 2011 7:31 AM PST

Google has begun adding its own ads to the top of Chrome's new-tab page.

(Credit: screenshot by Stephen Shankland/CNET)

Google just found another digital billboard for online ads: its Chrome Web browser.

I just started noticing the ads on one of my computers yesterday, and I'm not the only one to see them. Right now, the ads tout Google's Chrome OS-powered Chromebooks, which not coincidentally happen to be on sale for the holidays.

The ads don't interrupt ordinary Web browsing by pushing aside Web page content and don't compete with regular Web page ads. Rather, they appear in a yellow-tinted box at the top of the new-tab page in Chrome.

That page is typically a mere way station for users on their way to other destinations, but it's getting more important as a hub for Chrome Web Store apps and as the home screen for Chrome OS.

The ad reminded me most of the occasional promotions Google puts on its otherwise spartan Google.com home. They're not obnoxious flashing distractions, but they stand out against amid the uncluttered field.

You can't blame Google for wanting to take advantage of a chance to make money. But as the Spiderman saying goes, with great power comes great responsibility.

When Google launched Chrome in September 2008, it made it clear that the browser was a secondary mechanism for making money. The company wanted people to see Web pages faster and to enable programmers to build more advanced Web applications--like Google Docs, for example.

And as we've seen since then, Google likes using Chrome as a vehicle to bring new Web-app features to market--a new experimental interface to let Chrome extensions use a speech-to-text conversion, for example--and to encourage would-be Google standards such as SPDY networking, WebM video, and WebP images.

I'm going to go out on a limb here and predict that Chrome's new-tab page ads will likely remain like Google's home-page ads. They're chiefly used to promote Google services, and occasionally to offer important information such as links to natural-disaster response pages. But Google doesn't sell the ad space the way Yahoo does with its main page.

There's nothing stopping Google from plastering its entire browser with ads. But the moment it did so, it would start annoying users who already have plenty of other strong choices in the browser market right now. And in the long run, I believe Google will make a lot more money using browsers to advance Web services and to drive people to Google search ads than it will selling banners in its browser.

Is technology isolating people?

I think we really are forgetting how to interact with others.

Teens Want Phones, Not Cars
http://www.forbes.com/sites/mobiledia/2011/11/24/teens-want-phones-not-cars/

Teenagers prefer smartphones to cars, according to research firm Gartner, highlighting the impact of technology on kids and the auto industry’s future challenges.

The study found 46 percent of young adults aged 18 to 24 prefer access to the Internet over access to their own car, and that teens drive less overall today than they did in past generations. Comparatively, only 15 percent of baby boomers said they would choose a mobile device over an automobile.

The advent of social networking sites like Facebook and Twitter is likely responsible, as they create an interactive, fun world that’s accessible anytime, from almost anywhere. For teenagers who want to stay connected to their friends, social networks provides an ideal platform for communication.

Public transportation and hitching rides from parents also give teenagers more time to stay connected to their social world via their smartphones, making driving seem an unnecessary hassle that interrupts their social life.

Thilo Koslowski, lead automotive analyst for Gartner, said, “Mobile devices, gadgets and the Internet are becoming must-have lifestyle products that convey status,” and devices “offer a degree of freedom and social reach that previously only the automobile offered.”

To keep up with the trend, the auto industry has gradually begun integrating smartphone-type features like built-in GPS devices, Bluetooth, and iPod docks into their newest car models. In the future, auto makers may increase such features in hopes of making cars more of a “must have” for teens.

“We are not looking at this to ask how we can get teens to buy a car versus an iPhone,” says K. Venkatesh Prasad, senior technical leader of open innovation at Ford. “Instead, the car has to become more than just a car. It has to become an experience.”

Parents, meanwhile, may sleep a little easier knowing their kids are at home and not out engaging in dangerous behaviors like texting while driving. The trend may also be easier on the family finances, as parents won’t be pressured to buy an expensive automobile for their teens.

