Yet another Dolphin Browser security issue: think twice before backing up

Update: Dolphin finally encrypts your backups!

Dolphin Browser HD may be the Android browser with the most features of the pack, but it doesn't always behave well.

It used to send your entire surfing history to its webzine server. That got fixed in an update after the entire web screamed murder about it.

But there's another problem that remains unfixed, and this problem can cause a lot of trouble if exploited.

Dolphin has a backup feature that lets you backup all its browser settings, bookmarks, cookies, etcetera to your SD card. If you tell Dolphin to remember your logins and passwords they'll be included in the backup too.

It's your own choice to make backups or not, so what's the problem? The problem is that nobody expects their backups to be in a format that can easily be abused by anyone with access to the backup file. You'd expect the backup to be in a secure format, but unfortunately it's not. The backup is not encrypted, so anyone with access to your SD card can look into the backup file (sdcard/TunnyBrowser/backup/databases/webview.db) and read your stored passwords and login cookies.

Even if you sit on top of your phone 24/7 that doesn't mean your backup is safe. Any app with permission to read your memory card and go online (that means just about every app on the Android Market) could send the unencrypted backup file out and steal your passwords and login cookies. It only takes one evil programmer to release a bad app on the market to send your Dolphin backups out. Maybe those bad apps are already out there.

Any app that stores data on your memory card should consider the SD card of your phone an unsafe location that should only store sensitive data under lock and key. That's why backup app Titanium lets you encrypt its backups. The other big backup app out there does not. MyBackup should add encryption as soon as possible.

With all the recent fuzz about Dolphin you might think this web browser is a malicious app. It's probably not. The security issues are more likely a result of incompetence rather than evil intent. Of course that won't make any difference to you if your passwords get stolen, so if you keep surfing with Dolphin make sure you take your own measures to close the security holes.

My advice: do NOT use Dolphins built-in backup feature unless you've cleared your saved passwords and login cookies. If you want a backup with your login data included, just make an encrypted backup with Titanium.

Update: Dolphin finally encrypts your backups!

Dolphin Browser clean after a bath and a shower

Dolphin HD is the most feature rich(tabs, gesture commands, bookmarks sidebar, and much more) web browser in the seas of Android , but the marine mammal was smelling like rotten fish lately.

Flipper was still unclean after a bath, but a post-tub shower washed away the dirt.

What gives? Three days ago Fnorder found out that Dolphin HD was sending all your surfing history, including searches and URLs with private information, back home to en.mywebzines.com, a server owned by Dolphin. He shared the info with the world through the xda forum, and then the waves got rough.

The reason? Since version 6 Dolphin ships with a "webzine" feature that lets you display sites in a kind of Google Reader style. To ease toggling between normal and webzine view Dolphin compares the page loaded on your phone with a list of webzine-enabled sites. It does so by sending the URL to its own server to look for a match.

Doesn't sound like a big deal, except that 1) Dolphin never told us about it until we found out ourselves, 2) some URLs can contain sensitive data, especially if they point to a private network or if they're of the http://site.com/?private.stuff type, and 3) the data is sent unencrypted, even for https sites (which opens the doors to hijacking and mutiny).

And then Dolphin released version 7.0.1 of their app and told us that the URL snooping was gone.

But...

Hi Android Underground. It has come to our attention that the hot fix update we pushed out last night on Android Market (7.0.1) did not fix the issue, thank you for noting this!

It has now been resolved and is live on the Android Market as Dolphin Browser HD v7.0.2. Again, user privacy is a huge priority for us and we thank you for your patience while this has been resolved.

Alex Molloy on the Dolphin blog

First things first. The first one to notice (and share) that the first update still fished for your URLs is xda member Keiji, and Fnorder was the first to confirm that v7.0.1 remained fishy. So Alex Molloys words of thanks belong to them.

The good news is that the latest update to version 7.0.2 really fixes the issue. Dolphin screwed up in their first attempt, but v7.0.2 is clean and shiny and doesn't send your browsing data home.

So if you haven't already done so, head for for the fish market and update your copy of Dolphin HD to keep your surfing safe.

Dolphin, take note: Wireshark is watching you, no matter how deep you dive.

• Dolphin Browser HD
• Dolphin caught in the nets of xda

Dolphin Browser washed, still dirty

Update: Dolphin clean after bath and shower

Androids most popular browser Dolphin HD got caught in the nets of those who fish in the deep waters of their phones. The update to version 7.0.0 added a Cloud To Device Messaging background service that kept swimming, even for those who have no use for it.

