Very true. Amongst many other security flaws, UC Browser also does not support HSTS (headers or preload list) at all. That means that a connection made by UC Browser to any site can be man-in-the-middled and inspected or modified.
As far as the Chinese government is concerned, however, this may be a feature rather than a bug.
No one should be using UC Browser, full stop. It's pathologically insecure.
Your carrier can preload any CA certificates it wants on the device and install them OTA at least on android devices.
iPhones are a bit more restrictive apps can install their own CA/trusted certificates but these are accessible to the only the apps iirc Apple manages the general trust store on its own with system update.
The only effective way to get guaranteed security is with HSTS preloading. Anything short of that leaves you vulnerable to the linked attack, which dates way back to 2012.
sslstrip does not stop HTTPS connections. It simply replaces https links on a page with http, and that itself requires the initially manipulated page to be served over plain HTTP.
It was far more relevant when websites were mostly HTTP, but used HTTPS for login or payment pages.
It doesn't stop HTTPS connections, but if I type in randomdomain.com in my browser and hit return, that sends an HTTP request by default. If someone is intercepting my connection, they can modify what's being returned by the webserver, and even if the server itself only serves via HTTPS, the man-in-the-middle program can simply terminate HTTPS and then serve a modified version of the now-unencrypted contents via HTTP.
The only way to get guaranteed security is if your browser will only ever make HTTPS connections to a given domain name, and that requires HSTS preloading.
Have you ever seen popups abusing all possible browser API(best known for use of phone vibrator) promising to get rid you of the "virus" if you go and install that UC browser?
My experience casually observing how most people in coffee shops, even developers, leave their laptops unlocked as they go use the bathroom, or ask a random stranger to watch it for them, is that security in general is not as high of a concern for many as it should be.
The founder is the very first guy in China who used malware technique to prevent his own IE search enhancement plugin, 3721, circa 2004, from being uninstalled. It was a pain in the ass to uninstall this thing because it hooks so deeply in the system. Now it's sarcastic that this guy is running a security business.
The most recent case is that they broadcast the footages captured on the so called security cameras on a website that it positioned to be something like Twitch but with daily life content. So you really got to see inside other people's house! Supposedly this needs to be enabled by the user as an option, but I'm not sure why so many people enabled it. They have stopped this 'service', without admitting that it's wrong.
I don't know (nor did I downvote). Qihoo 360 has a bad reputation, Zhong Hongyi is a Trump-like character. But if you aren't into the China tech scene, you've probably never heard of them before.
UC Browser is now holding the web back by not adopting new standards like css-grid and flexbox. No version of UC supports these standards and with the rise of UC globally, developers are hesitant to use these standards as millions of users especially in India and China are left out. I know there are ways to configure fallback, but still.
As soon as I read the headline on the frontpage, I came here to search for a mention of flexbox.
It's the only non-deprecated browser that only supports the first draft of the flexbox spec. There's no workaround for the lack of flex-wrap — you have to assume it's a small mobile device and arrange items on a single axis.
>you have to assume it's a small mobile device and arrange items on a single axis.
Is there really no other way to detect if it's desktop? It seems like screen aspect ratio would be easy.
Mobile sites look terrible on desktop browsers if they work at all. The one I encounter all the time is Firefox's add-on site. Just because I don't have css-grid it forces mobile which makes things worse. I know people like myself are a tiny fraction of a tiny fraction of users but we exist.
They mention why in the article. Data compression in markets where data is slow and expensive. As well as a small storage footprint leading to more space on their phones for other stuff (which possibly also means a lower memory footprint so it may work better as well).
And the people who author mobile Chrome all use iPhones or Galaxies or Pixels. It's about the dogfooding -- the people who write UC Browser use it on the same phones, mobile networks and websites that the users of UC Browser use, so it's written with their needs in mind.
Which is a roundabout way of saying mobile Chrome doesn’t work well on lower end devices, which is why many users switch to it. This is the reason why I (and a distant parent, I’d assume) was looking for.
I guess that's what i dont understand, what are the needs of the people in this market and what about chrome or firefox fails to meet that need? It doesn't have flexbox support, and i would imagine that would break a ton of modern websites. It isn't like these markets have their own version of html/css, everyone's on the same web, so why go for a browser with worse support for modern standards?
Users don't know/care about flexbox at all. It's developers concern.
Also UC has much more features and builtin contents than chrome. Maybe UC can provide better user experience to new internet users that think typing urls on phones to see news and videos weird. Not everyone likes minimalism.
At least Chinese markets (and possibly Indian and others as well)do not seem to have the disdain for feature loading American markets do.
