Anatomy of a browser trick - you've heard of "clickjacking", now meet "keyjacking"...

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

An Italian security researcher has rediscovered a trick known as user interface redressing.

He's used the concept to detail some potentially risky behaviour in some versions of Internet Explorer on Windows 7 and 8.

As that's a fairly common combination, and because the trick is worth pondering for anyone who likes to be thoughtful about computer security, here's what Rosario Valotta came up with last week.

? If you've ever been confused by the term UI redress, you aren't alone. To keep it clear, imagine it written as UI re-dress. It means that you put a new layer of clothes over an interface object as a sneaky way of changing its appearance, not that you right the wrongs that were done to it (the usual sense of "redress" when written as an unhyphenated word).

You may remember clickjacking, where your cursor is placed over a clickable button, such as a Facebook Like, that is itself placed over an innocent-looking image.

Then the button is made transparent, so that the image "re-dresses" the button and you think you are clicking on the image.

Valotta's trick is keyjacking, which is like clickjacking but with the re-dressing done the other way around.

You initiate a download window, which, at least under Internet Explorer 8 on Windows 7, produces a Run|Save|Cancel dialog.

You cover up the dialog with a window that looks like a CAPTCHA with R as the first character you need to type in.

Then you remove focus from the foreground window so that if the user does innocently press R, it is fed into the underlying dialog, not into the fake CAPTCHA window.

In IE 8 on Windows 7, that tricks you into choosing the Run option, so the downloaded file is launched automatically, apparently with your official blessing.

? In clickjacking, you click on a button that is opaque to your mouse (so it accepts and processes your click), but transparent to your eyes. In keyjacking, you type a character into a window that is opaque to your eyes, but transparent to your keyboard (so it passes your keystroke through to a hidden window underneath).

Here's what is supposed to happen in Valotta's demo, starting with the launch page:

If you click the button to launch the demo, it opens a window containing an invisible IFRAME that's populated, using JavaScript, with an EXE file:

Pushing an EXE file into the IFRAME initiates a file download and causes a double popup, the first to denote the start of the download, and the second to ask you whether you'd like to Run, Save or Cancel:

But you can't see any of this, because the window responsible for the download is a pop-under window, re-dressed on top with a window that appears to be asking for input, but isn't:

(In the on-line demo, the field into which you are supposed to enter the CAPTCHA text is actually an animated GIF containing a flashing cursor, for added realism. The CAPTCHA in the demo starts with E, which stands for Esegui, the equivalent of Run on Valotta's Italian-language version of Windows.)

In theory, then, the CAPTCHA acts as a realistic and innocent-looking subterfuge that sneakily tricks you into signalling Run to a dialog you can't see.

In practice, in my tests using a default installation of IE 8 on Windows 7 Enterprise, IE automatically averted the danger by blocking the download with a yellow security bar:

To initiate the download, you have to click on the security bar in the offending window, select the Download File... option from the dropdown menu that appears, and only then click Run or type R:

Since the security bar is out of sight, there doesn't appear to be an easy way to trick you into following that sequence of steps.

And if you're a Firefox user, like me, the subterfuge is immediately obvious, at least with Valotta's demo.

The hidden window doesn't pop up underneath, and both the IFRAME border and the download dialog are clearly visible by default:

(The u are not character string visible in the background is partially-obscured text from the fake CAPTCHA window shown above.)

Valotta says the trick does work under IE 9 and 10 on Windows 7, and IE 10 on Windows 8, so his discussion is nevertheless worth studying, especially if you design web applications for a living.

[NB. Please see Valotta's comment below pointing out my error in an earlier version of this article. Apologies for the misunderstanding.]

It's a timely reminder, in today's web-based AJAX-heavy world, that what you see in your browser may not be precisely what you get, and that JavaScript's windows focus and transparency system are ripe for visual abuse.