Todays update to version 7.0.1 fixes that. The C2DM service stays underwater if you don't sign up for Dolphins bookmark sync service.

But Dolphin has more dirt under its tail fin. It's fishing for your data! Dolphin HD 7.0.0 sends all visited URLs back home to Dolphin without asking for permission or even telling that it did so and why it did so. It's been doing so since version 6, when the webzine feature was added to the browser.

Dolphin responded on their site:

"Webzine simply performs an ancillary check if we can view current webpage in Webzine format . It is not critical and we have temporary removed this functionality in our latest update yesterday.

[...]

While it has been immediately disabled, we do think that the “Toggle Webzine” feature is a useful one for exploring the Web and will be adding an “opt-in” feature in forthcoming releases to enable this function. The code and URL-checking process will be made very clear to users, and will only be enabled if a user wishes.
Again, our update last night have temporary removed this functionality to avoid any confusion or concern you may have."

(source: Dolphin blog)

Sounds good, right? Wrong! When the folks at xda tested the update (version 7.0.1) it still shipped all your surfing habits to the mothership. Dolphin promised to play fair but lied about it! So if you told your Android hosts file to block all communication with en.mywebzine.com you better keep blocking it. If Dolphin doesn't swim back to clear waters it may be time to fish for another web browser.

Take home message: if you make a popular app anything your software does will be closely watched and made public. Apps that don't behave are fed to the sharks.

If you want to keep using Dolphin without sharing your browsing history, add these lines to your Android hosts file:

127.0.0.1 en.mywebzines.com
127.0.0.1 pnsen.dolphin-browser.com

The first line stops the URL phone home behaviour, the second line blocks the annoying "rate me on the market" popups.

You can add the entries to your hosts file (usually in /system/etc/hosts) with a text editor, but it's a lot easier to enter them in the blacklist of AdAway. No matter which method you use, you'll need root access for it.

• The pros and cons of Dolphin
• Dolphin caught in the nets of xda
• AdAway

Update: Dolphin clean after bath and shower

Dolphin Browser: spyware?

Update: Dolphin clean after bath and shower

Dolphin is probably the most popular web browser for Android. There's a good reason for that, because is has a couple of killer features: unlimited tabs, gesture controls, and much more.

The bad news: version 7.0.0 adds a cloud to device messaging service (Dolphin Connect) without an off switch. The next version better come with a toggle in the settings menu for those who don't want Dolphin Connect listening online when there's no need for it.

The really really really bad news: a couple of updates ago Dolphin added a feature called "Webzines," and it seems that this addition turned Dolphin into spyware.

According to Fnorder on the xda forum the new Dolphin sends the address of every site you visit, every link you tap, and every search query you enter to http://en.mywebzines.com. The domain mywebzines.com is probably owned by Dolphin itself.

Maybe your surfing trips are sent out to target advertising, maybe it's just an innocent way to collect anonymous browsing statistics. Either way, having all your URLs collected can be a real security issue because many sites generate URLs of the www.domain.com/?personal.data type. And let's not even think about URLs for pages on your internal network, or URLs along the lines of [password]:[username].site.com.

If you want to stop Dolphin from sending your browsing history to mywebzines.com, open your Android hosts file (usually in /system/etc/hosts) and add this line to it:

127.0.0.1 en.mywebzines.com mywebzines.com

If you don't want to edit your hosts file by hand, you can blacklist the domain en.mywebzines.com with AdAway.

Editing your hosts file or using AdAway requires root access, but if you know what's good for you and your phone you'll have rooted it anyway.

You can also patch the Dolphin app itself so it doesn't send your surfing secrets out. Fnorder posted instructions on taming Dolphin by killing the offending code with APKTool.

Keeping your browsing data away from mywebzines.com will break the Webzine part of Dolphin, but does anybody really use that anyway?

Of course you can just throw Dolphin back into the ocean and surf with another browser, but keep in mind that other web browsers may do the same evil thing. For example, Boat Browser phones home to www.umeng.com and Maxthon reports to mm.maxthon.com and stats-a.maxthon.com.

Open source browser Firefox for Android is probably clean. Unfortunately it's not ready for human consumption yet. The best Dolphin alternative is xScope, but it lacks many of the features that make Dolphin such a popular browser.

This fish marine mammal should clean up its act real quick, or else I'm gonna eat a lot of tuna.