However, concerns have been raised about whether social networking can ever truly replace face-to-face social interaction. Teens need a balance of online interaction and real time hanging out with friends. The balance can be difficult to attain, since the lure of social networks can be all-consuming.

The auto industry hopes the open road still holds a classic allure, but how teens navigate that road may change in the near future. Automatic Foursquare check-ins and voice recognition systems are already being tested in cars, marking a new trajectory for teens and the auto industry alike.

This post originally appeared at Mobiledia.

Update Your Parents' Browser Day aka Black Friday

It's a better way to spend the day than shopping.

A worthy cause: Update Your Parents' Browser Day

http://news.cnet.com/8301-30685_3-57331117-264/a-worthy-cause-update-your-parents-browser-day/

by Stephen Shankland  November 25, 2011 12:59 AM PST

Google's Matt Cutts urged people to upgrade their parents' browser if they're still using an old one.

(Credit: screenshot by Stephen Shankland/CNET)

Perhaps you have a hard time getting behind National Parfait Dayor Dress Spotty Day.

Here's a worthy cause for today, though: Update Your Parents' Browser Day.

The Atlantic's Alexis Madrigal came up with it as a constructive pasttime for the day after Thanksgiving, when many folks are visiting their folks at home.

If you can't persuade your parents to drop Internet Explorer 6 because YouTube will stop working, "wait until they slip into a tryptophan-induced coma and then sneak into the den," Madrigal suggests.

I'd throw protection against security vulnerabilities into the upgrade argument, too--there's a time and a place for scare tactics, and browser upgrades is one of them. And I'd also advise sticking around to make sure your parents are comfortable with any user-interface changes.

My own personal motivation is a lot more carrot than stick, though. Using old browsers sucks up Web developers' time as they struggle with compatibility issues, and it keeps them from adding useful features that can make Web sites more polished and responsive. And if you want to observe family traditions by playing the guilt card on your parents, you can say that people who use new browsers are indirectly hurt by those who use old browsers.

The event has drawn support from Microsoft and Google's influential search exec, Matt Cutts. They're preaching to the choir, though--my guess is that anybody who reads Windows and IE blogs or follows a prominent Googler on Twitter already has a newer browser. If you're a member of that choir, go bring the modern-browser gospel to your parents.

Wisely, Madrigal also recommends not switching browser brands on your parents. Of course, that means all those Windows XP users with IE will only get as far as clunky old IE8, since Microsoft chose to make Windows Vista or Windows 7 as a requirement for the speedier and more modern IE9. But even IE8 is a big step up from IE6.

Though it's now a decade old, IE6 still accounts for 7.86 percent of global browser usage, according to Net Applications' data. Even Microsoft is trying to get people to upgrade off IE6now.

Unfortunately, filial piety holds that it's always a good idea to take care of your parents.

One of the big reasons IE6 remains popular is that it's used in corporations that are reluctant to switch for reasons such as internal Web site compatibility or IT staff constraints.

Cajoling your parents may be hard, but getting corporate computer support staffs to budge is a lot harder. Nevertheless, I have a suggested addition to Madrigal's idea.

When any of you still saddled with IE6 gets back to work on Monday, observe Beg Your CIO to Upgrade the Company's Browser Day.

Happy Thanksgiving!

Check out Google's Thanksgiving turkey.

http://mashable.com/2011/11/24/turkey-doodle-easter-eggs/

Foxconn - The Wal-Mart of China?

After the recent suicides and environmental concerns Foxconn has let a journalist in to see the facility. Part four is published tomorrow. It's an interesting piece and makes you think about where your favorite device came from. Imagine a single facility filled with 400,000 workers. Worldwide Foxconn employs 920,000+ people (Wal-Mart employs 2,100,000+ in comparison). Whether the company is good or bad is up to debate but it's certainly done well as an assembler for Apple.

http://techcrunch.com/tag/future-of-foxconn/

Last of the Open Graph commentary

I agree with the hope that filters can help.  I just don't know if it will be enough.