Some of the things you can do for additional security include:

Turn on as much of your browser's real-time protection (e.g. popup blockers and protected mode) as you can tolerate in order to reduce the risk of unwanted browser windows.Use a web filtering product on your computer or as part of your network gateway in order to block access to suspicious URLs and files.Ensure that your on-access (real-time) virus scanner is turned on in order to stop dangerous downloads from launching, even if they are successfully downloaded.

Follow @duckblog

Image of laptop keyboard courtesy of Shutterstock.

View the original article here

LinkedIn unhacked, Microsoft bounties, Java in your browser - 60 Sec Security [VIDEO]

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

It's that time again - time for this week's 60 Second Security, our fun-but-serious "security news with a conscience" video series.

Watch the latest security news in just 60 seconds! [Higher resolution available directly from YouTube. Click the Captions icon for closed captions.]

(If you enjoyed this video, you'll find plenty more on the SophosLabs YouTube channel.)

http://twitter.com/duckblog

Tags: 60 Sec Security, 60 Second Security, 60 Seconds, 60SS, Apple, applet, bounty, browser, crack, DDoS, dictionary, Erlangen, Exploit, ios, iPad, iPhone, Java, linkedin, Microsoft, network solutions, Oracle, outage, passwords, rce, update, vulnerability, Wi-fi, Window 8.1 Preview, Windows 8.1

View the original article here

Farewell Camino - pioneering Mac browser falls behind on security, reaches end of road

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Camino, the first browser that was purposefully made for Apple's OS X, has officially reached the end of the road.

If you were an OS X user when it first came out you were pretty much stuck with browsers that came from other operating systems, such as Internet Explorer for Mac. (Yes, that Internet Explorer.)

Camino was different.

Although it used Mozilla's web rendering engine, known as Gecko, it didn't use Mozilla's cross-platform user interface specification language, XUL.

Camino was written to be a native OS X application, using the Cocoa API and OS X's Aqua user interface.

It was the first OS X browser that really was an OS X browser.

Apple must have liked what it saw, because it hired one of the main coders of the Camino project (then called Chimera, a name that was shed early on for legal reasons) to work on its own Safari browser.

Unfortunately, being a minority browser created by a small group of enthusiasts is really tough in the modern world.

You're not only facing the healthy competition of other browser vendors, but also the unhealthy attention of cybercriminals.

Regular security updates, which are these days typically interleaved with feature updates, are a must.

Camino also faced the challenge, back in 2011, of switching web rendering engines, because Mozilla decided to stop supporting the embedding of the Gecko engine by third-party products.

As a result, Camino's last release was more than a year ago, and late last week the development team decided to pull the plug permanently.

After a decade-long run, Camino is no longer being developed, and we encourage all users to upgrade to a more modern browser. Camino is increasingly lagging behind the fast pace of changes on the web, and more importantly it is not receiving security updates, making it increasingly unsafe to use.

Ironically, you can still download Camino 2.1.2.

It still works just fine, reporting 99/100 on the Acid3 browser compliance test. (Chromium and Firefox on OS X complete 100 of 100 tests, but produce a rendering error causing them to display the telltale YOU SHOULD NOT SEE THIS AT ALL warning.)

But, as the developers have reminded us, security updates really are vitally important, so it's time to say, "Farewell, Camino."

Follow @duckblog

View the original article here

Google announces brand new web browser core, so does Mozilla

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

When you wait ages for a bus, and then three come along at once, it's not a coincidence: it's a side-effect of queuing and traffic lights.

But what about when three browser vendors make announcements on the same day?

Robust competition? Serendipity? Coincidence? Or a bit of all of them?

Google announced Blink, a fork of the Webkit browser that aims to build a smaller and safer rendering platform based on what Google is unashamedly referring to as a "healthier codebase."

Opera, which is retiring its own rendering engine Presto and replacing its browser core with Chromium, the open-source flavour of Google Chrome, indirectly announced its commitment to the Blink-based flavour of Chromium.

And Mozilla announced Servo, or, more accurately, announced an ARM port of its experimental browser engine Servo, written in its new and experimental programming language Rust.

