There's been a lot of talk about storing our media in "the cloud" over the past few years, but not a lot of action. We've seen start-ups such as mSpot and MP3tunes tackle the music locker idea while options like SugarSync and Dropbox lure users looking for more general file backup solutions. Still, no one yet has been able to push a cloud storage service into the mainstream. With Cloud Drive, Amazon.com is hoping to change that.

The online megastore's Cloud Drive online storage service starts with a free 5GB base plan that can be increased to 20GB, 50GB, 100GB, 200GB, 500GB, and 1,000GB, priced at $1 per gigabyte, per year (so that a 100GB plan costs $100 per year). For a limited time, customers who purchase an album from Amazon's MP3 store are automatically upgraded to a 20GB trial account for one year.

What do you get?
The promise of a product like Amazon's Cloud Drive is that you can upload all of the precious media files from all of your computers and devices (home, work, phone) to one common place, so that you're never stranded without access to your digital media.

Aside from Amazon's handy cross-platform uploader and downloader utilities and its browser-based tools for viewing, downloading, and streaming your stuff, Amazon is also throwing in a Cloud Player feature within the Amazon MP3 application for Android. Using the free app, you can stream all the music you have stored in the cloud, or download your tracks on the fly for offline playback.

How does it work?
Once you've chosen your plan on Amazon's site, you'll be prompted to download and install an MP3 Uploader tool that runs within the Mac- and PC-compatible Adobe Air platform (a separate download if you don't already have it). After Amazon's software is installed, it will run a quick scan of your drive, report on how many music files you have available to upload, and show you how much storage is available with your current plan.

If you don't have room for your whole collection, you can use the software to manually select which artists, songs, or playlists you'd like to upload.

After uploading, you can navigate through your music collection using Amazon's browser-based Cloud Player. Similar to the music locker interfaces we've seen from mSpot and MP3tunes, the Amazon Cloud Player allows you to sort your collection by song, artist, album, or genre by selecting from the intuitive sorting options in the left column. A listing of uploaded playlists is also displayed below the main sorting options. We were happy to see that the Amazon uploader tool was able to digest our iTunes playlists, including Smart Playlists and Genius Playlists.

A big play/pause button and track skip, shuffle, loop, and volume controls are lined up across the bottom of the player, proving easy, friendly controls for playback.

To get your music back down from the cloud and onto a computer, you have two options. One way is to manually select any Cloud Drive file or folder and click the download button located above the file list. If the file you're downloading is music, you may be prompted to download Amazon's Adobe Air-based MP3 Downloader app, although you probably already have this if you've downloaded music from Amazon before.

The second way to retrieve your music is to set it up automatically under the Cloud Player's settings menu. Here you'll find a check box that will direct the MP3 Downloader tool to automatically download any new music in your Cloud Drive to your computer. The setting is computer-specific, so it's possible to set things so that only your home computer will download new Cloud Drive music, leaving your work computer uncluttered, for example. It's a useful feature, and we're glad to see that Amazon included it.

Unfortunately, Amazon doesn't handle other types of files as elegantly as music. When you back out of the Cloud Player into the general Cloud Drive browser, you'll find folders for documents, pictures, and videos, in addition to music. Non-music files must be selected and uploaded through a browser pop-up window, instead of using the more elegant and automatic MP3 Uploader tool. Once uploaded, your files are organized generically as a hierarchical tree of files and folders. You have the option to copy, move, download, and delete these files--but that's it.

There are no options to share content, and no pretty photo views, and video playback is handled by your browser. Common cloud backup features such as folder monitoring and background uploading are also absent. In short, Amazon has a ways to go before Cloud Drive is a full-featured online backup solution.

Why is this important?
First and foremost, Cloud Drive is a free method for consolidating music collections that have been strewn across multiple computers and devices. There are similar products out there, but Amazon's scale, the breadth of its storage plans, and the popularity of its MP3 store will make Cloud Drive the service to beat in the music space.

From an industry perspective, the introduction of Cloud Drive and its ties into the Amazon MP3 store amount to a big competitive advantage over other music download stores, most notably Apple's iTunes store. Amazon is effectively guaranteeing a backup of your MP3 purchases at no cost, which is a big incentive to go with Amazon over Apple.

What's missing?
As a music storage and management package, Amazon's Cloud Drive and Cloud Player combination is easy to use and easy to recommend. There are some holes in the music service, such as limited format support (strictly unprotected MP3 and AAC), the somewhat dry user interface, a reliance on the Adobe Air platform, and the lack of an iOS app. If and when Apple comes out with something similar, it will likely run within iTunes, dovetail with iOS devices such as the iPhone, iPad, and iPod Touch, and support Apple's lossless audio format.

The biggest disappointment is how Amazon handles storage of non-music files. There are dozens of services out there that are more adept at intelligently archiving and organizing photos, documents, and videos. The uptime reliability of Amazon's servers is nice, and the plan pricing is competitive, but services such as SugarSync and Dropbox are better tools when it comes to routinely backing up critical files and folders.