Weibo is one of the most popular apps in the markwt (if not most) and it’s practically an operating system of its own. I suspect it would have gotten nowhere in US markets because people would have complained about it being not focused and having a bad UI.
Sounds more to me like other mobile browsers are holding the web back by not paying more attention to the needs of the many. Users don't care about standards, just that things work.
And how are things ever going to work without standards?
Standards aren't meant for end-users, they're meant for the engineers building the freaking software end-users are using.
Imagine every electrical device in your home having its own distinct power cable. Every device requiring a different voltage (110V is a standard, who needs that?) and plug type. You'd be spending a lot more (as the end user) in converters and adapters and whatnot; the only end result is that you pay much more for much less.
What standards? WHATWG publishes a living document, that's not a standard. Wake up, vendors control the web. If you wanted to make a competing browser today, you'd be utterly fucked because you'd never be able to implement the entire catalog of web features that exist today, and those feature sets change too rapidly.
There are no web standards. There are browsers and people who use them and developers who target those browsers.
So you're saying we should drop whatever unification WHATWG brings and leave everyone to do their own thing? That's certainly going to end well.
Saying "wake up" is a very dangerous statement; usually hints at ignorance more than anything else. Who do you think sits on the board of WHATWG? Its the very people building web browsers.
There's a reason making web apps doesn't suck nearly as much in 2018 as it did years ago, mostly because APIs are starting to be consistent across browsers. Thats standards for you, even living ones. (Its a living standard, not a living document, by the way.)
I'm very curious as to how you'll make a website that works in all browsers if they're all free to implement radically different interfaces to HTML/CSS/JS. Don't even think about web apps, or having 3D stuff.
Lets all go back to using glue libraries like jQuery like its 2010 again. That sounds fun.
A very large reason for the huge user base of UC browser is that it used to work on very low end phones, like Nokia S40 editions, similar to Opera Mini, and many people who migrated from those kept using UC.
Also, these browsers operated with very less data using server side comprssion. Not good for privacy maybe, but good for slow connections.
Another thing I hear from people using UC is that it has really good download capabilities. Such functionality might be common in today's mobile browsers, but 4 years ago, it was difficult to find another browser which could pause and resume downloads, which is essential if you have a slow internet connection.
A lot of people using UC were using Opera Mini. However, UC has a much larger bigger marketing budget and that I think made the difference.
You guys can imaging how crappy Chinese websites are, full of unrelated ads and mis-information. UCWeb has some kind of manual defined rules as well as automatic converter (IIRC, based on LXML and Squid) to strip html content and leave only minimal style and mostly text content. It was vast popular during 2G GPRS WAP era, and just as popular in 3G/4G era. E.g. something similar to youtube-dl+basic player for well known video sites.
UCWeb has this server-side as well as client-side page clean process that allows you to view content in some kind of Reader mode. People don't use UCWeb for your fancy HTML5 "full" experience but rather for a "casual online reading", e.g. for fake & hype news sites, Internet fan novels, online shitposting boards, etc.
For serious matters like social networking (very serious!), ppl use apps, for business/work related, or personal banking, people just switch to iOS/Android default browser for security. For everything else, well it's a totally different landscape in Asia, there's Wechat, one mega app for everything.
I have never seen anyone use UCWeb exclusively, often the have a standby fallback option.
UCWeb is growing out of a niche market and is growing well. If you think UCWeb is the same kind of browser like Chrome or Safari you are thinking it wrong.
The first comment you linked is mine. I only read some western languages, no Chinese. I'm both happy somebody else (you) cares about the issue and sad that not enough people do.
I'm using Firefox on my phone now because of the addons: uBlock origin (especially to hide fixed top and bottom bars, I also use Blokada to block ads even in app, no root required), Nocoin, Disable WebRTC, BarbBlock.
Some sites are really a pain to read because of horizontal scrolling. Reader mode helps sometimes but it doesn't when the site or the css are really broken. An example: reader mode doesn't work on Mozilla's own bug tracker. Kind of meta bug.
UC Browser apparently has more mobile usage that Firefox in the US. In 2017, they've clocked in at 1.22% vs Firefox's 0.59%.
Years ago, (~2004) I used to use a desktop version years to get around firewalls at my high school. Nowadays I wonder how the Chinese government uses the traffic data to take the temperature of the US.
That's really sad, because Firefox on Android is actually really great and the fact that you can run addons (e.g. uBlock Origin) makes it even better.
In years past Firefox would occasionally crash on me, but I'm not sure it's ever even done that on my current phone, which is closing in on 9 months old. I'm not exactly treating it kindly either, I currently have 93 "tabs" open and though it doesn't keep those in memory it does recall page position even if it has to reload the original source when I go back (based on it putting me at the same point on the page for a week-old HN thread I was skimming through).
