A more honest “Like” button. Image: Webmonkey.

Designers tend to hate them, calling them “Nascar” buttons since the can make your site look at little bit like a Nascar racing car — every available inch of car covered in advertising. Others think the buttons make you look desperate — please, please like/pin/tweet me — but there’s a much more serious problem with putting Facebook “Like” buttons or Pinterest “Pin It” buttons on your site: your visitors’ privacy.

When you load up your site with a host of sharing buttons you’re — unwittingly perhaps — enabling those companies to track your visitors, whether they use the buttons and their accompanying social networks or not.

There is, however, a slick solution available for those who’d like to offer visitors sharing buttons without allowing their site to be a vector for Facebook tracking. Security expert (and Wired contributor) Bruce Schneier recently switched his blog over to use Social Share Privacy, a jQuery plugin that allows you to add social buttons to your site, but keeps them disabled until visitors actively choose to share something.

With Social Share Privacy buttons are disabled by default. A user needs to first click to enable them, then click to use them. So there is a second (very small) step compared to what the typical buttons offer. In exchange for the minor inconvenience of a second click, your users won’t be tracked without their knowledge and consent. There’s even an option in the preferences to permanently enable the buttons for repeat visitors so they only need to jump through the click-twice hoop once.

The original Social Share Privacy plugin was created by the German website Heise Online, though what Schneier installed is Mathias Panzenböck’s fork, available on GitHub. The fork adds support for quite a few more services and is extensible if there’s something else you’d like to add.

Google+ Sign-In on Fitbit.com. Image: Google.

Google has announced a new feature for Google+ — third-party websites and applications can now offer sign ins through Google+.

The new Google+ Sign-Ins are essentially Facebook Connect for Google+, allowing you to not only sign-in to sites that support it, but also bring your Google+ profile data with you around the web.

The new Google+ Sign-In service will make it easier to share content from third-party sites (and within mobile apps). Exactly who will see the items you share on Google+ depends on the level of access you grant to an app, but in general you can share data with specific people on Google+, certain circles, or no one.

Here’s Google’s description of the actual sign-in process:

If you sign in to Gmail, YouTube or any other Google service, you can now use your existing credentials to sign in to apps outside of Google. Just review the Google+ permissions screen (outlining the data you’re sharing with the app, and the people who can see your activity), and you’re all set.

Google+ Sign-Ins aren’t just for web apps either — Google is pushing them for mobile apps as well. Starting today, when you sign in to a website with Google, you can install its mobile app on your Android device with a single click.

Google is also claiming that, because you can choose who to share things with, that it will mean less “social spam.” The Google+ Developer Blog even calls out Facebook’s “frictionless” sharing by name, saying “Google+ doesn’t let apps spray ‘frictionless’ updates all over the stream, so app activity will only appear when it’s relevant.” Of course one person’s “relevant” content is another’s spam, so take that claim with a bucket or two of salt.

Items you share from sites and apps using Google+ Sign-In show up as a slightly different “interactive” post in your friends’ Google+ stream. Clicking on these items will lead them to the app where they can listen to or buy or review the item you shared.

If you want to add Google+ Sign-In to your site or app, head on over to the new developer site and read through the documentation.

Facebook is in your Firefox (but only if you want it). Image: Screenshot/Webmonkey.

If you’d like to test out Firefox’s new Social API features, head over to the beta channel downloads page and grab the latest release. Then point your browser to Facebook, which will prompt you to install the Facebook Messenger for Firefox.

If you don’t visit Facebook you’ll never know the new Social API exists.

That’s exactly as it should be, according to Mozilla’s Johnathan Nightingale, senior director of Firefox engineering. I spoke to Nightingale ahead of the Social API release and he stressed that the Social API is entirely opt-in by design. “Our plan is not to push anyone into something they don’t want, but to make

The new Social API can be seen as an extension of the App Tabs Mozilla added to Firefox 4. The App Tabs feature recognizes that all tabs are not equal. Some tabs, like e-mail, document editors or news feeds are easier to use when they get a special spot in your browser. The Social API extends that idea even further, bringing social websites out of tabs completely and into a persistent sidebar that you can access without the need to switch tabs or log in.

“Social is not like other things that people do on the internet,” says Nightingale, “it runs as a current through everything they’re doing.” The Social API is designed to make it easier to stay in that current even while you’re visiting other sites. For example, Facebook Messenger for Firefox adds a sidebar that is visible even when you switch tabs. It’s easier to keep up with what’s happening because you see updates rolling in even when you’re browsing other sites. Since constant Facebook updates are annoying when you’re trying to get work done, there’s also a way to hide the sidebar until you want it again.