Final thoughts
For music fans, Amazon's Cloud Drive and Cloud Player get an unqualified thumbs-up from us. The price is right, the interface is simple, and if you're already a fan of Amazon and its MP3 store, then it's a slam dunk. If what you want to do is automatically back up files other than your music collection, there are better products and services for that out there.

Popular video enthusiast site Vimeo.com does not have the same level of viewership as YouTube, but it's definitely a great place to find interesting user-made videos. Today, Vimeo released a free iPhone app that lets you bring the video site with you on the go, but it lacks one very important feature.

Vimeo for iPhone (free) lets you join up with the site or log in within the app so you can upload, edit, and view videos on your iPhone. It comes with many of the popular Vimeo user-requested features like the Inbox, the ability to Watch Later, and Vimeo's selection of Channels. The interface uses buttons across the bottom of the screen, letting you browse your finished videos in My Videos, flick through your current projects in Recordings, and look at videos you previously "liked" in My Stuff. There's also a place to Browse Vimeo videos and look at your account information.

When you want to make a video of your own, simply hit the My Videos button and create a new video using your iPhone camera or choose an existing video from your library. From there you'll be able to edit the video for length, join video clips together with some simple transitions, add audio (the Vimeo app offers some samples, but you can also use your music library), and add a title to your project.

In our testing, whether we were watching regular or HD videos, the Vimeo for iPhone experience was incredibly smooth. We were able to browse videos by category and flick through several submissions. The one feature that's not available is the ability to search for videos at the Vimeo site, but the folks at Vimeo pointed out that they made sure to get many of the traditional Vimeo features like Watch Later and Channels into this version first and will be adding search hopefully in the next release.

Overall, Vimeo for iPhone is an excellent way to check out the popular video Web site's content with many of the features Vimeo users have come to love. Once Vimeo adds search to this well-made app, it will be the ideal app for browsing Vimeo.com.

After some real-world tests, Microsoft has concluded IE9 is the most energy-efficient of the major browsers on the market.

Microsoft compared its new browser with Opera 11, Firefox 4, Chrome 10, and Safari 5 on an Intel laptop, measuring how many watts the machine consumed with the browser idling, showing a news site, and running graphics-intensive Web tests.

The upshot: IE9 is the most efficient in the test, meaning it'll take the smallest toll on the battery.

"We hope and encourage the industry and other browser vendors to follow us on the path to a more power efficient Web," said Walter VonKoch, Matthew Robben, and Jason Weber, three Microsoft personnel involved in power and performance matters.

There's plenty wiggle room in the study, of course--your mileage may vary in any number of ways. The tests were on Windows 7--but how does Safari fare on a Mac? IE9 has lots of hardware acceleration features that can reduce power consumption--but Firefox 4 and later other browsers offer some hardware acceleration on Windows XP, too. Microsoft's selection of Web sites may not represent the sites where you actually spend time. Different computers have different power consumption and power-saving characteristics. And of course in the real world, most people run more software than just a browser.

But the results are valuable nonetheless. I applaud Microsoft for setting up a test and for caring about power consumption.

It makes sense to cut power usage from an environmental and financial perspective, needless to say, but better battery life is more important for the average person. Students moving around campus and traveling businesspeople don't always have the luxury of a power outlet on hand.

Originally posted at Deep Tech

For Android devotees, Mozilla's issuance of Firefox for Android has been a long wait. Sure, the browser maker added it to the Android Market in beta form months ago and made the release candidate (RC) available last week.

However, today marks the first that the app is available in full, unfettered by qualifications that mark it a prerelease product prone to bugs and subjected to rigorous user testing.

In other words, the app is done.

I gave my hands-on impressions of the faster, better-designed RC version of Firefox 4 for Android (and Maemo) last week, and my colleague Seth Rosenblatt will be back with his own hands-on take, including the results of several benchmarking tests.

In the meantime, try out the free browser for yourself, and let us know what you think--did Mozilla take the lid off just in time, or does Firefox for Android still need some finishing touches?

Originally posted at Android Atlas

For all the tens of billions of dollars a year spent on Internet security a year, on everything from antivirus software to intrusion prevention, there's one component that's vital but remains obscure: which Web sites browsers decide to trust.

Each of the major browser makers has compiled a different list of who possesses the master keys to Web authentication--namely, who can be trusted to issue the secure digital certificates to create encrypted channels--and each has different procedures for approval. A closed lock icon typically appears in a browser and an "https://" connection is displayed when a Web site is deemed legitimate.

The flaws in this system were thrown into sharp relief by last week's revelation that a hacker traced to Iran obtained fake digital certificates for Google, Yahoo, Microsoft, and other companies. Comodo, a Jersey City, N.J.-based firm, said it revoked the nine certificates as soon as it discovered the breach in a business partner's systems.

