browser for webapps? : privacy

[-] rollingflower@lemmy.kde.social 10 points 7 months ago* (last edited 7 months ago)

There are 2 answers to this.

Security

From a security point, Firefox on Android does not isolate processes and not even itself in a good way (I will try and search up the exact reason, its some modern Android feature that Firefox supposedly does not use).

So we should assume that Firefox is less secure on mobile.

You should not use it, but use Cromite or Brave, Vanadium on GrapheneOS. Note that most FOSS "privacy browsers" that have a download size of under 100MB will use the system webview and also not be able to isolate processes.

Usability/Privacy

I use Mull and Librewolf on my Devices.

Use Mull, disable keeping history (but do not enable "delete cookies") and use "Cookie Autodelete" to replicate what Firefox desktop can. You set it to delete all cookies, but you visit sites where you want to stay logged in, open the popup and whitelist only them. You "outsource" the cookie cleaning to the addon, as FF mobile doesnt have this feature.

I do it like that on mobile and desktop, delete all cookies and only keep those where you want to stay logged in.

On Mull also install UBlock origin. If you want security and an opt-in approach, install NoScript too and set "default" to not allow any javascript. You will need to "unbreak" every site you visit.

This approach will spare you of hundreds of embedded javascripts on websites, and you manually allow only what seems okay. (You mostly never know if it really is, as Javascript is often obfuscated). This is good for privacy and security.

the theory behind this

Adblockers and malware scanners use "badness enumeration" which means "allow everything but block a, b and c". This is fundamentally flawed, as malware can easily change "how it looks" (encode and decode again, or use randomized obfuscation) and with ads you will always have to keep track of changes.

The list of malware and ad sites will grow and grow, slowing down machines and consuming tons of processes.

Noscript and the cookie approach are the opposite, you block everything and the list you keep is only as big as the stuff you want.

Please also read the more detailed words on some points, but note that I am not an Expert

I am not sure but Firefox desktop (gecko) and mobile (fenix) are separate projects. I think they share a lot of code though.

So a browser renders webpages, CSS, Javascript and nowadays even Webassembly and WebGL stuff.

If you stick to HTML and CSS you are way more secure, Javascript is way more attack surface, and JIT+Webassembly where about 50% of Microsoft Edges security vulnerabilities.

So if you disable WebGL and JIT+Webassembly by default the attack surface is way lower. But there are websites, especially good stuff like Tuta doing in-browser encryption over advanced quantum resistant protocols, that require JIT. GrapheneOS Vanadium now has a toggle to enable JIT for some sites, Edge Desktop has too afaik (dont use it but its likely the most secure browser on Windows), Chrome-ium desktop allows a policy where you can list JIT exceptions.

Firefox desktop and mobile both likely allow blocking wasm and jit in about:config but no GUI toggle yet. Torbrowser in "very secure mode" also blocks JIT.

Coming to the engine, Chrome-ium focuses a lot on sandboxing, while using C and C++ for like everything.

Firefox has the rendering engine completely rewritten in Rust.

Assuming that most sandbox escapes come from memory issues, firefoxes sandbox doesnt have to be as secure if they simply dont have memory issues as they use Rust.

Firefox Desktop uses Seccomp filters for every process (restricting syscalls the processes can make) and separates processes using unprivileged user namespaces for every process (I think they call that fission). Firefox Flatpak can only use seccomp filters but the processes are not isolated from another, which is why you should probably use a system install (binary, .deb, .rpm, ...).

You can sandbox system installed apps using bubblejail and allow access to the syscalls needed to create user namespaces. But it is pretty complicated and incomplete in my experience, even though I dont know why.

On Android firefox still uses the engine in Rust afaik, but Android has a very different model how to isolate apps. Also only Chrome-ium can isolate every process strongly on Android, yet. It is totally possible but Mozills doesnt seem to care.

At the same time to be honest I never had a security vulnerability in Firefox affect me, my entire life.

It is important to protect activists and people that "StAtE ActOrS" want to target, so those people should use the most secure browser possible.