Facebook’s Social API implementation also adds a “like” button to the address bar, which means you can share a page with your friends on Facebook without leaving that page, which is great for sites that don’t offer their own social sharing buttons.

The Firefox Social API consists of a manifest file and few URLs, but the user interface, the features offered and all the other details are up to the social site itself. For now that’s just Facebook, but Nightingale says Mozilla will add more support for more providers, and eventually even for multiple social sites at once. The idea is to make it easy for any site to build on the Social API, much like the OpenSearch API did for custom search engines.

If you don’t use Facebook there’s nothing to see right now. However, after playing around with the new Facebook Messenger it’s not hard to imagine how other sites might do something similar. Twitter is an obvious example, but the Social API is not limited to just “social networks.” For example, GitHub could create a sidebar with, say, all your project updates and pull requests.

The privacy implications of giving social networks a cozier spot in your browser may make some people nervous, but Tom Lowenthal, of Mozilla’s Privacy and Public Policy team, assures users that nothing has changed regarding your data. “Once enabled, Firefox loads several pages from your social network over secure connections,” writes Lowenthal, “These pages are treated just as if you’d loaded them in another browser tab.”

That means Facebook can set cookies and collect data just like it would if you were logged into the site, but neither Facebook, nor any other social network that builds something with the Social API, will get any special treatment or additional data from Firefox. In other words, just because Facebook is persistent in the sidebar doesn’t mean it has access to any additional information from your browser.

If you’re always logged into Facebook anyway, the new Facebook Messenger for Firefox makes for a smoother, more compelling social network experience. It’s also easy to back out of should you end up disliking it. Those looking for something similar from another social network will just have to wait for those networks to build out their own Social API offerings.

A coalition of 30 technology companies hopes to turn the web into a competitive platform for building mobile applications. They have launched a Core Mobile Web Platform (coremob) community group through the W3C to provide a venue for collaborating on next-generation mobile web standards.

Facebook and Mozilla are among the leading members of the group. In an announcement today, Facebook discussed its motivations for participating. The social networking company says users who access Facebook through the mobile website outnumber the collective audience of all Facebook’s native mobile applications.

Facebook consequently wants to ensure its mobile website matches the quality of the experience users get from the native applications. In order to make that possible, open web standards will have to evolve to offer tighter device integration.

Mozilla has been pursuing that goal with its WebAPI project. That has introduced new JavaScript APIs allowing web content to access underlying hardware components and platform functionality, such as the cameras and cellular radio. As we recently reported, Mozilla is using those new APIs in the Open Web Devices (OWD) platform, a mobile operating system that is based on the organization’s Boot2Gecko project.

Mozilla is also working through W3C to turn the APIs into open standards so they can be supported by other browser vendors. The coremob community group will provide a means for mobile web stakeholders to discuss their technical requirements and help shape the emerging standards.

Facebook also announced the release of Ringmark, a test suite for evaluating the capabilities of mobile web browsers. The tests will help developers make informed decisions about what features they can safely use in various mobile web environments. Facebook hopes such information will help developers contend with the highly fragmented mobile web browser landscape.

The Core Mobile Web Platform community group has announced Ringmark, a test suite for evaluating the capabilities of mobile Web browsers.

The tests consist of two separate “rings” which represent sets of standard web features. The inner ring focuses on fundamentals like support for HTML video, native JSON parsing, CSS animation, and the Canvas element. The second ring includes a broader feature set, such as fullscreen support, touch events, and the device orientation APIs. I ran the test suite on an iPhone 4S, which passed all of the tests in the first ring and 229 of the 306 tests in the second ring.

In addition to Mozilla and Facebook, the coremob community group also includes major mobile network operators, hardware manufacturers, mobile platform vendors, and other web companies. The lineup includes AT&T, Verizon, Samsung, HTC, Nokia, Intel, Microsoft, Opera, Adobe, Netflix, Zynga, Sencha, among others. Conspicuously absent from the list: Apple and Google.

This article originally appeared on Ars Technica, Wired’s sister site for in-depth technology news.

A worm previously used to commit financial fraud is now stealing Facebook login credentials, compromising at least 45,000 Facebook accounts with the goals of transmitting malicious links to victims’ friends and gaining remote access to corporate networks.

