Author Archives: Emily Schechter

Reflecting on a year’s worth of Chrome security improvements

In the next few weeks, you’ll probably be spending lots of time online buying gifts for your friends, family and “extended family” (your dog, duh). And as always, you want to do so securely. Picking the perfect present is hard enough; you shouldn’t have to worry about staying safe while you’re shopping.

Security has always been a top priority for Chrome, and this year we made a bunch of improvements to help keep your information even safer, and encourage sites across the web to become more secure as well. We’re giving you a rundown of those upgrades today, so that you can concentrate on buying the warmest new slippers for your dad or the perfect new holiday sweater for your dog in the next few weeks.


More protection from dangerous and deceptive sites


For years, Google Safe Browsing has scanned the web looking for potential dangers—like sites with malware or phishing schemes that try to steal your personal information—and warned users to steer clear. This year, we announced that Safe Browsing protects more than 3 billion devices, and in Chrome specifically, shows 260 million warnings before users can visit dangerous sites every month.
chromeprotects_a.png

We’re constantly working to improve Safe Browsing and we made really encouraging progress this year, particularly with mobile devices. Safe Browsing powers the warnings we now show in Gmail’s Android and iOS mobile apps after a user clicks a link to a phishing site. We brought Safe Browsing to Android WebView (which Android apps sometimes use to open web content) in Android Oreo, so even web browsing inside other apps is safer. We also brought the new mobile-optimized Safe Browsing protocol to Chrome, which cuts 80 percent of the data used by Safe Browsing and helps Chrome stay lean.


In case you do download a nastygram, this year we’ve also redesigned and upgraded the Chrome Cleanup Tool with technology from IT company ESET. Chrome will alert you if we detect unwanted software, to remove the software and get you back in good hands.


Making the web safer, for everyone


Our security work helps protect Chrome users, but we’ve also pursued projects to help secure the web as a whole. Last year, we announced that we would mark sites that are not encrypted (i.e., served over HTTP) as “not secure” in Chrome. Since then, we’ve seen a marked increase in HTTPS usage on the web, especially with some of the web’s top sites:
saferweb.png

If you’re researching gifts at a coffee shop or airport, you might be connecting to unfamiliar Wi-Fi which could be risky if the sites you’re visiting are not using the secure HTTPS protocol. With HTTPS, you can rest assured that the person sitting next to you can’t see or meddle with everything you’re doing on the Wi-Fi network. HTTPS ensures your connection is encrypted and your data is safe from eavesdroppers regardless of which Wi-Fi network you’re on.


An even stronger sandbox


Chrome has never relied on just one protection to secure your data. We use a layered approach with many different safeguards, including a sandbox—a feature that isolates different tabs in your browser so that if there’s a problem with one, it won’t affect the others. In the past year, we’ve added an additional sandbox layer to Chrome on Android and improved Chrome’s sandboxing on Windows and Android WebView.


So, if you’ve entered your credit card to purchase doggy nail polish in one Chrome tab, and you’ve inadvertently loaded a misbehaving or malicious site in another tab the sandbox will isolate that bad tab, and your credit card details will be protected.


Improving our browser warnings to keep you even safer


It should always be easy to know if you might be in danger online, and what you can do to get back to safety. Chrome communicates these risks in a variety of different ways, from a green lock for a secure HTTPS connection, to a red triangle warning if an attacker might be trying to steal your information.


By applying insights from new research that we published this year, we were able to improve or remove 25 percent of all HTTPS warnings Chrome users see. These improvements mean fewer false alarms, so you see warnings only when you really need them.
chrome.png

Unfortunately, our research didn’t help users avoid dog-grooming dangers. This is a very challenging problem that requires further analysis.


A history of strong security


Security has been a core pillar of Chrome since the very beginning. We’re always tracking our own progress, but outside perspectives are a key component of strong protections too.


The security research community has been key to strengthening Chrome security. We are extremely appreciative of their work—their reports help keep our users safer. We’ve given $4.2 million to researchers through our Vulnerability Reward Program since it launched in 2010.
paidresearch.png

Of course, we’re also happy when aren’t able to find security issues. At Pwn2Own 2017, an industry event where security professionals come together to hack browsers, Chrome remained standing while other browsers were successfully exploited.