The problem is simply that we have no privacy respecting variant on the desktop, that also has quick CI/CD updates. Ungoogled Chromium often lacks behind on Updates (and dont mention Thorium please).

This could be done by people that know how to build such a pipeline on Gitlab, Github etc. and apply all the ungoogle patches to the browser, hardening the build and creating .RPM packages every few days. There just is nobody currently doing that.

[-] TheAnonymouseJoker@lemmy.ml 8 points 7 months ago* (last edited 4 months ago)

[removed by mod]

[-] rollingflower@lemmy.kde.social 1 points 7 months ago

What do you mean by this comment?

[-] TheAnonymouseJoker@lemmy.ml 4 points 7 months ago* (last edited 4 months ago)

[removed by mod]

[-] rollingflower@lemmy.kde.social 0 points 7 months ago* (last edited 7 months ago)

I am not parrotting their Propaganda, see my other, longer comment. I attached it to the top one now, and changed the catchy phrasing.

See this GrapheneOS Discuss thread where they deleted or have hidden my comment.

But as you seem to not have read the probably more detailed other comment, please do so.

I dont know what you want to tell me with the "mail thread about hating tom" as I have no idea what I just read.

I guess the beginning of the conversation and especially Tom Ritters mail here most useful.

[-] TheAnonymouseJoker@lemmy.ml 3 points 7 months ago* (last edited 4 months ago)

[removed by mod]

[-] rollingflower@lemmy.kde.social 2 points 7 months ago* (last edited 7 months ago)

I dont get that forum. They dont actually recommend Brave, only some "lower level" people do. Some people that parrot what the others say are often mods and take care of blocking everything. A post I made about that issue was also hidden, I can still see it and likely the mods.

Especially bad if in the same thread misinformation posts are kept. But deleting them is also not fair, as they are partly right.

claims Firefox security is bad, claims Google things are good and so o

I understand that you have no time to write about that in detail, but they do. Apart from the Torbrowser thread I read nowhere about the key differences in sandboxing and site isolation.

I also read nothing yet about how "leaky" Chromium is in terms of security. For sure Torbrowser doesnt accept it as it permanently contacts Google. But this is about security. I dont use Chromium anymore after finding out how much it pings Google using googerteller.

But just saying they have superficial opinions like that is not fair.

They have their alternative facts about security, which will not be allowed here.

If you have sources that prove me wrong please add them. I asked Firefox Devs about the security of Flatpak Firefox, also because it seems they dont do anything against their "Firefox is insecure" reputation. For sure, big corps like Microsoft and Google are pushing Chromium, but they simply also add a lot of informative sources for research.

It stems from the nonsense agenda GrapheneOS desires to propagate about Firefox.

Bullshit. Please cite where this should be the case .

and anyone can follow through mailing lists.

Tbh today was the first day reading a mailing list and its very strange. Their tracker, and the duplicate of that are both nearly empty and have no info, the only info is from that mailing list.

You will need to retract your statement

So it seems you are a mod, and if you think I need to do that I want to have at least another mod look at this.

I am critical of GrapheneOS, as clearly demonstrated, but your comment didnt disprove anything I said but you just ranted about how bad they are. I dont think this is very constructive.

[-] TheAnonymouseJoker@lemmy.ml 4 points 7 months ago* (last edited 4 months ago)

[removed by mod]

[-] rollingflower@lemmy.kde.social 0 points 7 months ago

Thanks for the link. I will read through the Tor mailing list and the other parts.

you wrote GPT style filler paragraphs about Firefox insecurity, misinformation that is up for a day now.

Why would you say something like that? But I will check everything again.

This was about Android, and Firefox had no process isolation to my last knowledge. Looking to find a source against this currently.

This is not Reddit, where closed source stuff and Big Tech stuff gets promoted or recommended

Okay? This is about privacy and security, Chromium is fully open source. Yes it is big tech and that may be a problem in many many cases. But this has no effect on its security.