• Dolphin
• AdAway
• The Dolphin is fishy thread on the xda forum
• xScope (Android Market)

Update: Dolphin clean after bath and shower

Free streaming music player shootout: Dood's Music Streamer, KLastFM, QueueTube

Want free music on your Android phone? You can play its FM radio (if your phone has one), or stream online Shoutcast radio stations with WinAmp or other media players.

But what if radio is not good enough, Google Music doesn't cut it either, and you've already played the mp3s on your memory card so many times that the bits and bytes have worn out?

Then you need one of these apps. Or better yet, all of these apps:

QueueTube

QueueTube plays the sound streams of YouTube music clips. Yes, you could fire up YouTube in your web browser or use the YouTube app from Google, but QueueTube comes with a few nice extras.

If you send your browser or the YouTube app to the background or if you lock your screen the music stops playing. That's because YouTube thinks that you don't want their clips to continue when you don't look at them. YouTube won't let you make playlists either.

QueueTube keeps playing. It lets you make playlists too, and it displays album art and song lyrics. To cut a long story short: QueueTube is an excellent app if you want to use YouTube as a cloud music streaming service. Just keep in mind that YouTube is full of live tracks shot with cell phones that sound terrible, and QueueTube mixes them together with the normal music clips.

KLastFM

Last.fm is a radio with a twist. Enter an artist or band name, or a tag like triphop or death metal and last.fm will turn it into a personal radio station. It makes custom radio out of your own favourite list of artists or those of your last.fm friends too.

But last.fm doesn't like phones. It doesn't like most of the world either.

If you're from Germany, the UK, or the USA you can listen to last.fm for free, but only on your computer. If you want to listen on your phone (a tiny little computer) you have to pay. But even if you pay you're not allowed to listen to last.fm unless you are in one of the aforementioned three countries. As if the rest of the world doesn't want last.fm on the move.

KLastFM unchains last.fm by letting everyone everywhere on the planet listen to last.fm on their phones for free. Out with the geographical restrictions, because the first two letters in www mean world wide! The program interface is ugly and scrobbling is sometimes erratic, but those are minor flaws of an otherwise excellent app.

Update 1: CoboltFM and KLastFM are dead. Last.fm changed things for the worse and pulled the plug on free streaming for almost everyone. Believe it or not, most of the planet can't stream anymore even if they pay. Last.fm refugees can still stream custom radio stations from Grooveshark with Dood's Music Streamer.

Update 2: Liquid Bear still plays last.fm radio on Android.

Dood's Music Streamer

In my language dood means death, and the maker of the app lives on a website called mysticdeath.com. Don't let that scare you. Dood's Music Streamer streams music from Grooveshark. You don't need to subscribe to Grooveshark, just search for songs and play them. Dood's Music Streamer also comes with a few built-in radio stations, but they're no match for KLastFM. What makes Dood's a great app is that it plays your choice when you want it, and it does it better than QueueTube.

Dood's Music Streamer can scrobble your tracks to last.fm too. It has excellent playlist support and a pretty good widget. The only drawback is that its mp3s are only 128 kbps, but that's a Grooveshark limit and it's still better than the sound quality of KLastFM or YouTube. Dood's can also buffer the next track in the play queue for gapless playback. If you copy the buffered tracks from Dood's SD card folder you can even use it as an mp3 downloader!

Update: recent versions of Dood's have a very annoying ad banner that's so close to the tab bar that it's way too easy to click by accident. Until Dood's moves its ads to the bottom of the screen you better tame it with AdFree or AdAway. Or ditch Dood's and use TinyShark instead.

The verdict

The best cloud music streaming app is Dood's Music Streamer, but only if you get the paid version or use an ad blocker. If you don't want to do that, use TinyShark instead. You may want to keep a copy of QueueTube installed for those rare occasions where a song is not available on Grooveshark, or if you want to see the song lyrics inside the app (QueueTube) rather than in a web browser (Dood's). KLastFM and CoboltFM are the best radio apps. Liquid Bear is the best last.fm radio app. So just keep all of them. And you may want to grab a copy of WinAmp for Shoutcast radio if the stock player of your phone doesn't have Shoutcast built in.

• Dood's Media Streamer
• KLastFM and CoboltFM
• QueueTube

Update 1: CoboltFM and KLastFM are dead. Last.fm changed things for the worse and pulled the plug on free streaming for almost everyone. Believe it or not, most of the planet can't stream anymore even if they pay. Last.fm refugees can still stream custom radio stations from Grooveshark with Dood's Music Streamer.