Zooming out, we worked with two top-tier security firms to independently assess Chrome’s overall security across the range of areas that are important to keep users safe. Their whitepapers found, for example, that Chrome warns users about more phishing than other major browsers, Chrome patches security vulnerabilities faster than other major browsers, and “security restrictions are best enforced in Google Chrome.” We won’t rest on these laurels, and we will never stop improving Chrome’s security protections.

Combined.png

So, whether you’re shopping for a new computer, concert tickets, or some perfume for your pooch, rest assured: Chrome will secure your data with the best protections on the planet.

Source: Google Chrome


Reflecting on a year’s worth of Chrome security improvements

In the next few weeks, you’ll probably be spending lots of time online buying gifts for your friends, family and “extended family” (your dog, duh). And as always, you want to do so securely. Picking the perfect present is hard enough; you shouldn’t have to worry about staying safe while you’re shopping.

Security has always been a top priority for Chrome, and this year we made a bunch of improvements to help keep your information even safer, and encourage sites across the web to become more secure as well. We’re giving you a rundown of those upgrades today, so that you can concentrate on buying the warmest new slippers for your dad or the perfect new holiday sweater for your dog in the next few weeks.


More protection from dangerous and deceptive sites


For years, Google Safe Browsing has scanned the web looking for potential dangers—like sites with malware or phishing schemes that try to steal your personal information—and warned users to steer clear. This year, we announced that Safe Browsing protects more than 3 billion devices, and in Chrome specifically, shows 260 million warnings before users can visit dangerous sites every month.
chromeprotects_a (2).png

We’re constantly working to improve Safe Browsing and we made really encouraging progress this year, particularly with mobile devices. Safe Browsing powers the warnings we now show in Gmail’s Android and iOS mobile apps after a user clicks a link to a phishing site. We brought Safe Browsing to Android WebView (which Android apps sometimes use to open web content) in Android Oreo, so even web browsing inside other apps is safer. We also brought the new mobile-optimized Safe Browsing protocol to Chrome, which cuts 80 percent of the data used by Safe Browsing and helps Chrome stay lean.


In case you do download a nastygram, this year we’ve also redesigned and upgraded the Chrome Cleanup Tool with technology from IT company ESET. Chrome will alert you if we detect unwanted software, to remove the software and get you back in good hands.


Making the web safer, for everyone


Our security work helps protect Chrome users, but we’ve also pursued projects to help secure the web as a whole. Last year, we announced that we would mark sites that are not encrypted (i.e., served over HTTP) as “not secure” in Chrome. Since then, we’ve seen a marked increase in HTTPS usage on the web, especially with some of the web’s top sites:
saferweb (2).png

If you’re researching gifts at a coffee shop or airport, you might be connecting to unfamiliar Wi-Fi which could be risky if the sites you’re visiting are not using the secure HTTPS protocol. With HTTPS, you can rest assured that the person sitting next to you can’t see or meddle with everything you’re doing on the Wi-Fi network. HTTPS ensures your connection is encrypted and your data is safe from eavesdroppers regardless of which Wi-Fi network you’re on.


An even stronger sandbox


Chrome has never relied on just one protection to secure your data. We use a layered approach with many different safeguards, including a sandbox—a feature that isolates different tabs in your browser so that if there’s a problem with one, it won’t affect the others. In the past year, we’ve added an additional sandbox layer to Chrome on Android and improved Chrome’s sandboxing on Windows and Android WebView.


So, if you’ve entered your credit card to purchase doggy nail polish in one Chrome tab, and you’ve inadvertently loaded a misbehaving or malicious site in another tab the sandbox will isolate that bad tab, and your credit card details will be protected.


Improving our browser warnings to keep you even safer


It should always be easy to know if you might be in danger online, and what you can do to get back to safety. Chrome communicates these risks in a variety of different ways, from a green lock for a secure HTTPS connection, to a red triangle warning if an attacker might be trying to steal your information.


By applying insights from new research that we published this year, we were able to improve or remove 25 percent of all HTTPS warnings Chrome users see. These improvements mean fewer false alarms, so you see warnings only when you really need them.
browser warnings_chrome.png

Some of Chrome’s HTTPS warnings (on the left) are actually caused by reasons unrelated to security—in this case, the user's clock was set to the wrong time. We’ve made the warnings more precise (on the right) to better explain what’s going on and how to fix it.

