Ever since it became stable enough to use on a day-to-day basis on a Mac last year, Google Chrome has been my browser of choice. Other browsers have been adding some nice features — but Chrome keeps adding them faster. And today on its second birthday, that rate of change isn’t slowing down.

Google has officially rolled out Chrome 6 as the latest stable version of the browser today. This shouldn’t come as a surprise to anyone using the dev or beta builds of the browser, but it’s nonetheless an important mark as it means it’s stable enough for mass consumption.

Remember that it was just two years ago when Google surprised the world by announcing a new browser (a little early) via a comic. The next day, we got the first shots of what the browser would look like — and it was released as a beta for Windows users. It actually looks pretty much the same today, but it’s now much, much faster (and when it launched it was already faster than most browsers out there).

Google says that Chrome today is a full three times faster when it comes to JavaScript performance versus Chrome circa 2008. The rapid speed increases have also undoubtedly pushed rival browsers to become faster, so we’ve all benefited.

Arguably more important to me is that despite adding all the new features – and extensions — Chrome still seems lightweight today. I fondly remember the good old days of 2004 when I first started using Firefox as my main browser and thinking how fresh and lightweight it felt compared to the atrocity that was IE. Firefox, sadly, got bloated over the years. So far, Chrome hasn’t put on the same weight. Here’s hoping it never does.

As I said, Chrome is also showing no signs of slowing down from a development standpoint. The browser is already in the process of morphing into version 7 as well. Chromium, the open source browser that Chrome is based on, has been hit version 7 a couple weeks ago — and the dev build of Chrome just went 7 as well. Google has said they hope to iterate every six weeks going forward.

These next few months are going to be arguably the most interesting times for the browser yet. The Chrome Web Store will soon open, bringing tightly integrated web-based apps into the browser. And then, of course, Chrome OS is due before the end of the year.

Happy birthday Chrome.

Example of private browsing in Firefox.

Features in the four major browsers designed to cloak users’ browser history often don’t work as billed, according to a research paper that warns that users may get a false sense of security when using the built-in privacy settings.

The private-browsing modes are supposed to allow users to visit a website without leaving any trace on their computers, and yet Internet Explorer, Firefox, Chrome, and Safari frequently leave tracks, according to the research, which is scheduled to be presented at next week’s Usenix Security Symposium in Washington DC. The makers of those browsers — Microsoft, Mozilla, Google, and Apple respectively — often hail the offerings as a way to enhance privacy when using shared computers.

One failure that affects IE, Firefox, and Safari happens when users save SSL, or secure sockets layer, client certificates while browsing in private mode. The browsers store a record of those actions in a file that allows anyone who has physical access to know exactly what site the user was visiting at the time. Similarly, when IE and Safari encounter a self-signed certificate, it is stored in a certificate vault that is preserved even after the private session ends.

Similarly, Firefox users who make security certificate settings while in private mode will have a partial copy of their browsing history stored in a file called cert8.db, the researchers said.

“We discovered that all these browsers retain the generated key pair even after private browsing ends,” the researchers wrote. “Again, if the user visits a site that generates an SSL client key pair, the resulting keys will leak the site’s identity to the local attacker.”

The study (PDF here) showed each browser failing in specific settings.

The privacy mode in Firefox, for instance, is undermined when a user sets site-specific preferences or uses a variety of Mozilla-sanctioned plug-ins. The open-source browser also stores websites visited that dole out custom protocol handlers based on the HTML5 standard.

For its part, IE’s InPrivate mode can be undermined when websites make SMB queries, since the Microsoft browser shares large chunks of code with Windows Explorer.

The researchers also devised a way for webmasters to detect when someone visiting their sites is using the privacy mode. It involves placing an iframe with a unique web address and then “using JavaScript to check whether a link to that URL was displayed as purple (visited) or blue (unvisited).”

The researchers said that to the best of their knowledge they are the first to demonstrate a way to detect private browsing mode — but that may not really matter for much longer. The technique appears to use the decade-old browser history attack, which was recently fixed in Safari and will soon be fixed in Firefox. It’s only a matter of time before Microsoft and Google follow suit.

Using the technique, they confirmed what we all suspected: the feature is mainly used when surfing to porn sites. Gift and news sites, not so much.