There are some addons I'd recommend bypassing on mobile though just for UI reasons - uMatrix, any of the Vim keybinding options, stuff like that. Also, unfortunately the Invert Colors addon doesn't work on Android because of a missing API.
Firefox on Android is becoming ready for prime time just now, until recently it lacked basic functionality that most competitors have, e.g. unless you opted into beta, you still can't organise your bookmarks in folders [1]. So it is understandable that it still has a tiny user base, but at the same time now that critical features have been added I expect it to grow. We should also consider that soon, when version 58 will be out, there should be a significant performance improvement which will help adoption [2].
I really want to use Firefox on my Pixel 2 but the scrolling still feels really chunky compared to Chrome. I hope there's still room for improvement there. I've been really happy with the newer Firefox builds on my MBP.
Firefox 58 should bring some bigger performance improvements still to Android. It's mostly going to bring those improvements to Android that Firefox 57 brought to the desktop, minus the UI and the deprecation of old extension APIs.
Firefox for Android does background playback too, and even provides media controls (exposing play/pause etc through the standard system API). Some sites may need the Video Background Play Fix [0] add-on.
For popping out YouTube videos I use NewPipe, a FOSS Android YouTube client [1].
You can also enlarge the default font size similar to desktop browser. Can not do that on Chrome, Firefox and Safari. Reading this site on UC is much easier on my eyes.
The Accessibility section in the Firefox for Android settings also contains options for adapting pages to the system font size and overriding zoom-blocking. And there's the built-in Reader View which extracts and represents the text from supported pages.
iOS definitely allows you to implement your own browser engine. The only caveat is that Apple doesn’t let third-party apps to mmap executable memory, so you won’t be able to create a JITting JS engine.
Not necessarily worth much these days, but in the early days of Windows 10 on phones when Edge had... issues, UC Browser was one of the only other options available. While MS has technically (mostly?) abandoned Windows Phone, it does still get updates including regular Insider builds and Edge is much better these days.
I'm a little disappointed but perhaps not surprised to see Dolphin Browser missing - before Firefox and Chrome really got there on Android it was a great option including tabbed browsing, plugins including adblocking, and even "Dolphin Jetpack" which was their own updated Webkit engine that Dolphin could use instead of the built in and rarely-updated browser engine on 2.x and 4.x phones.
Dolphin is still going strong. I've been happily using its "lite" version on my old Android 2.2 phone until it (the phone, not the browser) completely broke.
Yeah, I have it installed but haven't actually used it for much of anything in years. I suspect that part of the reason for its continued existence is the hope that one or more carriers in China, India or elsewhere will pick it up for an Android-based phone that doesn't include the Play store.
When there was a possibility that Microsoft was actually going to pull off "Project Astoria" to let Android apps run in some way on Windows Phone, I was actually hoping that Dolphin (with very limited dependency on the Play ecosystem) would be one of the options and would become the de facto alternative to Edge on WP. Google certainly wasn't going to go there and I believe Mozilla had already expressed that they weren't planning on investing much if anything in WP, so Dolphin would potentially have been the one solid Webkit-based browser in the ecosystem.
I've been using UC Browser on my Nexus One for about a year.
It has two killer features:
- It can be installed (unlike Chrome, which never ran on Gingerbread, and Firefox, which I tried before but can now no longer reinstall).
- It renders most pages correctly, unlike the AOSP browser.
It unfortunately does not solve the other major problem with the Gingerbread ASOP browser: that I cannot connect to many modern SSL sites, so I keep Opera Mini around for those. (Opera Mini is otherwise terrible.)
The QQ Browser (QQ浏览器) is also pretty solid. I like its night mode better than UC's, and you can archive pages for offline use. Tencent doesn't seem to be trying to internationalize it as UC is, though.
Those who worry that UC browser is not sticking to standards... not thinking about end users. End users or layman are using it because it is easy and lite.
After a recent update, Chrome is nearly unusable on my spare 1 year old Moto G4 phone. There is a massive lag when I try to type in text on any website.
Chrome's RAM hogging tendencies on desktop have also made me search for an alternative for my PC. Sadly, Firefox is long way from its former glory. Any suggestions?
Have you actually tried Firefox? They've had a pretty big update recently, which also broke many extensions and ways of making advanced extensions, so some people do take that as reason to say that it's now "long way from its former glory", but if you've been a Chrome user up until now, it'd strike me as odd for you to think that, since it's still much more extensible than Chrome.
Well, unless you haven't seen the new update yet and are talking of the performance problems that it had prior to this update. In that case, you should try the new version.
Firefox with uBlock installed gives a much faster overall experience on my device compared to using Google Chrome. Ads have become such a nightmare on mobile sites.