Update 2: Liquid Bear still plays last.fm radio on Android.

WiFi Probe finds open networks that really work

There are plenty of open WiFi networks around, but not all of them are really open. Many networks that are not locked down with WPA or WEP redirect your web browser to a login page or pay screen. They look open to your phone, but they're not.

WiFi Probe takes WiFi scanning a step further. It looks for open networks, and then checks if if they are really open, i.e. free to use without having to log in.

WiFi Probe is very simple, very fast, and very useful in cities where the real open networks are buried in a sky full of unencrypted networks that won't let you go online.

There's one problem with WiFi Probe: it doesn't remember. That's why it is a good idea to use WiFi Probe together with Wi-Fi Ruler, an app that remembers the networks it encounters and lets you choose whether to connect to them in the future or avoid them like the plague.

The ultimate WiFi app would combine the functions of WiFi Probe and Wi-Fi Ruler. Until then, use both of 'em.

• WiFi Probe (Android Market)
• Wi-Fi Ruler

Optimize Toolbox update speaks chinese, english version still available

Optimize Toolbox is an all-in-one (to be precise: 15-in-one and counting) toolkit for your Android phone.

Features

Most of its features duplicate functions built into the standard Android settings screens, but Optimize Toolbox does a few things that make it worth downloading.

Optimize Toolbox comes with an excellent yet simple to use startup manager to control what can launch at boot and what should not. It times your startup too, so you can see how many seconds you can shave off by stopping unnecessary autostarts. It also has a tool to callibrate your battery, and it comes with an app manager that can send apps to your SD card. The running apps and processes tabs do a better job than the built-in apps settings menus of your phone, and they are faster too. Another useful feature is its screen test to hunt down dead pixels on your display.

The China Syndrome

You'll find some bits of chinese in the user interface, because the translators of the app missed a few things. It doesn't interfere with using the app.

But that changed with the update to version 2.1.0. The developers posted the update on the Android Market in chinese only. The predictable result was a lot of pissed off users who couldn't find their way around the program anymore, and those without a backup were stuck. Take-home message: never update an app without making a backup of the old version first!

For those who're locked out without a backup there's a link to the old english version below.

Update: the latest edition speaks english again.

Many features of Optimize Toolbox require root access. You may want to use DroidWall or LBE Privacy Guard to keep Optimize Toolbox offline.

• Optimize Toolbox (Android Market) Chinese only last time I checked!
• Optimize Toolbox version 2.0.9 (android underground) This one speaks english.
• Optimize Toolbox Lite version (Android Market) In english last time I checked, but check the market comments to make sure it didn't turn chinese.

Update: the latest edition speaks english again.

GO SMS Pro adds clipart

The built-in Android SMS app does what it's supposed to do, but it doesn't do anything more than that. That's why there are a bunch of SMS app replacements floating around.

SMS and MMS app GO SMS Pro (never mind the "Pro" suffix, it's free anyway) can back up and restore your messages, comes with an (almost) full screen edit window, and you can add drawings and handwritten text to your messages. Of course it can send and receive plain old SMSs too.

If you don't draw like Picasso then GO SMS lets you cheat a bit. The latest edition comes with clipart to paste into your messages. It only has five images to start with, but you can download a few dozen more.

Too bad the drawing options are not available in the big editor window, but you can tap into them from the default small edit box. The big editor is in need of an overhaul, which the GO team may work on later on.

GO SMS Pro asks for internet permission, which may be a little scary considering that GO SMS can read all your messages and contacts data. GO doesn't really need internet access, except for downloading more clipart. So if you don't want GO SMS going online you can block it with apps like LBE Privacy Guard or DroidWall. Just make sure to give it temporary internet access if you want to grab some extra clipart.

• GO SMS Pro (Android Market)
• GO SMS at goforandroid.com

Adobe Reader got dumbed down: update kills PDF text reflow

Update: Adobe listened to us. Text reflow is back.

There are many PDF viewers for Android. Unfortunately there are not many good PDF readers for Android, and none of the free PDF viewers can match their PC counterparts.

The free Adobe Reader is not a very good PDF reader, but it had one thing going for it: text reflow.

Yes, the original idea behind PDF is to preserve formatting and layout, but the inventors of PDF never anticipated that one day we'd read PDF files on the small screens of our phones.