When Google launches new services, they often gets a lot of hype (see: Wave, Buzz). Unfortunately, they don’t always live up to that hype (see: Wave, Buzz). But one service that Google launched last year definitely has: Google Voice. Sadly, it has only been open to those with invites. But starting today, it is open to all.

Google Voice started as GrandCentral, a startup launched in 2006 to revolutionize phone management on the web. Google quickly snapped it up in 2007 for over $50 million. For the next two years, it went through a metamorphosis. During that time, some wondered if it was yet another service that Google bought and let die. But in 2009, it emerged as the Google Voice butterfly.

The “early preview” of Google Voice that Google unveiled last year has since undergone a number of changes. Notably, SMS now works better, a Chrome extension makes it simple to keep on top of everything, and there’s a great mobile web app. Most importantly though, Google Voice now works seamlessly with all Android-based mobile phones. The solution is brilliant — and was the central figure in Google’s falling out with Apple (after they rejected the native Google Voice app).

There are also some features we’re still waiting for — such as full number portability and a desktop app (which may be scrapped now).

Google says that there are now over one million people actively using the service. You can expect that number to balloon now that anyone can go to the site and sign up.

In fact, why are you still reading this? Go sign up (well, if you’re in the U.S. –  yes, it’s still U.S.-only). After all, according to this chart, Google Voice is the pinnacle of human communication.

If you are not familiar with Google Voice, here are some of my favorite features:

• transcribed voicemails: whenever somebody leaves a voicemail, Google Voice will transcribe the message as best it can (this only works for English right now). These transcripts are then forwarded to your email account and you can also opt to receive an SMS notification.
• listening in to voicemails: whenever you receive a call and decide to let it go to voicemail, you can also choose to listen in and even pick up the call if it turns out to be an important message. This feels just like the old days when answering machines with tapes were still a novelty.
• call screening: one neat option in Google Voice is the ability to screen calls. If you activate this feature, callers will be prompted to leave their name once they call, and once you pick up the phone, Google Voice will play the name back and you can choose whether you want the call to go to voicemail or actually speak to this person. You can opt to let all unknown callers who are not in your Google address book go through this procedure or just those calls from callers who have blocked their caller ID.
• recording calls: at any time during a call, you can press 4 and the call will be recorded. This only works for calls you receive on your phone for now, and doesn’t work for outgoing calls.
• conference calls: just ask participants to call your Google Voice number and as more callers arrive, you can just conference them in – this works for up to 4 callers.
• switching phones: if you want to switch phones during a call (say you took a call on your landline and decide you want to take a walk and continue the call on your cell), just press * and all your other phones will ring again and you can continue the conversation on any othe rphone.
• SMS: you can send and receive text messages from your Google Voice account and web interface
• integration with Google Contacts
• it just works: the call quality is good, we didn’t experience any outages during the last few months, and calls aren’t dropped. Google Voice does what it says it does, and it does it well.

Since Google Chrome’s release in September of 2008, Mac and Linux users have been playing catchup with Windows users for features and stable releases. As of Today, all three versions of Chrome are now officially stable as the Mac and Linux versions have shed their beta labels for a faster version of Chrome with new features. According to the official Google Chrome blog, the new universally stable release also includes a handful of new HTML5 and syncing features.

Previously only bookmarks could be synced across various machines, but with this latest release, users will now be able to port their preferences – including zoom defaults, themes and homepage settings – to the various computers they browse from. By associating browser settings with a Google account, users can quickly sync the settings on their various installations of Chrome.

Additionally, this newest version of Chrome now supports some fancy new HTML5 features, including geolocation APIs, and drag-and-drop functionality. Beta release testers of Chrome may have already spotted the ability to use Google Maps’ location functions, as well as drag-and-drop of attachments from within Gmail.

Chrome Benchmark Results

According to Google, today’s release of Chrome is the fastest ever, improving “by 213 percent and 305 percent in Javascript performance by the V8 and SunSpider benchmarks” since its initial beta release. Google is also working with Adobe to fully integrate Flash into the browser with new plug-in APIs, but this will not be available until the next full release of Flash Player in the near future.

Today Google announced via a blog post that it has enabled extensions support in the latest beta of its Chrome browser for Apple’s OS X. Users can expect their browsers to update in the next day or so.

Good news for users of Google’s Chrome browser on the Apple platform. Extensions and bookmarking are now fully supported (thank goodness!).

