Google's mobile development team has had a busy couple days fine-tuning what it likes to call its "iterative mobile Web," a phrase that, in plain English, extends to all the Google sites you can access from some iPhones and Android smartphones.

Earlier, it migrated a better search result for business listings from Google.com for the desktop to Google.com from the phones. On Wednesday, the team rolled out changes to the way it shows image results when you search from some of those two smartphones.

The redesign's objective is to squeeze more thumbnail images onto the page. To do this, Google has made thumbnails square instead of rectangular.

Swiping left and right keeps the header static while advancing through multiple pages of image results. You can also swipe through individual images if you'd rather view them one at a time.

Interestingly, Google has added an intermediate step for viewing image results. Tapping a photo pulls it up on a black backdrop and briefly flashes options to head back to the results page or to view the full-size image, along with a title and source information. The words fade after a few seconds, but be careful: tap the screen in the wrong place and instead of getting your options once again, you may find yourself directed to the source site.

Google's redone mobile image results are available in 38 languages from Google.com on iPhone 3.0 and Android 2.1 smartphones.

Originally posted at Android Atlas

Google issued a course correction for the stable version of Chrome on Wednesday. In addition to JavaScript sluggishness and Java plug-in issues introduced in the previous version, Google also made three critical security patches to its browser.

The last version of Google Chrome stable, version 4.1.249.1059, was using an incorrect path for version 6 update 20 of Sun's Java plug-in. It was also, according to Google, significantly slower than the second-to-last update, version 4.1.249.1045. Both of those have been corrected in the current release.

The three security fixes address a cross-origin bypass in Google URL, memory corruption in HTML5 handling, and memory corruption in font handling. The first and third errors were discovered outside of Google and awarded $1,000 and $500, respectively, for participating in Google's ongoing security bug-finding contest.

The full changelog can be read here.

A useful feature that Google rolled out for the Web last September has just made its way to U.S. Android phones and iPhones.

You might have noticed Place Pages as a newish type of search result that pops up on Google.com, often as the first nonsponsored listing. Connected to Google Maps (and Local search results), a Place Page gathers together key information about a location: the Web site, map, phone number, link to directions, and user reviews.

The mobile version, accessed through Google.com, similarly puts useful info for local businesses at your fingertips. "Local" is the keyword in the clause, and Google should have automatically generated a page for any business that also surfaces in Local Search (if it doesn't, a merchant can claim a Place page through Google Places, formerly the Local Business Center.)

We gave it a go for some of our favorite Bay Area eateries. You'd think that Google's ability to sniff out your location on a mobile phone makes finding and using the feature almost seamless, but we had better luck seeing the Place Page result when we added in our location, for example, "Town Hall SF" rather than just "Town Hall."

Originally posted at Webware

Android users who relish being on the cutting bleeding edge of mobile software are going to love getting their peepers and fingers on Mozilla's latest foray into Firefox for mobile phones.

Late Tuesday, the open-source browsermaker released a prealpha version of Firefox for Android. If beta builds are for testing and feedback with minimal instability for the tester in question, alphas are far less stable elements, and prealphas--well, you get the picture. You should only consider downloading it if you have a high tolerance for crashes and forcing reboots on your Android smartphone--like us! 

Mozilla issues a heap of caveats and considerations to go along with the warning. It has only tested Firefox prealpha for Android on the Motorola Droid and Nexus One, which we just happen to have lying around.  The prealpha won't work on any Android device running an operating system version below 2.0 and it "likely" requires your phone to be OpenGL ES 2.0-capable, according to Mozilla in a blog article.

You must also install it to the phone memory and not to the SD card. The early build of the browser eats memory, may not adequately render large pages, you won't be able to open links from other apps, and there are various other installation punches that you should roll with when previewing the browser.

Hands on Fennec for Android

Sure enough, we ran into problems right away with a black screen of death Mozilla warned about on its blog. We had to force stop Fennec--the development name for Firefox on mobile phone--and reboot the phone before we could play around with the browser.

When we did, we saw that Fennec on Android looks roughly like the first finished version of Firefox mobile for the Maemo platform, including tabbed browsing and the metaphor of swiping left and right on the touch screen to get to the gutters where the settings menu, bookmarks, navigation arrows, bookmarks, and browser tabs live. There are some subtle design differences in Android versus the Nokia Internet devices, mostly in terms of button placement.