? The ARM processor is the CPU in most Android devices in the marketplace. Samsung, which sells a wide range of Android offerings, including phones, tablets, and phablets (giant phones or tiny tablets depending on whether they're against your ear or on your lap) is partnering with Mozilla in the Servo-on-ARM project.

A new rendering engine has at least one similarity with marriage, namely that it is not an undertaking to be entered into lightly.

A web browser is not just an HTML parser but also a CSS handler, a JavaScript interpreter, a DOM manager, a page layout engine, and an image processor, as well as a programming platform in its own right.

Modern browsers support all manner of third-party add-ons, extensions and plugins that typically let you customise almost everything to do with the browser's look, feel, and feature set. (Java applets, anyone? Flash videos? Audio playback? 3D modelling? Interactive games?)

Both projects, Blink and Servo, are forward-looking, by which I mean they aren't finished products that you can download and install right now.

Google talks about "the next 12 months" in its Developer FAQ, and talks about the "next generation" of web apps.

Mozilla's posting refers to "the coming year", and admits that both Rust and Servo are "early stage projects."

Sceptics, therefore, may very well write off both announcements as little more than positioning statements.

Indeed, their coincidental arrival on the same day will probably convince the real cynics that the announcements had more to do with the browser makers' marketing departments than with engineering.

Don't be too judgmental, though.

Mozilla's post comes from Brendan Eich, Mozilla CTO and well-respected inventor of JavaScript.

Google's was written by Adam Barth, who's a software engineer and security researcher.

And both companies talk prominently about security and simplicity as a motivator for the projects:

Chromium uses a different multi-process architecture than other WebKit-based browsers, and supporting multiple architectures over the years has led to increasing complexity for both the WebKit and Chromium projects...

[Rust] is *safe by default*, preventing entire classes of memory management errors that lead to crashes and security vulnerabilities.

It's pleasing to see this sort of language prominent in new project announcements.

Google's writeup, indeed, explicitly talks about how many lines of code Mountain View expects to be able to remove from the Webkit codebase, which is a refreshing change from product announcements that talk up all the features that have been added since the last release.

Web developers might not feel quite as enthusiastic as I do, of course, because a brand new rendering engine means a brand new list of browser-specific pecadillos, a need for yet more special-case code tweaks, and a whole new environment to test.

Nevertheless, the principle of hybrid vigour suggests that breeding the next decade's browsers from a broader range of genetic starting material is unlikely to do any harm.

I think we should welcome these announcements as evidence that at least part of the battle in today's browser wars isn't vendor against vendor, but instead a collective fight against cybercriminality.

What do you think? Have your say in the comments below...

Follow @duckblog

Tags: barth, blink, browser, browser war, eich, Google, JavaScript, Mozilla, rust, Security, servo

View the original article here

Facebook owns up - admits network breached, blames "Java in the browser"

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

There's a scene in the movie The Social Network where Mark Zuckerberg is arguing with Eduardo, his CFO.

Eduardo's just frozen Facebook's bank account.

The plan is to get Zuckerberg's attention and to try to get Zuck back on what Eduardo thinks is the straight and narrow.

But Zuckerberg is irate.

He thinks it might end up with an unpaid bill and thus a network outage, and that won't do!

Zuck rants:

Let me tell you the difference between Facebook and everybody else: WE DON'T CRASH EVER!

It's only a movie, of course.

In real life it's not true that Facebook never goes down, but when you consider its size and the online activity it supports, Facebook's uptime and availability is astonishing. Stellar. Intergalactic, even.

The movie version of Zuckerberg goes on to explain:

If the servers are down for even a day, our entire reputation is irreversibly destroyed. Users are fickle... Even a few people leaving would reverberate through the entire user base.

But what about getting owned by hackers?

What effect do you think that might have?

If you're the world's biggest social network, and if collecting, storing and using other people's personal information is your bread and butter?

Hold your horses, because we're about to find out.

Facebook just published an article entitled Protecting People On Facebook, and it doesn't cover what you might at first expect when you see the title.

