Netscape 8 Fights Phishing
Web Design & Technology News, May 19, 2005

May 19, 2005

Netscape on Thursday plans to release the final version of Netscape 8, a browser that includes features to protect Web surfers against online scams.
By Joris Evers

Early test versions of the new browser -- so-called alpha and beta releases -- have been available since February. As reported, Netscape has made mostly cosmetic changes in the final version, said Jeremy Liew, general manager of Netscape, a division of Time Warner's America Online subsidiary.

Almost a million people participated in the public beta, which started in March, Liew said, and most of the criticism received was about the look and feel of the browser. During the beta process, Netscape improved the stability and speed of the browser by fixing bugs and optimizing the software, he added.

Security features in the Netscape software have not changed. "Security is the sizzle that will get people to use this new browser," Liew said. "I think the Web has become a more dangerous place. The threats of phishing and spyware have become more and more real."

The Netscape browser was once ubiquitous, but it was marginalized after Microsoft introduced Internet Explorer in the mid-1990s. However, several high-profile security vulnerabilities in IE have led others, including Netscape and Firefox distributor the Mozilla Foundation, to make security the No. 1 selling point for their browsers.

The new Netscape takes aim at two types of security risks now causing concern among consumers: spyware and phishing. Spyware is malicious software that gets surreptitiously installed on a PC and spies on the user's actions. Phishing scams are a prevalent type of online fraud that attempts to steal sensitive user information such as user names, passwords and credit card information. The attacks typically combine spam e-mail that lures victims to fraudulent Web pages that look like legitimate sites.

Netscape 8 adds a layer of protection when it comes to spyware, Liew said. Whereas many anti-spyware tools can help users after the malicious software has already hit their PCs, the new browser can prevent users from getting it in the first place, he said.

To help people avoid phishing frauds, the updated browser automatically adjusts security settings while they surf, based on lists of sites that are known to be malicious and of trusted sites. The lists will be updated three times a day and automatically downloaded when a PC connects to the Internet, Liew said.

Netscape uses information from parent AOL as well as from nonprofit privacy group Truste, VeriSign and security software company Paretologic to compile the lists, which will be stored on the user's PC. The initial whitelist that ships with the browser contains 150,000 sites, and the blacklist has thousands, according to Netscape.

However, systems will still be vulnerable to problems such as an exploitable flaw in the browser itself, said Thor Larholm, a senior security researcher at PivX Solutions.

"The new security features in Netscape 8 will help guide users in their choices, but will do little to prevent the reoccurring code execution vulnerabilities in Web browsers that we have seen over the years," he said.

Engineering
Netscape 8 is based on Firefox 1.0.3 and uses that browser's Gecko rendering engine by default. But the new software also supports Microsoft's Internet Explorer browser engine, which is part of Windows. Many Web sites have been built to work with IE, so supporting the engine maximizes compatibility.

Netscape 8 users will be alerted to malicious sites with a red shield in the browser tab. If the user chooses to display the site, it will be rendered using the Firefox engine and with browser features such as cookies and JavaScript turned off. Trusted Web sites are displayed with fewer restrictions and using the IE engine.

Other features in the browser, unrelated to security, include the ability to set multiple Web sites as the home page. These pages will open in multiple tabs when starting the browser. Also, the browser offers improved support for RSS, or Really Simple Syndication, feeds.

Microsoft's browser still dominates in terms of usage, but Firefox and other browsers have been pecking at its market share. At the end of April, Microsoft held 88.86% of the U.S. browser market and Firefox stood at 6.75%, according to data from Web analytics firm WebSideStory.

Netscape hopes the new browser will be downloaded more than 15 million times this year, about the number of Netscape browser downloads the company hit last year, Liew said. Initially, Netscape 8 will only be available in U.S. English. Canadian English and French are set to follow in June. Other international versions may follow, he said.

The primary distribution mechanism for Netscape 8 will be through the Netscape.com Web site, which gets about 18 million unique visitors per month, Liew said. Netscape is also advertising the update on Web sites and in search engines, he said. It should be available for free download Thursday morning.