The new version means users can take advantage of more than 2,200 extensions that add features and bolster the usability of Chrome within Mac OS. Extensions can be selected and managed through the options menu.

As for bookmarks, Google explains that bookmarks can be synced between multiple computers, even between Macs, Windows and Linux machines. It also adds bookmark and cookie managers “in a way that feels completely at home on the Mac.” A new Task Manager will help power users keep better track of tabs.

For the impatient, the new version can be downloaded right away. The version number is 5.0.307. The link is here. Haven’t tried it yet? Well it seems to be catching on fast and is super fast, so you might want to give it a shot because it could just replace your current browser… it sure did for me!

Here are a couple of videos that Google through together to explain how it all works.

A spamming botnet known for keeping a low profile has been hammering hundreds of Websites — including the CIA, Chase, Mozilla Labs, Twitter, SANS, Google Chrome, and the FBI — during the past week with an unusually conspicuous amount of phony traffic that has researchers rushing to analyze its next move.

The Pushdo botnet, a.k.a. “Cutwail” and “Pandex,” has been flooding those sites with bogus SSL connections that stop short of requesting anything from the Website. The infected bots begin to initiate an SSL connection with some “junk” traffic and then disconnect, according to The Shadowserver Foundation. Shadowserver and other researchers have been monitoring the activity, which increased traffic by several million hits across several hundred thousand IP addresses, according to Shadowserver.

The botnet hit the ZeusTracker Website, for example, with hundreds of thousands of different IP addresses within a 24-hour period. “This is a lot of bots generating a lot of traffic,” blogged Steven Adair, a researcher with Shadowserver. Recent code changes to Pushdo resulted in its bots generating the “junk” SSL connections to the 315 Websites, he said.

So what is Pushdo up to? Joe Stewart, director of malware research for Secureworks, says the botnet is making fake SSL connection attempts: Malformed packets cause the server to return an SSL negotiation error. “By adding the initial header of an SSL conversation, they may be attempting to avoid closer scrutiny by less vigilant inspection devices,” Stewart says. “And by sending a flurry of these connections to a number of legit ‘decoy’ sites, it helps the Pushdo C&C [command and control] traffic blend in and remain undetected in some cases,” he says.

It’s unclear thus far whether this is a test-run for phony SSL connections gone amuck that ended up exposing this Pushdo traffic, or something else. Stewart says it’s possible there could be more to the latest activity, such as the botnet’s rotating its target lists. “It’s hard to say,” he says.

Blending in has traditionally been Pushdo’s trademark: Although it’s one of the top five spamming botnets, it’s also one of the more under-the-radar botnets around. But this latest activity has researchers wondering how this massive surge of traffic, which resembles a distributed denial-of-service (DDoS) attack, would ultimately help its traffic blend in and become less detectable.

Shadowserver says the traffic is technically an attack, even though it doesn’t appear to be trying to knock the sites offline like a DDoS does. “We find it hard to believe this much activity would be used to make the bots blend in with normal traffic, but at the same time it doesn’t quite look like a DDoS either,” Adair says.

Secureworks’ Stewart says he has witnessed botnets sending traffic via SSL or port 443, but this phony SSL connection attempt is a first. “The Pushdo C&C protocol now also uses similar packets to encapsulate its encrypted/compressed phone-home requests,” he says. “Port 443 is commonly being used to proxy all kinds of non-SSL traffic by legit applications and bots alike, so it stands to reason that a heuristic one might look for suspicious or firewall-policy-violating traffic connections over port 443 that aren’t using SSL.”

The surge in traffic from Pushdo could cause problems for Websites with limited bandwidth and that typically get only a few hundred to a few thousand hits daily, Shadowserver says.

Google just pushed an update to the stable channel of Chrome on Windows, bringing support for extensions and bookmark syncing to everyone who isn’t living on the bleeding edge of Chrome.

The major features in this release (officially labeled 4.0.249.78—uh, we’ll just call it 4.0):

• Extensions
• Bookmark sync
• Enhanced developer tools
• HTML5: Notifications, Web Database, Local Storage, WebSockets, Ruby support
• v8 performance improvements
• Skia performance improvements
• Full ACID3 pass, due to re-enabled remote font support (with added defense against bugs in operating system font libraries)
• HTTP byte range support
• New security feature: “Strict Transport Security” support
• Experimental new anti-reflected-XSS feature called “XSS Auditor”

They’ve also pushed out a handful of security fixes, listed on the Chrome Releases blog post. Google’s spinning this release as adding “over 1,500 new features” to Chrome by virtue of the number of extensions already available to the Chrome community. This update isn’t the final blow to Firefox or anything along those lines, but we can’t help but think the folks at Mozilla would be a little worried.