Ever tried to read a two or three column PDF on your phone? Then you know why it's a good idea to reflow the text to make things readable on your mobile display.

But Adobe had to ruin it.

The new Adobe Reader update for Android adds bookmarks (not done very well) and lets you read PDFs protected with their own DRM scheme (as if anyone would want to do that), and you can copy text from your PDFs to other apps now.

But...

...Adobe stupidly removed the option to reflow the text of your PDFs to a single screen width fitting column in a legible font size.

Let's hope text reflow comes back in a future version. Until then you better stick with the old version of Adobe Reader if you want to keep the option to reflow your PDFs.

• Adobe Reader (Android Market)

Adobe Reader version 10.0.2 still comes with text reflow:

• Adobe Reader 10.0.2 at ftp://ftp.adobe.com/pub/adobe/reader/android/10.x/10.0.2/
• Adobe Reader 10.0.2 on Google

Ask for the return of text reflow on the Adobe forum. Maybe they'll listen?

• What happened to text reflow? (Adobe Forums)

Update: Adobe listened to us. Text reflow is back.

Banner blocker AdAway sends your hosts file to your text editor

Ads in apps and websites are annoying and they usually track your online behaviour too. Fortunately you can keep most of the major banner pushers out of your phone by blocking the servers that serve them. It's a simple matter of editing your Android hosts file to send requests for ads to hell.

Of course it's only simple if you can automate the process, because editing your hosts file by hand is not my idea of fun.

AdAway is the best app to feed blocklists to your hosts file. It grabs hosts files from different online sources, and you can add hosts files and file entries of your own without the need for manually editing the list in a text editor.

But if you want to play with your hosts file in a text editor anyway, the recent AdAway update saves you a trip to the dark corners of your system folders (/system/etc/hosts). AdAway added a new button that lets you send the hosts file to your favourite text editor.

AdAway needs root access to work. It's an open source app, so if you have the technical know-how you can check the code and improve it. You can grab a copy from the Android Market and from Google Code. Yes, the biggest advertiser on the web hosts the tools to remove their own ads :)

• AdAway (alternative download links, no longer in Play Store)
• AdAway (Google code)

If you don't like AdAway you can give AdFree a shot.

• AdAway vs. AdFree

Be evil, destroy wireless networks with WiFiKill

Are people abusing your wireless network? Do you want to keep your kids offline at night? Do you want to break the network of your school, office, or local coffeeshop?

Then WiFiKill is your weapon.

WiFiKill turns your phone into a rogue access point that drops the packets of every computer, phone, tablet or other device that you choose to block. You can keep your boss offline, throw your teachers out of the school network, cut your husbands access to online porn, or simply disable internet connections for each and every device made by Apple, Inc.

You don't even need to own the network (although WiFiKill lets you p3wn it), because it works on all wireless networks that you can connect to, whether they're encrypted or not.

You get a choice of methods to play the bad guy. The default method will simply drop all packets for the devices that you select. If you enable IP tables you can reject packets or redirect all requests to a bogus IP address (like the loopback address 127.0.0.1). You can't redirect traffic to an address of your choice, which is a good thing since this would allow you to send everyone on the network to a virus server.

Update: WiFiKill got even more deadly. Now you can redirect your victims to your fake PayPal login screen.

There is a price to pay, however. Since your victims believe your phone is the router, your WiFi will get flooded. If you block everyone on a large network you'll get so much incoming traffic on your phone that your own internet connection will suffer and your battery will drain like crazy.

WiFiKill doesn't spoof your MAC address, so you may get caught. And even if you get away, your phone will probably be banned forever by the network administrator. Worse yet, the network owner can just wait until you return to the network later and send out some sort of identifiable information like an email address or Facebook login. Of course WiFiKill can also get you expelled, fired, dumped, divorced, locked up, or murdered, so don't go killing networks at random.

By default WiFiKill loads a long list of hardware vendors so you can see who made the devices connected to the network. This list loads real slow, but you can speed up the app by disabling the vendor list. If you do so, you'll only see MAC addresses, not device types.

WiFiKill needs a rooted phone to work and is was available for free in the Android Market. Google may kick it out kicked it out, just like they kicked out another app by the same developer (which hacked into Facebook accounts), but there are other places to get it. The app has ads, but it's easy to get rid of them.

Update: WiFiKill got booted off the Android Market, but you can download the free version straight from its maker.

• Things change. Go read all about the new WiFiKill.