The security company Seculert has been tracking the progress of Ramnit, a worm first discovered in April 2010, and described by Microsoft as “multi-component malware that infects Windows executable files, Microsoft Office files and HTML files” in order to steal “sensitive information such as saved FTP credentials and browser cookies.” Ramnit has previously been used to “bypass two-factor authentication and transaction signing systems, gain remote access to financial institutions, compromise online banking sessions and penetrate several corporate networks,” Seculert says.

Recently, Seculert set up a sinkhole and discovered that 800,000 machines were infected between September and December. Moreover, Seculert found that more than 45,000 Facebook login credentials, mostly in the UK and France, were stolen by a new variant of the worm.

“We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims’ Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware’s spread even further,” Seculert said. “In addition, cybercriminals are taking advantage of the fact that users tend to use the same password in various web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.) to gain remote access to corporate networks.”

Facebook fraud, of course, is nothing new. Facebook itself has acknowledged seeing 600,000 compromised logins each day, although that accounts for just 0.06 percent of the one billion Facebook logins each day.

This article originally appeared on Ars Technica, Wired’s sister site for in-depth technology news.

Earlier this year, the Firefox add-on Firesheep created quite a controversy by making it easy to capture unencrypted web traffic.

Firesheep sniffs unencrypted cookies sent across open wi-fi networks. That means anyone with Firesheep installed can watch your browsing sessions while you lounge at Starbucks and grab your log-in credentials for Facebook, Twitter or other popular sites. Armed with those credentials, anyone using Firesheep can essentially masquerade as you all over the web, logging in to other social sites, blogs and news sites using your Facebook or Twitter username and password.

None of Firesheep’s mechanisms are new. But Firesheep made sniffing web traffic point-and-click simple — it was suddenly dead easy to do something that used to require a good bit of hacking knowledge.

The best way to protect yourself from Firesheep is simply avoid connecting to unencrypted sites when you’re on an open wi-fi network. That means making sure that you connect over HTTPS rather than HTTP everywhere you surf. But sadly, doing so is complicated and depends on which site you’re trying to connect to.

That’s where the Electronic Frontier Foundation’s HTTPS Everywhere Firefox add-on comes in. The extension makes it easy to ensure you’re connecting to secure sites by rewriting all requests to an HTTPS URL whenever you visit one of the sites it supports.

Of course if the website you’d like to visit doesn’t support HTTPS, there’s nothing the add-on can do, but for many big sites — Twitter, Facebook, Google, PayPal, The New York Times, Bit.ly, Amazon — HTTPS Everywhere automates the process for you.

With HTTPS Everywhere installed, if you type “twitter.com” in the Firefox URL bar, the browser will automatically connect to https://twitter.com rather than http://twitter.com.

That’s a good start, but it won’t completely protect you from anyone sniffing with Firesheep. The latest beta release of HTTPS Everywhere, released over the long weekend, improves the add-on’s protection against Firesheep, but you’ll need to do some extra stuff.

First, head the HTTPS Everywhere preferences (Tools -> Add Ons -> HTTPS Everywhere -> Preferences) and check the “Facebook+” rule. Then install the Adblock Plus extension and use it to block the insecure http:// advertisements and tracking sites that Facebook (and other sites) sometimes include. There are more instructions on the EFF’s site.

Now you can browse Facebook at the coffee shop in relative peace. Certain parts of Facebook may not work properly — some applications can’t use HTTPS, and the chat app won’t work — but at least you aren’t broadcasting your login credentials to anyone who wants to listen. The EFF says it has alerted Facebook to the incompatibilities, and that it’s waiting for Facebook to fix them.

See Also:

• Gmail Now More Secure With OAuth Support
• Google Chrome Beta Adds Privacy and Content Controls
• EFF Reveals How Your Digital Fingerprint Makes You Easy to Track

The rumor mill has been buzzing for months about the imminent arrival of a new “Facebook browser” called RockMelt.

Well, it really does exist, and it’s here. RockMelt is being released as a limited public beta Sunday. Anyone can sign up to test it out, but the release will be throttled so as not to overload the cloud-based components of the app. RockMelt will be doling out download links as quickly as it can manage on a first-come, first-served basis.

The two founders, CEO Eric Vishria and CTO Tim Howes, demonstrated RockMelt to Wired a few days before Sunday’s launch.

It’s based on Chromium, so it inherits Google Chrome’s speed, looks, and basic functionality on both Mac and Windows.