Sure, it starts upbeat enough:

Facebook, like every significant internet service, is frequently targeted by those who want to disrupt or access our data and infrastructure. As such, we invest heavily in preventing, detecting, and responding to threats that target our infrastructure, and we never stop working to protect the people who use our service.

But that's followed by a hint of what's coming next:

The vast majority of the time, we are successful in preventing harm before it happens, and our security team works to quickly and effectively investigate and stop abuse.

And then the bombshell. OK, not really a bombshell. Let's be fair and say it's actually a pretty candid admission for which the company deserves at least a nod of respect:

Last month, Facebook Security discovered that our systems had been targeted in a sophisticated attack. This attack occurred when a handful of employees visited a mobile developer website that was compromised. The compromised website hosted an exploit which then allowed malware to be installed on these employee laptops.

Later on in the article, Facebook claims that it has "found no evidence that Facebook user data was compromised," and and for what it's worth, I'm willing to accept that claim.

? Update. In an interview with Ars Technica, Facebook CSO Joe Sullivan has admitted that the crooks made off with information from the laptops themselves. ("What you typically find on an engineer's laptop, including corporate data, e-mail, and some software code.") But despite being able to get "some limited visibility" into Facebook's production systems, Sullivan confirmed that a forensic review found no evidence that the crooks got away with any data off those systems. Close, in a word, but no cigar. (Added 2013-02-16T22:11Z)

The crooks had a Java zero-day at their disposal, and this exploit let them infiltrate Facebook's network and inject malware.

But the company says it was fully patched and anti-virused, and it sounds as though the malware that followed the exploit was quickly spotted and cleaned up, with no lasting harm done.

Just one suggestion to Facebook developers: why not read Naked Security?

We've given you loads of good reasons to turn off Java in your browser, starting from the middle of last year.

That alone could have side-stepped this problem.

Even just using a browser with click-to-play (so that Java and Flash applets, amongst others, can't launch quietly in the background from compromised websites) would surely have been enough.

I'm guessing now, but I'd be very surprised if the mobile developer website alluded to above actually required Java, so there would have been no reason to have Java turned on for that site.

Similarly, the mobile developer website could have considered using outbound web or packet filtering to block the egress of Java applets if, indeed, its site was never supposed to serve them up in the first place.

? IPS technology is usually thought of as a way to keep bad guys out, not least because it stands for intrusion prevention system. But most decent IPSes work bidirectionally, and can act as effective EPSes, or exfiltration preventers, too. You filter email for spam both ways (don't you?), because you can, and because it makes sense. The same applies with network traffic in general. If the bad guys have already got in, you may as well stop them getting back out as well!

Having said all that, it remains for me to ask. You have turned off Java in your browser, haven't you?

If not, here you are: How to turn off Java in your browser.

And fear not that you will break JavaScript: Java is not JavaScript.

Follow @duckblog

View the original article here

Is Opera *really* the safest browser?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

An online poll conducted on the Naked Security site has come up with an interesting finding: Opera, a relative minnow in the web browser market, is reckoned to be a more secure browser than the likes of Google Chrome, Mozilla Firefox and Internet Explorer.

We were interested in discovering which browser our readers would recommend to friends or family who had suffered a computer security problem.

The poll opened on the morning of Monday 3rd September, and saw Chrome and Firefox take an early lead with Internet Explorer, Safari and Opera lagging far far behind.

Everything changed yesterday, however, as Opera surged in its share of the vote. The Norwegian browser - which had earlier only been receiving less than two votes every hour suddenly was receiving five votes every minute!

Impressive for a browser which has a much smaller marketshare than the big players.

So, what happened? Had thousands of people suddenly woken up to the realisation that Opera *was* their favourite browser, and that they should vote for it instead of Chrome or Firefox?

Well, we did a little digging around and found that Opera's marketing department wasn't resting on its laurels.

The guys and gals at Opera tweeted and posted on Facebook, inviting their fans to participate in the poll.