• Protect yourself against WiFiKill with Wifi Protector

VoIP app Viber adds pictures, location, low bandwidth codec

Call, text, share pictures

VoIP client Viber lets you call other Viber users for free. There are other apps and VoIP services for that, but the sound quality of Viber is comparable to CSipSimple, and much better than Skype, Nimbuzz, or fring.

The latest Viber update comes with a new voice engine that makes calls sound better on low bandwidth connections. Great if there's no WiFi around and you need to call over 3G.

The SMS substitute got a little better too. You can now add pictures to your texts. It's not real MMS yet, but maybe Viber will add sound and video later?

Viber added a "is typing" notification so you can see if your chat partner is typing a response while you're waiting for a reply, similar to other chat networks.

You can also send your location out with text messages. Of course you can also choose not to share your location, and in my tests Viber doesn't use your location unless you tell it to.

Autostart yes, filtering no

Viber still has plenty of room to improve. If you don't want to be available 24/7 you can switch Viber off, but you can't stop it from autostarting when you boot your phone unless you use an autostart killer. I use Optimize Tool Box to ensure that Viber only speaks when I tell it to. Too bad that Viber is not willing to add an autostart toggle switch in its own settings. It would make the app a bit less intrusive if they did. There's a lot wrong with the Skype app, but at least the competition leaves the choice to you.

Viber doesn't come with any type of filtering either, so anyone who's got your phone number can Viber you whenever you got the app running, whether you like it or not. Viber could really use a feature to block your friends during business hours and keep your coworkers away at night. Since unlimited data is quickly becoming a thing of the past, Viber could also use an option to limit incoming calls to WiFi networks. Maybe with an automatic message along the lines of "not on WiFi now, so text me instead of calling me."

A public api to integrate Viber into other apps would be welcome too, because the VoIP and chat fragmentation is getting out of hand.

• Viber Media, Inc.
• Viber (Android Market)

Some Viber competitors:

• Skype
• CSipSimple
• Vonage
• fring

Bolt browser for Android out of beta testing but fails miserably

There are a lot of web browsers for Android, and now that Bolt is out of beta testing the Android Market offers yet another one. Bolt is an old browser that has been available for Symbian since many years, and it ranked among the worst web browsers back then. The Android version keeps that old tradition alive.

Bolt starts with a tabbed screen for quick launching of your favourite websites. The "favorites" tab is similar to the start screens of Opera and Dolphin, but nowhere near as good. The Bolt screen comes preloaded with links to Bolts sponsors. You can replace 'em with links to your own favourite websites, except for one: the number one spot on the list is occupied by a link to the GetJar app store that won't go away no matter how hard you try. The same screen sports a web apps tab that advertises a Bolt app store, and there's no way to get rid of it. The social tab is just a link to a useless, stripped down version of Facebook. You can't remove unwanted tabs from the launch screen.

Although Bolt puts its start screen tabs right in your face, the tabs that really matter are hidden away. If you open a few websites in tabs, you need to enter the menu to switch between them.

Similar to Skyfire and Opera Mini, Bolt renders pages in the cloud and then sends the output to your phone in a proprietory format. The cloud rendering is supposed to speed up browsing and eat less data, but Bolt is the slowest Android web browser I've ever seen. Opera and Skyfire render pages pretty well, Bolt doesn't. It chokes on sites with frames, it won't reflow text to fit your screen, its cloud rendering renders your ad blocker useless, and once a page is finally loaded it takes forever to scroll around in that page. If you can scroll at all: I often got stuck on the right side of a page because Bolt wouldn't let me scroll back to the left.

The best thing you can do with Bolt after you loaded it on your phone: hit the uninstall button. There are plenty of competing browsers out there that do a better job than Bolt.

• Bolt (Android Market)

A few Android web browsers that outperform Bolt:

• Dolphin
• Opera Mini (Android Market)
• Skyfire (Android Market)

Google Music Beta: plays for all, clouds for a few

Cloud storage service Google Music is available by invitation only while beta testing lasts, and only in the USA. But the matching music player is available for everybody everywhere outside the Android Market.

Google Music 4.0.1 can work as an offline music player, but not a very good one. Google Music sorts your music by the artist, album, title, and genre tags, and it reads (and syncs) your playlists too. Unfortunately it won't use the composer tag, and it ignores your folder structure. It displays album art, but not lyrics. It doesn't have an equaliser either. You can't send music to a play queue like you can do in WinAmp or PlayerPro, but you can work around this by making an on the fly playlist.