Although bright green around the gills, Fennec for Android prealpha already supports Mozilla Weave, the extension that lets you access tabs from Firefox on the desktop as well as the tabs you have open on the mobile browser.

Mozilla includes other extras with the browser, such as being able to set your start page. As with Firefox Mobile for the Nokia Internet devices of its debut, the browser comes with a few plug-ins preinstalled, so you can search Google, Amazon, Twitter, and Wikipedia from the get-go.

We were able to get the experimental version of Weave Sync that's compatible with Fennec for Android prealpha (1.3b2 to be exact) to work; however, its installation process could have been--and we're sure will one day will be--smoother. Still, we were able to access open browser tabs from the desktop once we synced.

Even taking our test experience with a grain of salt--we'll forgive the sluggishness in light of the browser's early development--we did notice page rendering pitfalls, the keyboard popping up when we wished it hadn't, and the critical lack of multitouch support like pinch-to-zoom. Fennec supports only one zoom level when you double-tap the screen. This version of Fennec also doesn't respond to the Nexus One's hardware back button, which means you get to make more trips to the navigation sidebar to navigate.

There's a certain bravery that goes along with making software available to testers at such an inchoate stage, and it's one that's a central tenet in the open-source philosophy of the active feedback loop. Although there are holes aplenty that the team is aware of, we still had a blast seeing the app up and running on an Android phone.

If any of you hardcore Android testers out there try it out, let us know in the comments how you think it's progressing. You can also check out the above video of Firefox for Maemo 1.0 to see where Fennec for Android is headed.

Originally posted at Android Atlas

A security researcher has discovered that any wireless network can pretend to be an AT&T Wi-Fi hot spot and thus lure unsuspecting iPhone users to an untrusted network connection.

Samy Kamkar, who created a worm that garnered him a million friends on MySpace overnight in 2005, said in an interview this week that he can hijack any iPhone within Wi-Fi range in what is often dubbed a "man-in-the-middle" attack because of the way the devices are configured to recognize AT&T Wi-Fi connections merely by the name "attwifi."

Typically, an iPhone will look for a specific MAC address--the unique identifier for the router--to verify that the wireless network is a device a user agreed to join previously. However, if the iPhone has previously connected to any one of the numerous free AT&T Wi-Fi hot spots (offered at virtually every Starbucks in the U.S., for example) the device will ignore what the MAC address says and simply connect to the network if it has "AT&T Wifi" attached, Kamkar said.

"The iPhone joins the network by name with no other form of authentication," he said.

Kamkar said he made this discovery recently when he was at a Starbucks and disconnected from the AT&T Wi-Fi network.

"I went into the settings to disconnect and the prompt was different from normal," he said. "I went home and had my computer pretend to be an AT&T hot spot just by the name and my iPhone continued to connect to it. I saw one or two other iPhones hop onto the network, too, going through my laptop computer. I could redirect them, steal credentials as they go to Web sites," among other stealth moves, if he had wanted to.

To prove that a hijack is possible, Kamkar wrote a program that displays messages and can make other modifications when someone is attempting to use the Google Maps program on an iPhone that has been intercepted. He will be releasing his hijacking program via his Twitter account: http://twitter.com/samykamkar.

Kamkar hasn't attempted the hijack on an iPod Touch, but plans to determine whether it has the same vulnerability.

iPhone users can protect themselves by disabling their Wi-Fi, or they can turn off the automatic joining of the AT&T Wi-Fi network, but only if the device is within range of an existing AT&T hot spot, Kamkar said.

Asked for comment an Apple spokeswoman said: "iPhone performs properly as a Wi-Fi device to automatically join known networks. Customers can also choose to select to 'Forget This Network' after using a hot spot so the iPhone doesn't join another network of the same name automatically."

Kamkar, an independent researcher based in Los Angeles, first made a name for himself by launching what was called the "Samy" worm on MySpace in order to see how quickly he could get friends on the social-networking site. The cross-site scripting (XSS) worm displayed the words "Samy is my hero" on a victim's profile and when others viewed the page they were infected.

He served three years of probation under a plea agreement reached in early 2007 for releasing the worm.

Originally posted at InSecurity Complex