Unfortunately, our research didn’t help users avoid dog-grooming dangers. This is a very challenging problem that requires further analysis.


A history of strong security


Security has been a core pillar of Chrome since the very beginning. We’re always tracking our own progress, but outside perspectives are a key component of strong protections too.


The security research community has been key to strengthening Chrome security. We are extremely appreciative of their work—their reports help keep our users safer. We’ve given $4.2 million to researchers through our Vulnerability Reward Program since it launched in 2010.
paidresearch (2).png

Of course, we’re also happy when aren’t able to find security issues. At Pwn2Own 2017, an industry event where security professionals come together to hack browsers, Chrome remained standing while other browsers were successfully exploited.


Zooming out, we worked with two top-tier security firms to independently assess Chrome’s overall security across the range of areas that are important to keep users safe. Their whitepapers found, for example, that Chrome warns users about more phishing than other major browsers, Chrome patches security vulnerabilities faster than other major browsers, and “security restrictions are best enforced in Google Chrome.” We won’t rest on these laurels, and we will never stop improving Chrome’s security protections.

Combined (2).png

So, whether you’re shopping for a new computer, concert tickets, or some perfume for your pooch, rest assured: Chrome will secure your data with the best protections on the planet.

Say “yes” to HTTPS: Chrome secures the web, one site at a time

Editor’s note: October is Cybersecurity Awareness Month, and we're celebrating with a series of security announcements this week. See our earlier posts on new security protections tailored for you, our new Advanced Protection Program, and our progress fighting phishing.

Security has always been one of Chrome’s core principles—we constantly work to build the most secure web browser to protect our users. Two recent studies concluded that Chrome was the most secure web browser in multiple aspects of security, with high rates of catching dangerous and deceptive sites, lightning-fast patching of vulnerabilities, and multiple layers of defenses.

About a year ago, we announced that we would begin marking all sites that are not encrypted with HTTPS as “not secure” in Chrome. We wanted to help people understand when the site they're on is not secure, and at the same time, provide motivation to that site's owner to improve the security of their site. We knew this would take some time, and so we started by only marking pages without encryption that collect passwords and credit cards. In the next phase, we began showing the “not secure” warning in two additional situations: when people enter data on an HTTP page, and on all HTTP pages visited in Incognito mode.

http search

It’s only been a year, but HTTPS usage has already made some incredible progress. You can see all of this in our public Transparency Report:


  • 64 percent of Chrome traffic on Android is now protected, up from 42 percent a year ago.

  • Over 75 percent of Chrome traffic on both ChromeOS and Mac is now protected, up from 60 percent on Mac and 67 percent on Chrome OS a year ago

  • 71 of the top 100 sites on the web use HTTPS by default, up from 37 a year ago

percentage of page loads over HTTPS in Chrome by platform
Percent of page loads over HTTPS in Chrome by platform

We’re also excited to see HTTPS usage increasing around the world. For example, we’ve seen HTTPS usage surge recently in Japan; large sites like Rakuten, Cookpad, Ameblo, and Yahoo Japan all made major headway towards HTTPS in 2017. Because of this, we’ve seen HTTPS in Japan surge from 31 percent to 55 percent in the last year, measured via Chrome on Windows. We see similar upward trends in other regions—HTTPS is up from 50 percent to 66 percent in Brazil, and 59 percent to 73 percent in the U.S.!


Ongoing efforts to bring encryption to everyone


To help site owners migrate (or originally create!) their sites on HTTPS, we want to make sure the process is as simple and cheap as possible. Let’s Encrypt is a free and automated certificate authority that makes securing your website cheap and easy. Google Chrome remains a Platinum sponsor of Let’s Encrypt in 2017, and has committed to continue that support next year.


Google also recently announced managed SSL for Google App Engine, and has started securing entire top-level Google domains like .foo and .dev by default with HSTS. These advances help make HTTPS automatic and painless, to make sure we’re moving towards a web that’s secure by default.


HTTPS is easier and cheaper than ever before, and it enables both the best performance the web offers and powerful new features that are too sensitive for HTTP. There’s never been a better time to migrate! Developers, check out our set-up guides to get started.

Source: Google Chrome


Say “yes” to HTTPS: Chrome secures the web, one site at a time

Editor’s note: October is Cybersecurity Awareness Month, and we're celebrating with a series of security announcements this week. See our earlier posts on new security protections tailored for you, our new Advanced Protection Program, and our progress fighting phishing.