There are better offline music players for Android. What sets Google Music apart is its cloud storage service. By streaming your music from Google you can carry much more music with you than fits on your SD card: Google lets you store 20.000 songs on its servers. The cloud storage service is free while beta testing lasts, but may cost you later on.

Too bad that uploading your music to Google is really slow, and it won't work at all if you're outside the USA. Streaming music to your phone sucks your battery dry. If you'll be away from a power outlet for a while you're better off playing music from your memory card instead of letting it rain down from the cloud.

In addition to playing locally stored content and streaming from the cloud you can download your music back to your phone. Unfortunately Google renames your songs to cryptic file names like 1234.mp3, and it strips the mp3 tags away. As a result your cached music only works in Google's own player, not in other players like PlayerPro or WinAmp unless you rename and retag your files.

If you try to install the off market version of Google Music on top of a previous version your phone will probably refuse. If you already have an old copy of Google Music on your phone, make a backup, uninstall the old version, and then install the latest update.

• Google Music Beta (Android Market)
• Google Music 4.0.1 (Android Police)

If you're looking for a good free offline music player:

• WinAmp (streams ShoutCast radio too)
• MIUI Music 1.4.22 (this version supports mp3 tags and folders)

Default App Manager adds new view

One of the advantages of Android over iPhone is that you can choose your own default apps to open your mail, SMSs, pictures, songs, movies, web sites, etcetera. Dolphin instead of the stock web browser, K-9 Mail instead of the built-in mail app, WinAmp instead of the vanilla music player, anything goes.

Too bad that editing your default app settings requires a trip to the slow loading app settings screen.

Enter Default App Manager. It takes you straight to the relevant app settings screen to set or clear your defaults. Editing defaults straight within the app would be better, maybe that will come in a future update?

The latest edition of Default App Manager adds an "all defaults" view in addition to its old category sorting. It won't let you set apps by file extension, but that's because Android won't support that.

The choice between the two views adds an extra tap to change your defaults, but since this is an app you won't use very often the extra tap is not a problem. Default App Manager beats launching Androids own apps screen and swiping through its endless list of apps.

Default App Manager asks for internet permissions. It doesn't need them to do its job, so if you want you can keep it offline with apps like DroidWall or LBE Privacy Guard.

If you update the app from an old version it may refuse to launch. Uninstalling and reinstalling fixed it for me.

• Default App Manager (Android Market)

File manager X-plore needs to explore touchscreens

Blast from the past

Update: X-plore improved a lot. Most of the issues that plagued the first versions are fixed now. If you ditched X-plore before, give it a second chance.
Back when I used Symbian, X-plore was the best file manager for my Nokia. And now the Android version is totally free, without delays and nag screens.

But X-plore got stuck in the past. Back when Symbian was big phones had small screens and big keypads, and the Android version of X-plore is not adapted to touchscreens at all.

Big menu

X-plore has an on-screen menu button that just replicates what the hardware menu button does. You really need to dig into that menu to select multiple files or folders, because X-plore won't let you do that from the main screen. You have to open the menu, navigate into a submenu to select more than one file, and then again and again for each and every file and folder that you want to select.

Selecting a file or folder takes one tap, opening it takes a second tap. Checkboxes on the edge of the screen for selecting files and folders would really make a difference, but X-plore for Android doesn't have them.

Speaking of folders, X-plore shows your SD card as a subfolder of the phone memory. There's no option to show the card only unless you tell it to hide all system folders. A button to toggle between internal memory and memory card would make the folder list way less cluttered.

View and read

X-plore comes with a built-in text and image viewer, and a player for some audio formats (mp3 and ogg, but not aac). It insists on opening supported files in its own player. There's no option to set your own preferred player.

X-plore reads your IMEI whenever you launch it, and it asks for full internet permission. It's probably only to send crash logs, but you may want to tame X-plore with apps like DroidWall and LBE Privacy Guard anyway.

The promised root access didn't work on my rooted Motorola Defy. X-plore showed all the system folders and their contents, but it never bothered to ask Superuser for root permission so I could only watch, not touch my system files. Maybe you have better luck.

There's one good thing about X-plore for Android: it has the same folder tree view mode of its Symbian parent. But that's not enough to compete with ES File Explorer or File Expert. What worked on the keypads of yesterday doesn't work on todays touchscreens.