Why Facebook is (mostly) right about sharing

By Mathew Ingram Nov. 21, 2011, 9:33am PT 

http://gigaom.com/2011/11/21/why-facebook-is-mostly-right-about-sharing/

Facebook’s implementation of what it calls “frictionless sharing” continues to cause controversy: critics complain that the new feature — which automatically shares songs from Spotify or news stories from social-reading apps — is ruining the site, cluttering up their stream and is generally just creepy. As newly-minted venture capitalist MG Siegler has noted, this kind of backlash is par for the course whenever Facebook makes sharing-related changes, so it’s likely this particular storm will also blow over. But what the fuss does highlight is how Facebook still needs better filters to help users cope with the onslaught of social-sharing information.

Molly Wood at CNET seems to have started the latest furore, saying the new changes at Facebook are “ruining sharing,” because they clutter up a user’s feed and try to badger them into signing up for apps like Spotify or the Washington Post app. Wood calls Spotify song sharing “the new Farmville,” and that isn’t meant as a compliment — and she also notes, as many other critics have, that Facebook is driving this behavior because it wants to collect more information about its users and make that available to advertisers. But one of her main complaints seems to be that instead of reducing the friction around sharing, Facebook is actually increasing it:

In search of “frictionless” sharing, Facebook is putting up a barrier to entry on items your friends want you to see–that is, they’re creating friction. Even if it’s just a onetime inconvenience, any barrier to sharing breaks sharing. The barriers will keep popping up as more content publishers create social apps that have to be authorized before you can view their content.

Noisy? Yes, but also a serendipity engine

I can see Wood’s point. My Facebook page has also gotten noisier, and the incessant links toWashington Post articles — which Liz Gannes at All Things Digital has also complained about — and Spotify music-sharing links can be irritating. But at the same time, those links can also be an interesting way to discover content, and a fairly powerful illustration of the “long tail,” as the Financial Times noted in a post about the kinds of stories that newspapers like the Post are finding get a lot of traffic through their apps. In other words, that sharing can produce a kind of serendipity that is very valuable.

Uber-blogger Robert Scoble writes about how Facebook’s sharing is getting closer to the “freaky” line, where it starts to bother people by being intrusive, but I think MG Siegler is right when he says that Facebook has always been pushing this envelope — right from the beginning of its existence, when it encouraged university students to post their photos and relationship status. When the news feed was first introduced, there was a hue and cry about how intrusive it was, and yet it has become the foundation of everything Facebook is, and millions of users are addicted to it.

Does that mean Facebook founder Mark Zuckerberg is altering our vision of privacy for his own nefarious purposes? I don’t think so. I think he and others like former Facebook president and Spotify investor Sean Parker have simply been more aware than others of the way that privacy is evolving. It used to be a binary thing — you shared certain things with family, friends and neighbors but kept most of that from the outside world. Now, you can choose to share certain things, like the songs you are listening to or the news articles you are reading, and not share others. Is sharing a song an invasion of privacy? It’s hard to see how. Privacy is now a spectrum, not an on-off switch.

We need better filters, not more privacy

Sociologist and Microsoft researcher Danah Boyd has written a lot about how younger users respond to privacy issues around Facebook, and it’s a lot more nuanced than just saying “kids share everything now.” In some cases, younger users are even more concerned with privacy than older users, and they come up with some interesting ways of dealing with that (like deleting their Facebook accounts every evening, and then reinstating them in the morning, since Facebook doesn’t actually delete anything in case you change your mind). But for many things — particularly social experiences like music — they are happy to share, and so frictionless sharing probably makes perfect sense.

For me, what Facebook’s rollout of frictionless sharing highlights more than anything is that we need better filters to cope with the rising tide of information on social networks, and that includes Twitter and Google+. Google’s introduction of “circles” and Facebook’s addition of “smart lists” are a step in the right direction, but they are still too cumbersome, and require a lot of ongoing management (which many people likely just won’t do). Idealab founder Bill Gross introduced a “partial follow” model with his new social network Chime.in, where you can follow only certain topics that a person posts about, but that also requires a lot of up-front management.