And while its Facebook integration runs deep, RockMelt is not exactly a Facebook browser. It’s a social web browser, allowing you to post links, videos and status updates to both Facebook and Twitter (that’s it for now, but more services will be added later). There are also built-in clients for consuming your Facebook feed and managing multiple Twitter feeds, a chat client, and lightweight RSS reader. It does use your Facebook account to personalize the experience, but its reach is broader than just Facebook.

We’ve seen browsers custom-built for the social web before, most notably Flock, which launched as a MySpaced-up version of Firefox. Mozilla experimented with Ubiquity, an in-browser tool for posting to different social sites and interacting with web services. There are a number of add-ons that can embed social networking dashboards into the browser for you. These tools have grown in popularity as we’ve struggled to manage the ever-increasing flow of links, media and bits shared by our online friends.

So, the idea isn’t original. And RockMelt doesn’t sport a complete re-invention of the browser interface, either. But it is very streamlined, and there are some key elements that people who live and breathe the social web will find intriguing.

First of all, you log in to RockMelt before you use it. You authorize the browser to connect to your Facebook account, and the browser is instantly customized for your social circle, showing your friends and your favorite sites in slim sidebars — or “edges,” to use the RockMelt parlance.

The edge on the left has your picture at the top, and the friends you interact with the most appear in a list below you. To send a new tweet or to update your Facebook status, you click on your picture. To send your friend a message or start a new chat with them, click on their photo. You can also share things by grabbing an image or video on the web page and dragging it on top of your friend’s icon.

The edge on the right has small icons for each of the services RockMelt tracks for you (only Facebook and Twitter for now) as well as spaces to add RSS feeds from your favorite sites.

The “edges” aren’t intrusive — they are less than 50 pixels wide each — but they do add extra visual heft.

“You can’t forget you’re a browser, and you can’t get in people’s way,” says RockMelt CEO Eric Vishra. “We designed these edges to be very thin, to be there when you want, and to blend in when you don’t.” You can also dismiss them with hot keys.

Clicking on one of the icons in the right edge — either Twitter, Facebook or a website icon — brings up a little pane that shows recent posts and activities from that source. Following the “keep things out of the way” philosophy, these panels can pop out from the browser to float freely if you want.

All of your user data is stored in the cloud by RockMelt (on Amazon servers) and synced when you log in, so no matter whose copy of RockMelt you’re using, you see your own custom version of the browser. Others are moving in this direction, too — Chrome connects to your Google account and Firefox has an agnostic Account Manager. But RockMelt’s Facebook integration is central to the experience.

RockMelt is polling Facebook, Twitter and your favorite sites periodically to check for updates (There’s no Firehose or PubSubHubbub magic yet, the founders tell us). But the feeds are real-timey enough. Updates show up in under a minute, often less. The updates are collected by the cloud service and pushed down to the browser.

There’s also a big “Share” button at the top of the browser. Clicking this button opens up an all-purpose sharing window, so you can tweet a link, post something to your Facebook wall or send the link as a message to a friend. Not a huge innovation, as we’ve seen something similar in Flock, but it’s nice.

Lastly, when you use the web search box in the browser, you get another floating window pane that shows the top ten search results. You can click (or navigate with keys) through this list, and the results flip by in the main browser window. RockMelt starts pre-fetching and rendering each one of those ten search results as soon as they show up (with Flash blocked). When you click through the list, you’re seeing real web pages, not snapshots, and you don’t have to wait for the individual pages to load. It’s wicked fast, like flipping through a stack of cards. It sounds bandwidth hoggish, but the browser calculates how much pre-fetching your connection can handle and adjusts accordingly.

Those are the big features. But let’s consider for a moment the elephant in the room: RockMelt is very, very Facebooky. It uses Facebook to sign you in, the in-browser chat experience is built on Facebook Chat, and when you share something via a message, you’re sending them a Facebook mail.

The founders say there are investigating other login experiences, like Twitter sign-in or OpenID logins using Google, Yahoo or AOL accounts.

“We’re going to remain agnostic and pick the services that the most people want to use,” Vishra says, but the team decided to “go deep” on Facebook simply because of the site’s size and volume.

Although it’s disappointing to see that the browser doesn’t play as well on the open web as it does on Facebook’s web, the tight focus makes sense for a young browser trying to gain a foothold in the mass market: Go drop your line where the fish are biting.