Extensions are a large part of what’s set Firefox apart from Chrome, while Chrome has often out-paced Firefox in arenas like performance. As Chrome extensions hit the mainstream stable release, we could see a lot of people considering the switch.

Chrome 4.0.etc. is a free, stable release for Windows only but you can only expect the other OS’s versions to be caught up fairly quickly.

Microsoft made its Internet Explorer 8 browser available yesterday, along with a company-commissioned report claiming IE8 is more secure against malware than rival browsers from Mozilla and Google. Users were able to download IE8 in 25 languages at 12:00 noon Eastern Daylight Time on Thursday from Microsoft’s IE Web site and its online download center.

Microsoft has been preparing users for IE8 for a good year now, stressing performance improvements, better support for Internet technology standards, the addition of new features to help people keep track of most visited sites and favorite sources of information, and of course, security, as highlights of the new browser. According to the report Microsoft released Thursday, based on research conducted by NSS Labs, IE8′s Release Candidate 1 was 69 percent effective at catching malware before it did damage to a user’s system. Mozilla Firefox 3.07 came in second with a 30 percent effectiveness rate, with Apple Safari’s 3 in third place with a 24-percent rate and Google’s Chrome 1.0.154 in fourth place with 16 percent effectiveness rate

NSS Labs said in the report that the data was collected from tests conducted in just over 12 days from Feb. 26 through March 10 in its labs in Austin, Texas. During the course of the test, the company said it monitored connectivity to ensure the browsers could access the live malware sites being tested, and performed 141 discrete tests. The margin of error of the tests was 3.76 percent, according to NSS Labs. Amy Barzdukas, a senior director at Microsoft, acknowledged that it might be a conflict of interest for Microsoft to sponsor a report in which IE8 came out on top in terms of security. However, she encouraged people to “look closely at the results” before making a judgment call on the validity of the report.

IE8 will be included as part of the Windows 7 OS. However, for the first time since adding browser technology to its operating system, Microsoft will give users the ability to turn off IE8 as a feature in the system. This decision was outlined in a blog post on the Engineering Windows 7 blog. Microsoft is under pressure from an ongoing antitrust case in the European Union to give users more browser choice in Windows.

A major complaint about Google’s Chrome web browser has been that so far, it is still not available on anything other than Windows. Google promised to deliver Chrome to Mac OS X and Linux as well, but as it turns out, this is a little harder than they anticipated, Ben Goodger, Google’s Chrome interface lead, has explained in an email. It has also been revealed what toolkit the Linux version of Chrome will use: Gtk+.The decision to use native user interface toolkits on each platform has made it all the more difficult to deliver the Mac and Linux versions of Chrome. Several people wondered why Google didn’t just use Qt from the get-go, which would’ve made the whole process a whole lot easier. Goodger explains that Google ”[avoids] cross platform UI toolkits because while they may offer what superficially appears to be a quick path to native looking UI on a variety of target platforms, once you go a bit deeper it turns out to be a bit more problematic.” Your applications end up “speaking with a foreign accent”, he adds. In addition, Goodger claims that using something like Qt ”limits what you can do to a lowest common denominator subset of what’s supported by that framework on each platform.”

As for the Linux version, Google initially thought that a Windows clone would be acceptable, since Chrome itself is already such a fast application. However, the people working on the Linux version of Chrome made a case for using Gtk+ instead, and Google went with that option. Since Chrome is open source, it could still be possible that a Qt version will be developed independently of Google, of course.

When it comes to the Mac version, Goodger explains that the plan there has been to develop a native version all along. ”A Windows-clone would most definitely not be acceptable on MacOS X,” Goodger says, ”where the APIs for UI development are highly evolved and have many outstanding features. So that’s always been the plan there.” The Mac version is coming along nicely, and Google hopes to deliver both the Linux and Mac versions somewhere in June. Hopefully, they will also implement something like Firefox’s NoScript extension because according to some users, the security model is still lacking.