So I have no problem with Facebook’s approach to sharing, and I think it is probably the future (as I mentioned in an earlier post). But if we are sending more and more content out through our activity streams, we need to find better ways to filter it — and maybe that’s smarter recommendations from apps like Flipboard or services like Summify — or we are all going to be swamped by the mother of all signal-to-noise problems. As Clay Shirky pointed out some time ago, the problem isn’t information overload, it’s filter failure.

Post and thumbnail photos courtesy of Flickr user Luc Legay

A third take on the Open Graph

I still think opt-in is better than removing it after it's already been shared. I feel that most people would choose to share something when they want. Removing ten items just because you wanted one item to be shared is still not efficient. The algorithms needed to make the system run smoothly are a long way off. The algorithm Facebook uses to determine "Top Stories" is horrible. I marked countless items unimportant and it never seemed to catch on.

Facebook and the Age of Curation Through Unsharing
By: Josh Constine

http://techcrunch.com/2011/11/19/curation-through-unsharing/

Facebook’s Open Graph is ushering in a monumental shift in how we curate what we share. Curation used to mean opting in to sharing. You found or did something you thought your audience would care about, and you went to the trouble of sharing it. This worked when we didn’t have so much content at our finger tips, but as more news and media consumption moves online, the friction of constantly opting in exhausts us and we don’t bother to distribute what others might enjoy. That’s why I believe we are entering the age of curation through unsharing, and it will force us to change.

Some believe “frictionless sharing” via Open Graphs will be the death of curation. That signal will be drowned out by noise as the content we consume but that’s not worth the attention of others is automatically published to our friends and followers. This is a big problem for curation, but it is temporary. It stems from a lack of understanding of curation through unsharing by both the users and developers of Open Graph apps.

Users still expect to have to actively share something in order for it to reach their audience. That’s no longer true. Instead we’ll need to learn to filter out the noise in reverse, opting out when we don’t want to share instead of opting in when we do. That’s a huge behavioral realignment that will take time and won’t come easy. If learned, though, we’ll be able to dance across the web from one piece of great content to the next, sharing it all effortlessly, and only having to stop when something deserves to be struck from the record. And as algorithms improve to show us what’s most relevant, we won’t have to unshare as often.

I love listening to music and reading news, and I love helping my friends discover songs and articles. But before Open Graph apps, I had to actively share each piece of content to the news feed. To my audience, there was no distinction between what I really wanted to highlight, and what was enjoyable but not necessarily crucial. This is why Ticker is brilliant. It creates a channel for casual opt out sharing of high volumes of content, a distinct complement to the channels for explicit opt in sharing we’ve always known.

This granularity allows for more curation, not less. I can still take a song that touches me and opt in to posting it directly to the news feed, where Facebook intelligently gives it more visibility. But through the Ticker I can also share hundreds of songs, all that I enjoy to a lesser extent, and give people who respect my taste a way to discover vetted content.

To make this work, though, we’ll need the app developers to cooperate by making it easy for us to mark an article as unread, remove the last song we heard from the Ticker, etc. I reviewed the sharing controls of all the major news reader apps, and some like The Washington Post and The Guardian are doing their part by providing simple unsharing options.

Unfortunately, some developer like Newscorp with The Daily app are trying to maximize virality by not offering unshare options. They are overemphasizing the short-term, and not thinking enough about being apps that facilitate the new model of curation — apps people will want to return to. We need to pressure them to provide unsharing options by telling them so and not using them if they don’t.

Until we have both learned to unshare and have the capability to do so, this will indeed be the dark age of curation. But we have the power to set the norms. Go read a ton of articles using a responsible app, unshare from the Ticker each one you wouldn’t recommend, and explicitly post links to the news feed to those you think are must-reads. If you see low-quality content shared to the Ticker, tell your friends to utilize the unshare button.

This isn’t natural. Often the best product design is translating existing behavior patterns to new mediums. But the proliferation of content, in both volume and access, requires a brand new conception of sharing and curation. Together we can bring about a golden age.