The downside being, of course, that if you’re not a Facebook person, RockMelt isn’t as interesting. I could see it being useful for Twitter power users who have a Facebook account, even if they don’t use Facebook heavily. But if that’s your angle, RockMelt’s chat and messaging features, which are based entirely on Facebook, are nothing more than food coloring.

See also:

• New Flock Is Simpler, Now Based on Chrome
• Mozilla Gets It Right, Moves Identity Management Into Firefox
• New ‘OpenID Connect’ Proposal Could Solve Many of the Social Web’s Woes

If you’ve ever wanted to archive your social network activity, store in your own database and pull all sorts of interesting visualizations out of it, then the new ThinkUp app is what you’ve been waiting for.

ThinkUp is one part metrics app — tracking which of your posts are most popular, for example — and one part cross-network aggregator. It offers features you won’t find on Twitter or Facebook, like a detailed “conversation view” of exchanges with other users. ThinkUp also acts as a backup for your social network data, pulling it into your own database. It even offers CSV files for creating your own spreadsheets.

Since it archives all of your activity, ThinkUp is an especially useful tool for those of us who like to maintain control over our own data. It takes stuff that would otherwise only live in the various networks’ silos and copies it to a database where we’re the administrator. So if we want to ditch Twitter or Facebook in some distant future where those companies start acting against our best interests, we don’t lose the massive stores of updates, links, photos and, most importantly, friend relationships we’ve already set up. And in the meantime, it lets us have fun with all the data it’s archiving.

Although ThinkUp is still a beta release, we took the code for a spin and found it to be stable enough to be useful. At the moment, it only supports Twitter and Facebook data, but ThinkUp plans to add additional social networks in the future, including LinkedIn, Flickr, YouTube and Google Buzz. If you’d like to try out the limited beta, head over to Github and grab the code. You may notice it’s a project published by Gina Trapani, the former Lifehacker editor who is now an independent author, blogger and programmer.

Installing ThinkUp is a bit like installing WordPress on your own server — you’ll need a MySQL database, PHP 5 and a public URL (at least to start, Twitter’s new OAuth system requires a public callback). A full list of system requirements can be found on GitHub.

Once you’ve unzipped and uploaded the code, just visit the URL where you plan to use ThinkUp and an automated install script will walk you through the installation process, just like WordPress. The only snag we hit was that our server didn’t support PHP’s mail() function, so we never got a confirmation e-mail. The solution is pretty simple: just head into MySQL and mark your user as confirmed.

Once you’re up and running, ThinkUp is pretty simple to use. It wraps your myriad of data in a nice-looking interface. Some of the information ThinkUp gives you for Twitter is available in the new Twitter interface, but there’s plenty of extra stuff that make ThinkUp worth having.

ThinkUp's conversation view

The big feature here is that ThinkUp tracks all of your Twitter interactions, showing your most replied-to posts, your most re-tweeted posts and, my personal favorite, threaded conversations with other Twitter users. But it also tracks everything your followers do as well. For example, ThinkUp catalogs all the links and images your followers have posted, displaying them all in one place.

See all your follower's posted images in a single view

There are dozens of features, like charts and graphs showing post counts, follower counts and @replies over time. You can also view all of your followers or friends on a Google Map.

While ThinkUp puts a tremendous amount of data at your fingertips, it manages to keep the interface simple enough that it’s never overwhelming. In fact, it can offer some insight into both how you use Twitter and how you might get more out of it.

If you’ve ever wondered why some of you posts are more popular than others, ThinkUp offers a window on what your followers like, how they respond to your posts, and how quickly they respond. ThinkUp is especially useful if you often post questions of your followers. Because responses tend to trickle in over time, finding them all can be difficult given the speed of Twitter. Thanks to the conversation view, ThinkUp makes it easy to see your question and everyone’s response in a single view.

As should be apparent when you set it up, ThinkUp is an entirely modular app — everything is a plugin. That means anyone can write plugins and expand the functionality of ThinkUp. At the moment, there doesn’t seem to be repository of outside plugins. But should the app take off, we expect something of the sort will be available.

ThinkUp is still clearly a beta release and a little rough around the edges. Its biggest downfall is a lack of user documentation. There is however, great documentation for developers looking to extend the app. But even at this early stage, ThinkUp is well on its way to becoming a must-have tool for social media addicts — albeit ones with access to a personal web server and the smarts to use it.

See Also:

• Take a Tour of the New Twitter
• Twitter Moves to OAuth: The OAuthcalypse Is Nigh
• Using the Twitter API