Opera has some 1.7 million fans on Facebook, so it's really no surprise to see some of them vote for their browser of choice. And sure enough, straight after Opera publicised the poll via social media, the votes for Opera began to flood in.

As of midday in the UK, Opera had raced into the lead.

We don't actually mind that Opera publicised our browser poll - after all, we didn't say that vendors were bound from rallying their supporters. If anything, Opera's marketroids have shown some admirable velocity in encouraging their fans to take part.

But we do suspect that our (admittedly unscientific) poll may have been skewed somewhat by this spike in Opera-loving votes. (Interestingly, there was also a synchronous rise in votes for Opera's rivals - presumably from those who follow Opera on social networks, but aren't necessarily diehard fans).

So, come on Firefox lovers and those of you who think Chrome is the greatest thing since Netscape Navigator - what are you waiting for? There's still time to cast your vote!

And is there really no-one who has a good word to say about Internet Explorer?

If you have an explanation for IE's poor showing, or think Opera is right to be considered the safest browser, or have any other opinions on the survey - why not leave a comment below?

Follow @gcluley

Thanks to Sara Warner for helping crunch the data, necessary to write this article.

View the original article here

Which web browser do you recommend? [POLL]

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The browser wars are here - with big players like Google Chrome, Microsoft Internet Explorer and Mozilla Firefox fighting tooth-and-nail for marketshare.

The good news is that users are benefiting from the fight, with vendors using new security features as differentiators in an attempt to make you switch your browser.

And there's good reason for you to be pleased that browsers are tackling security problems, as so much of today's malware is delivered via the web, or has a web-based component.

So, here's the question - if one of your friends or family had suffered a computer security problem, what browser would you recommend that they use? What's your preferred browser security-wise?

And don't just make your vote - tell us why you made your choice by leaving a comment below.

Thanks for sharing your point of view!

http://twitter.com/gcluley

View the original article here

Apple zombie malware 'NetWeird' rummages for browser and email passwords

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

When we write Naked Security articles about Mac malware, we often end up creating a bit of a stir. Usually that's not on account of the malware itself, but on account of us writing about it in the first place.

Here's how it goes down.

We write the article. The politically-sensitive Apple fanbuoys come out swinging, saying we only write about Apple malware because we're down on Cupertino.

The artistic fanbuoys (Apple users who are in a band, for example) chime in even more fiercely, saying Mac malware is a figment of everyone else's unimaginative delusion.

The geeky fanbuoys (the ones who know where bash is, and what it's for) come out firmly to remind us - utterly without any accuracy - that if it doesn't ask for the Admin password, it can't be malware.

And then the long-suffering but battle-hardened Windows users pop up and say, "Back in 1991, we felt the same way. It didn't end well." Those of a philosophical bent repeat, with sincerity and concern, the words of George Santayana. "Those who cannot remember the past are condemned to repeat it."

So, with a deep breath, here's some Mac malware news.

There's been a touch of fuss in the media about it, which is the first reason we thought that we ought to tell you about it; the second reason is that it has an engagingly curious name: NetWeird. (No, I don't know why, either.)

NetWeird is interesting primarily because it is uninteresting. It's not very well written; it's not very well tested; it's probably not going to catch you unawares (but watch out if you're in a band!); and so far as we can tell, it's not in the wild.

But someone has gone to the trouble of creating it and, according to our chums at French Mac anti-virus outfit Intego, is actually trying to sell it on the underground market for the ambitious price of $60.

And that makes it interesting: it seems that the crooks really are getting into the habit of churning out new Mac malware, not to show how clever they are, but merely to see if they can repeat the trick that's worked on Windows for years: making money out of next to nothing. Those who remember the past often choose to repeat it, especially if there's money to be made.

And now about the malware.

NetWeird installs itself into your home directory as an application bundle called WIFIADAPT.app.app. That makes it rather obvious.

It adds itself to your login items, presumably with the intention of loading up every time you reboot your Mac. But a bug means that it adds itself as a folder, not an application. All that happens when you log back in is that Finder pops up and displays your home directory.