[-] LWD@lemm.ee 4 points 7 months ago

Daniel Micay of Graphene has... A reputation. At the end of his tenure at Graphene, Micay started increasingly accusing people in many other communities of conspiring against him and harassing him. It elevated to the point of accusing Louis Rossman of being part of the conspiracy. It got swept under the rug for years, but Rossman was the one person to get so pissed off that he eventually outed Micay... And his departure from the organization was swift.

I actually reached out to Micay (IIRC before Rossman outed him) looking for answers. After showing me some incredibly scant "evidence" that amounted to accusations he had written in the past, he started accusing me of being part of the conspiracy too.

I don't like to claim people have mental illness recklessly, but I can't think of many other reasons he behaved that way. The only other obvious one is that he was a massive asshole for no reason at all.

But he's also very technically competent (or at least, prior to stepping down, was very competent), and there's probably a reason Graphene finds so many Android bugs and gets their patches implemented so regularly. But the whole thing definitely taints the project and some of the pages he most likely wrote.

[-] rollingflower@lemmy.kde.social 0 points 7 months ago

I dont know if his fears are true and that is not for me to judge.

But he is very active, like still the most active person. It seems that he will always use his own account, but when reporting issues its always him to react.

I cannot imagine what a job that is

[-] TheAnonymouseJoker@lemmy.ml 4 points 7 months ago* (last edited 4 months ago)

[removed by mod]

[-] rollingflower@lemmy.kde.social 0 points 7 months ago* (last edited 7 months ago)

I also think the DivestOS project is pretty cool, as I use Mull daily and maintain my own custom addon collection from the time when Firefox didnt allow all installs. (I really have to clean that list up though, it has too many things).

Will look into it.

My knowledge is too that even "ungoogled Chromium" may not send data (so it doesnt have active antifeatures) but it is still not fingerprint protected.

Brave meanwhile is veeery bloated with weird stuff, which totally tells me that their focus cannot be that much on the privacy and security hardening.

Regarding Arkenfox, I maintain a small and pretty messy project to make it usable for daily usage changing only small bits.

I dont know percentages, but I remember most of it being one of these

"remove everything Mozilla"
remove actual tracking stuff
privacy hardening that may break sites
security hardening

So it is not mainly a security project but mainly privacy hardening to my knowledge. I agree with it mostly though, it is a great project.

Chromium has some flags and policies which are very limited though. The secureblue project has integrated all of them, and its still way worse than Arkenfox for privacy. There are JIT Exceptions though, not sure if this is available on Firefox, it was very hidden also for Chromium.

I also agree that manifest v3 is central Google control dystopia.

I have to say though

While DivestOS includes a Gecko based browser for privacy reasons, Chromium based browsers have many security advantages.

This makes little sense. If a Browser is not as secure as possible, it is not as private as possible. At least if you scale it. "The browser is like pretty secure, not the best available but okay, unless you are not targeted or something". What statement is that? We dont know if we are targeted.

So I appreciate if people say "this may not be the best for privacy, but we use the most secure base and try to make it privacy friendly" just like I respect people making hardened Firefox more secure.

Anti-fingerprinting on Android is very difficult because of GPU models, display size etc. According to GrapheneOS, Vanadium sends as little data as possible. And I believe them that. Not sure about other vectors of privacy, the lack of NoScript (granular JS control per origin) and UBO makes it unusable for me, along with strange UI for adding search engines or whitelisting cookies while whiping the others.

[-] tfowinder@lemmy.ml 5 points 7 months ago

You mean using brave is better than firefox on Android?

[-] rollingflower@lemmy.kde.social 1 points 7 months ago* (last edited 7 months ago)

No, not as a general statement. Read the comment again

[-] BearOfaTime@lemm.ee 3 points 7 months ago

Maybe you should elucidate why you think this is the case, Rather than replying dismissively.

Frankly, I don't trust what you say because you only make a claim - you don't back it up with any explanation.

Check your hubris.

[-] LWD@lemm.ee 2 points 7 months ago

I too am curious about the real world implications of this lack of process isolation.

[-] rollingflower@lemmy.kde.social 3 points 7 months ago