Security has always been one of Chrome’s core principles—we constantly work to build the most secure web browser to protect our users. Two recent studies concluded that Chrome was the most secure web browser in multiple aspects of security, with high rates of catching dangerous and deceptive sites, lightning-fast patching of vulnerabilities, and multiple layers of defenses.

About a year ago, we announced that we would begin marking all sites that are not encrypted with HTTPS as “not secure” in Chrome. We wanted to help people understand when the site they're on is not secure, and at the same time, provide motivation to that site's owner to improve the security of their site. We knew this would take some time, and so we started by only marking pages without encryption that collect passwords and credit cards. In the next phase, we began showing the “not secure” warning in two additional situations: when people enter data on an HTTP page, and on all HTTP pages visited in Incognito mode.

http search

It’s only been a year, but HTTPS usage has already made some incredible progress. You can see all of this in our public Transparency Report:


  • 64 percent of Chrome traffic on Android is now protected, up from 42 percent a year ago.

  • Over 75 percent of Chrome traffic on both ChromeOS and Mac is now protected, up from 60 percent on Mac and 67 percent on Chrome OS a year ago

  • 71 of the top 100 sites on the web use HTTPS by default, up from 37 a year ago

percentage of page loads over HTTPS in Chrome by platform
Percent of page loads over HTTPS in Chrome by platform

We’re also excited to see HTTPS usage increasing around the world. For example, we’ve seen HTTPS usage surge recently in Japan; large sites like Rakuten, Cookpad, Ameblo, and Yahoo Japan all made major headway towards HTTPS in 2017. Because of this, we’ve seen HTTPS in Japan surge from 31 percent to 55 percent in the last year, measured via Chrome on Windows. We see similar upward trends in other regions—HTTPS is up from 50 percent to 66 percent in Brazil, and 59 percent to 73 percent in the U.S.!


Ongoing efforts to bring encryption to everyone


To help site owners migrate (or originally create!) their sites on HTTPS, we want to make sure the process is as simple and cheap as possible. Let’s Encrypt is a free and automated certificate authority that makes securing your website cheap and easy. Google Chrome remains a Platinum sponsor of Let’s Encrypt in 2017, and has committed to continue that support next year.


Google also recently announced managed SSL for Google App Engine, and has started securing entire top-level Google domains like .foo and .dev by default with HSTS. These advances help make HTTPS automatic and painless, to make sure we’re moving towards a web that’s secure by default.


HTTPS is easier and cheaper than ever before, and it enables both the best performance the web offers and powerful new features that are too sensitive for HTTP. There’s never been a better time to migrate! Developers, check out our set-up guides to get started.

Chrome: secure by default, for everyone

You shouldn’t need to be a security expert to browse the web, which is why we built Chrome to be secure by default, and easy to use safely by everyone. Chrome protects our users from malicious webpages by showing warnings more than 250 million times each month before users reach dangerous sites. We have also given more than $3.5 million to the security research community in rewards for helping us identify security bugs so we can fix them and strengthen Chrome. Here’s a refresher on how Chrome makes it easy for you to stay safe online.

Security by design

Chrome has used Google Safe Browsing for more than a decade to show you warnings before you visit a site that might be dangerous or deceptive. Safe Browsing launched in 2007 to protect people across the web from deceptive phishing sites, and has evolved to help protect against threats like dangerous malware across Chrome desktop and mobile. If you see a full-screen red warning, you’ll know that the page ahead might be dangerous.

ChromeSecurity_alert800px.png

There are lots of different players—like your internet service provider or your Wi-Fi network—that help get you connected online. Chrome will let you know if you’re securely connected directly to a site by showing a green lock in the address bar:

ChromeSecurity_bar.png

This means that you can be confident that you’re sending any information directly to that site, and it can’t be snooped on or tampered with by anyone else—even a curious person who also happens to be on the free coffee shop Wi-Fi!

Making security easy

Using unique, strong passwords is one of the most important things you can do to stay safe on the web. Chrome’s password manager, called Google Smart Lock, helps you remember your  passwords, so you’ll never have to reuse them. If you’re signed into Chrome, you can keep track of your passwords and Chrome will automatically fill them in on the right sites, across devices.