Today's system gives browser makers tremendous responsibility. Any list of so-called certificate authorities they include will be trusted by billions of Web browsers around the world, unless users take the time to change the settings. The surprise is, perhaps, that the lists of who's trusted aren't the same.

"Microsoft appears to generally trust a much larger set of certificate authorities than Mozilla does," says Peter Eckersley, senior staff technologist at the Electronic Frontier Foundation. "That may be because Microsoft's criteria are easier to meet in practice, or because certificate authorities prioritize getting onto Microsoft's list first."

Mozilla ships Firefox with a list of about 150 trusted certificate authorities. The list included with Microsoft Windows, used by Internet Explorer, totals 321 as of last week.

Opera includes only 37. Apple's OS X operating system, which Safari relies on, trusts 79 certificate authorities. Google says Chrome uses the Windows or OS X lists; Google Checkout trusts 168. (See CNET's spreadsheet with comparisons.)

It's difficult to compare those numbers directly, though, because some certificate authorities are counted multiple times. VeriSign appears 55 times in Microsoft's list based on different types of products offered but only once in Opera's, for instance.

Microsoft explicitly trusts more government-operated certificate authorities than any other browser maker. The list includes: Brazil, Hong Kong, India, Japan, Latvia, Lithuania, Serbia, Slovenia, the United States, Tunisia, Turkey, Uruguay, and Venezuela.

Another complicating factor is that some browsers download updated lists of "root" certificate authorities as needed.

Opera's default "list starts out with a limited number of frequently used certificates," says Yngve Pettersen, a senior developer at Opera Software in Oslo, Norway. "The remainder are downloaded as needed from certs.opera.com when the user actually visits a site issued from a root...We pre-ship some roots and also some intermediates, while others are downloaded dynamically."

What makes the list of trusted certificate authorities crucial is that each possesses the master keys to Web authentication. Companies like Etisalat, a wireless carrier in the United Arab Emirates that implanted spyware on customers' BlackBerry devices, can generate certificates that can be used to impersonate any secure Web site on the Internet. So do more than 100 German universities, the U.S. Department of Homeland Security, and random organizations like the Gemini Observatory, which operates a pair of 8.1-meter-diameter telescopes in Hawaii and Chile.

A fraudulent certificate would allow a network provider (or a government) to use what's known as a man-in-the-middle attack to impersonate the legitimate sites and grab passwords, read e-mail messages, and monitor any other activities on those Web sites, even if browsers show that the connections were securely protected with SSL encryption. And in the last few years, plenty of other techniques have emerged to trick computers into visiting fake Web sites even without control of the network.

Microsoft says it included the Tunisian government as a trusted certificate authority after it went through the normal application process.

"Microsoft requires that certificate authorities applying to the program provide standardized information," says Bruce Cowper, Microsoft's group manager for trustworthy computing. Tunisia applied in 2006, he said, and its certificate was distributed in February 2007. Venezuela applied in September 2010, and was approved a month later.

Cowper declined to provide information about how many companies, organizations, or governments have failed to pass muster, saying "Microsoft does not share specific information about denied applications, but we do reject applications from certificate authorities who don't meet our criteria (or) fall into one of the named exclusions from the program." Microsoft's specifications say that any certificate authority that fails an audit, for instance, will be given the boot.

If a certificate authority "isn't in our list it is either because they have not asked to be included, or have not yet been approved," says Opera's Pettersen. "So far, I don't think we have refused any certificate authorities that have applied." Neither Tunisia nor Venezuela have sent Opera an application to be included, he said.

Neither Apple nor Comodo responded to requests for comment.

While both Microsoft and Opera make their criteria public, Mozilla goes further and even makes the list of pending applications public. Those include a certificate authority operated government of the Valencia region of Spain and Deutscher Sparkassen Verlag GmbH, the world's largest smartcard provider.

As a result of the Comodo breach (Comodo is currently trusted by all the major browsers), there's been talk among Mozilla developers of imposing what amounts to the Internet death penalty: revoking the company's certificate authority, at least until a security audit is performed, from the default Firefox configuration.

Lending ammunition to critics is that this is not the first time that Comodo has experienced a serious security breach. In 2008, a reseller issued an improperly acquired certificate for Mozilla.org.

And Comodo's chief technology officer, Robin Alden, wrote in February 2010 that, before issuing a certificate, "Comodo performs an automated check of domain control by sending (and confirming receipt of) an email to an address which is either on the domain to be validated or is explicitly mentioned in the Whois entry."

That apparently wasn't done when a Comodo business partner issued those fraudulent certificates earlier this month. Comodo declined to answer questions that CNET posed last week, including the identity of its reseller, what current audits were performed, and how much authority it delegates to partners.

Elinor Mills contributed to this report

Originally posted at Privacy Inc.