Update: X-plore improved a lot. Most of the issues that plagued the first versions are fixed now. If you ditched X-plore before, give it a second chance.
• X-plore (Android Market)
• X-plore (Lonely Cat games)

The competition:
• ES File Explorer
• File Expert (Android Market)

Flash updated, links to privacy settings

Android phones have Flash, iPhones don't. That may become irrelevant when every website has made the switch to HTML5, but that's still years away. Flash is gonna stick around for quite a while.

Flash for Android is updated. You won't notice much of a difference, except for one tiny little detail: the new Flash app puts an icon in your app drawer.

The icon launches your web browser and takes you to the mobile Flash player settings page. It doesn't have all the features of the desktop version, but the options available for the Android Flash plugin are useful anyway.

The Local Storage menu lets you limit which sites can store Flash data on your phone. You can choose always or never, and there's a setting in between called "only from sites I visit." This setting lets the sites you surf to store some stuff so you don't need to redownload everything when you come back later, but it stops third party Flash content from being stored. This helps fight the infamous Flash cookies that advertisers abuse to track you. There's also a button that lets you erase all stored content with a single tap.

The other setting is called "peer-assisted networking." This lets sites lighten the load on their servers by letting their users redistribute their Flash content: you share the Flash stuff you already downloaded with others, and you may get your Flash fix from other users instead of from the original site. If you're often using Flash on 3G connections you better switch this feature off.

• Flash (Android Market)

Google apps on GetJar

Android may be open source, but if your version of Android is not approved by Google you can't bundle it with the Android Market.

Fortunately there are other Android markets. Amazon has one, and GetJar caters for Android too.

And now GetJar serves Google apps too. Gmail, Google Search, Voice Search, Maps, Goggles, Google Music, YouTube, Google Books, Sky Map, Earth, Google Finance, and Google Translate are all on GetJar.

So if your phone or tablet didn't come with the Android Markt you don't have to hunt for Google apps on forums and shady sites with ripped APKs that may or may not be compatible with your device. Apple may be anal retentive about its app store, but Google doesn't seem to mind competing markets.

• getjar.com
• m.getjar.com

Microsoft brings Hotmail to Android, comes with push email

Hotmail on Android, I'm sure Google doesn't like it. But if you mail with the other Evil Empire your number of options has +1'ed. After all the unofficial Hotmail clients, Microsoft released their own Android app.

Hotmail by Microsoft + SEVEN (you may remember them from their horrible Symbian mail app) supports multiple Hotmail accounts (good). Deleting mail requires a tap on the menu button (bad). Tapping a link in Hotmail fires up your browser (good), but when you return to Hotmail you end up in your inbox instead of the mail from which you launched the link (sloppy programming). The app won't sync your custom folders unless you go to the settings menu to enable them (counterintuitive). You can't set it to load messages older than a month, so forget about digging up that old mail with the details of the flight you booked six weeks ago.

You can protect the Hotmail app with a password (which the app calls "pin code" even though it doesn't need to have a single number), you can choose your own attachment folder, but you can't set your own email notification sound. In addition to the non-customisable sound you can be notified of new messages in the notification bar, and by vibration.

The official Hotmail app supports push notifications, so all your spam can get to you without delay. It can load your Hotmail Calendar too, but does anybody really use that?

Hotmail by M$ & 7 is not a very good email client, but at least you don't have to trust 3rd parties with your Hotmail password if you really want to use an app instead of the Hotmail website. You better have a launcher that lets you change app icons, because Hotmail designed the ugliest icon they could think of. It's even uglier than the icon of K-9 Mail! Speaking of K-9, they know how to design a good email app. SEVEN has a lot to learn.

• Hotmail by Microsoft and SEVEN (Android Market)

Smart Browser Chooser launches the right browser for your connection speed

There are plenty of web browsers for Android, and you probably have more than one on your phone.

I usually use Dolphin HD for my mobile surfing, but when I'm on a slow (and/or expensive) mobile data connection I use Opera Mini.

Enter Smart Browser Chooser. This app is not a web browser, but it's meant to be your default web browser anyway. With Smart Browser Chooser set as default, any links you tap will launch in the right browser for your connection.

You can set one browser to launch when you're on WiFi, another browser when you're on 3G, and if you're stuck on a 2G connection (do they still exist?) you can set the lightest browser available (Opera Mini).

Smart Browser Chooser is available from different Android app stores.
Update: now it's on the Android Market too.

• Smart Browser Chooser (AppBrain)
• Smart Browser Chooser (AndroLib)
• Smart Browser Chooser (Android Market)