NetWeird also calls home to a hosted server located in The Netherlands. This makes it a bot, or zombie.

Bots use an outbound connection to listen for command-and-control signals from a cybercrook known as a botmaster. This works because a TCP connection, once established, is fully bidirectional, so the client side can behave as a server, and vice versa.

The commands that the bot can process allow it to run arbitrary programs via the shell, monitor running processes, take screenshots, exfiltrate files, and to rummage through the password files of well-known third-party browsers and email clients Opera, Firefox, SeaMonkey and Thunderbird.

You're not likely to see this thing, but if you do, Sophos Anti-Virus will mop it up for you under the name OSX/NetWrdRC-A.

If you do get infected, deleting the above-mentioned application bundle and rebooting should get it off disk and out of memory.

And if you're running Mountain Lion in its default security settings, you won't be able to run it anyway, because it's not from the App Store and isn't digitally signed by an Apple-endorsed developer.

That's about all you need to know about it.

Follow @duckblog
-

Stirrer image courtesy of Shutterstock.

Tags: apples, bot, cupertino, Malware, netweird, netweirdrc, netwrd-a, OS X, osx, Trojan, zombie

View the original article here

Browser wars - Microsoft says IE10 will support Do Not Track by default

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Filed Under: Featured, Privacy

On Thursday Microsoft announced that Internet Explorer 10 on Windows 8 will be the first web browser with a Do Not Track feature that's on by default.

Microsoft's Chief Privacy Officer Brendon Lynch explained the move in unequivocal terms:

We've made today’s decision because we believe in putting people first. We believe that consumers should have more control over how information about their online behavior is tracked, shared and used.

Consumers should be empowered to make an informed choice and, for these reasons, we believe that for IE10 in Windows 8, a privacy-by-default state for online behavioral advertising is the right approach.

When the World Wide Web Consortium (W3C) released its first drafts for Do Not Track standards in November 2011 I asked the question Will Do Not Track make a difference to web privacy?

In the article I explained that Do Not Track must be on by default if it's going to have an impact and at that time we just didn't know if that was likely to happen.

...users will need to upgrade to a new generation of DNT compliant browsers to get the ball rolling ... [we] don't know yet if the browser vendors are intending to switch DNT on by default...

Well now we know that one of them is. Microsoft are the first and their decision is important both practically and morally.

Practically the move is significant because it will greatly increase the pressure on websites to start honoring the Do Not Track standard.

Do Not Track relies on two distinct technical steps; web browsers that send out Do Not Track signals (in the form of HTTP headers) and websites that listen for and honor those Do Not Track signals.

So long as the volume of Do Not Track signals being received by websites is low there will be little pressure for them to implement their parts of the Do Not Track standard. Internet Explorer remains a very popular browser and a lot of people are going to end up using IE 10.

The moral impact of this decision is that it will change users' minimum expectations when it comes to trusting their web browsers.

Browser vendors don't really compete on features any more, they compete on performance and trust; the best browser is the fastest, most secure and most private.

All the major browsers already support Do Not Track in one form or another but up until now they have all left it to their users to switch it on.

As long as none of them enabled Do Not Track out of the box then none of them looked any more or less trustworthy as a result. Microsoft's decision to break the status quo makes its competitors look like they have something to hide and that isn't something I think they'll tolerate.

So I'm watching with interest to see how, and particularly how quickly, the other vendors respond.

Windows 8 doesn't have a release date yet but the rumor is that users won't get their hands on it until October.

Meanwhile Mozilla will push out a new version of its Firefox browser every few weeks between now and October. If Mozilla chooses to it can have a browser with Do Not Track on by default and in the wild long before Microsoft.

Although Do Not Track extensions are available for Chrome, Google is not intending to add support into its browser proper until the end of 2012. Even with that shameful bit of heel-dragging they still have enough time to beat Microsoft to the punch.

Google and Mozilla; a little piece of your thunder has been stolen, I dare you to take it back.

Follow @markstockley

Woman with laptop on mountain image, courtesy of Shutterstock.

View the original article here