When did you last try it? If it was anything more than a month ago you might want go give it another spin, and/or try a Beta or Nightly build, as the Quantum revamps aren't all enabled yet in the stable channel of the Android edition.
I'm pretty happy with Firefox Focus on a Moto G3. Some people may not like the lack of features in that browser however, e.g. no history, no cookies saved, etc.
> Some people may not like the lack of features in that browser however, e.g. no history, no cookies saved, etc.
That's kind of the point of Focus, it's meant to be a private browser. You can also get regular Firefox with uBlock Origin to have a similar experience with these features, if this annoys you.
I haven't tried opera on android so can't say. I do like the way Brave blocks ads, tracking and 3rd party cookies on a mobile device, something I'm pretty paranoid about
Minor note: the under-the-hood improvements of Quantum will be coming to the Firefox Android version 58. The current stable version only has the UI tweaks.
I don't think you read the article. :) The article specifically talks about smartphones, not feature phones. It mentions how Chrome is an issue for cheaper smartphones with less storage: "The UC Browser app takes up 31 megabytes of space, compared with Chrome’s 125 megabytes". And aside from a smaller app size, UC also compresses data and blocks ads to reduce data requirements (data tends to be expensive in emerging countries).
Let's face it, Chrome is designed by and for people living in the west, where people have smartphones with lots of storage and typically buy monthly plans with unlimited (or large allowance of) data.
I don't think this makes much sense, just looking at China (where I have some insight). You can easily run Chrome (default install) on a <$150 = 1000 RMB phone from Lenovo/ZTE/BLU. Below $100 today performance quickly drops to unusable.
I'm suspicious that the numbers also include non-smart phones, just because of the 430M size, use of the word "mobile", and discussion of a browser from 2004 that predates the iPhone. Further, to the extent that compression is important, I'm suspicious their proxy-compression is a bigger deal for people looking to save money on data (and governments looking to monitor them).
What Google needs to look out for is UC becoming a default App since Alibaba and Alipay are already huge in China, and they could pay for it. Most people don't care about what browser is pre-installed on their phone, if it just works. Of course an Indonesian or Indian company could do this just as well as Alibaba.
I'd assume it's either a proxy browser and not doing much locally or just using Android's WebView; even Opera/Presto towards its end couldn't fit in such a small binary despite targetting tiny devices.
>giving owner Alibaba Group Holding Ltd. an advantage in the race among technology giants to capture the next generation of internet users
...seems suspect. Most western Chrome users started off with Netscape, Internet Explorer, Safari, etc., and then switched when they got better machines and got tech-savvier and realized it was a better browser.
So just because a browser reaches a user first does not, I think, mean it has "capture"d that "generation".
I think you overestimate most people. There’s a reason why IE is still supported on the web. People will continue to use what they know if it isn’t negatively impacting them. Most people don’t use all the extra features in the browser. They just want Facebook to work.
That said, I don’t trust the security of this browser so I don’t think it’s a good thing people are using it.
Several devices I've bought in the last few years (mostly cheap ones of chinese manufacture), did not include Google Play; they mostly encouraged either Aptoide or 1Mobile Market. Heck, that's part of why I keep F-Droid on my phone now.
I don't know why you're getting downvoted. Although UC does make an Android version, they are much better known for supporting Java even if Android comprises more than half of their total users.
Note that it's been banned from the PlayStore as well for inflating installs "with malicious redirect ads":
The one preinstalled on their phone, as long as it has a text field at the top where they can just type where they want to go. Most people don’t give any thought to these things.
Only speculating, but I would guess that "low end" describes a lot (perhaps even the large majority) of phones in active use in China, India and other Asian countries.
It's amazing that we can get portable Linux devices with specs like that for so little money these days. It's a shame that Mediatek doesn't respect the GPL so hackability is low otherwise there would be so many prototype/IOT/research uses for a device like this!
Thanks to MTK datasheet leaks (try finding the docs for Qualcomm or even Broadcom stuff...), and the easy rooting (no locked bootloaders), "hackability" is actually quite high. You can also find the source code pretty easily even if it's not officially released --- a lot of these Chinese smartphones are based on the same hardware with only cosmetic differences.
It was also removed from Google Play Store [3] (although temporarily).
Kinda surprises me to see it as the 'dominant' browser. Maybe people are indifferent.
[0] https://citizenlab.ca/2015/05/a-chatty-squirrel-privacy-and-...
[1] https://citizenlab.ca/2016/08/a-tough-nut-to-crack-look-priv...
[2] https://tech.blorge.com/2017/11/27/uc-browser-believed-colle...
[3] http://www.hindustantimes.com/tech/uc-browser-app-vanishes-f...