Finally, we know that you want to stay safe without the hassle of installing updates. Chrome automatically updates behind the scenes every six weeks to ensure that you always have the latest security features and fixes. And if we find an important security bug, we push out a fix within 24 hours—no update from you required.

ChromeSecurity_update.png

Our security team works hard behind the scenes, even (especially!) if you can’t see it happening. Check out our new Chrome Security page for more details, and for more news on security at Google, check out our Security Blog.

Chrome: secure by default, for everyone

You shouldn’t need to be a security expert to browse the web, which is why we built Chrome to be secure by default, and easy to use safely by everyone. Chrome protects our users from malicious webpages by showing warnings more than 250 million times each month before users reach dangerous sites. We have also given more than $3.5 million to the security research community in rewards for helping us identify security bugs so we can fix them and strengthen Chrome. Here’s a refresher on how Chrome makes it easy for you to stay safe online.

Security by design

Chrome has used Google Safe Browsing for more than a decade to show you warnings before you visit a site that might be dangerous or deceptive. Safe Browsing launched in 2007 to protect people across the web from deceptive phishing sites, and has evolved to help protect against threats like dangerous malware across Chrome desktop and mobile. If you see a full-screen red warning, you’ll know that the page ahead might be dangerous.

ChromeSecurity_alert800px.png

There are lots of different players—like your internet service provider or your Wi-Fi network—that help get you connected online. Chrome will let you know if you’re securely connected directly to a site by showing a green lock in the address bar:

ChromeSecurity_bar.png

This means that you can be confident that you’re sending any information directly to that site, and it can’t be snooped on or tampered with by anyone else—even a curious person who also happens to be on the free coffee shop Wi-Fi!

Making security easy

Using unique, strong passwords is one of the most important things you can do to stay safe on the web. Chrome’s password manager, called Google Smart Lock, helps you remember your  passwords, so you’ll never have to reuse them. If you’re signed into Chrome, you can keep track of your passwords and Chrome will automatically fill them in on the right sites, across devices.

Finally, we know that you want to stay safe without the hassle of installing updates. Chrome automatically updates behind the scenes every six weeks to ensure that you always have the latest security features and fixes. And if we find an important security bug, we push out a fix within 24 hours—no update from you required.

ChromeSecurity_update.png

Our security team works hard behind the scenes, even (especially!) if you can’t see it happening. Check out our new Chrome Security page for more details, and for more news on security at Google, check out our Security Blog.

Source: Google Chrome


Chrome: secure by default, for everyone

You shouldn’t need to be a security expert to browse the web, which is why we built Chrome to be secure by default, and easy to use safely by everyone. Chrome protects our users from malicious webpages by showing warnings more than 250 million times each month before users reach dangerous sites. We have also given more than $3.5 million to the security research community in rewards for helping us identify security bugs so we can fix them and strengthen Chrome. Here’s a refresher on how Chrome makes it easy for you to stay safe online.

Security by design

Chrome has used Google Safe Browsing for more than a decade to show you warnings before you visit a site that might be dangerous or deceptive. Safe Browsing launched in 2007 to protect people across the web from deceptive phishing sites, and has evolved to help protect against threats like dangerous malware across Chrome desktop and mobile. If you see a full-screen red warning, you’ll know that the page ahead might be dangerous.

There are lots of different players—like your internet service provider or your Wi-Fi network—that help get you connected online. Chrome will let you know if you’re securely connected directly to a site by showing a green lock in the address bar:

This means that you can be confident that you’re sending any information directly to that site, and it can’t be snooped on or tampered with by anyone else—even a curious person who also happens to be on the free coffee shop Wi-Fi!

Making security easy

Using unique, strong passwords is one of the most important things you can do to stay safe on the web. Chrome’s password manager, called Google Smart Lock, helps you remember your  passwords, so you’ll never have to reuse them. If you’re signed into Chrome, you can keep track of your passwords and Chrome will automatically fill them in on the right sites, across devices.

Finally, we know that you want to stay safe without the hassle of installing updates. Chrome automatically updates behind the scenes every six weeks to ensure that you always have the latest security features and fixes. And if we find an important security bug, we push out a fix within 24 hours—no update from you required.

Our security team works hard behind the scenes, even (especially!) if you can’t see it happening. Check out our new Chrome Security page for more details, and for more news on security at Google, check out our Security Blog.

Source: Google Chrome