Add More Privacy-respecting Browsers #674
No reviewers
Labels
No Label
🔍🤖 Search Engines
approved
dependencies
duplicate
feedback wanted
high priority
I2P
iOS
low priority
OS
Self-contained networks
Social media
stale
streaming
todo
Tor
WIP
wontfix
XMPP
[m]
₿ cryptocurrency
ℹ️ help wanted
↔️ file sharing
⚙️ web extensions
✨ enhancement
❌ software removal
💬 discussion
🤖 Android
🐛 bug
💢 conflicting
📝 correction
🆘 critical
📧 email
🔒 file encryption
📁 file storage
🦊 Firefox
💻 hardware
🌐 hosting
🏠 housekeeping
🔐 password managers
🧰 productivity tools
🔎 research required
🌐 Social News Aggregators
🆕 software suggestion
👥 team chat
🔒 VPN
🌐 website issue
🚫 Windows
👁️ browsers
🖊️ digital notebooks
🗄️ DNS
🗨️ instant messaging (im)
🇦🇶 translations
No Milestone
No Assignees
1 Participants
No due date set.
Dependencies
No dependencies set.
Reference: privacyguides/privacytools.io#674
Loading…
Reference in New Issue
No description provided.
Delete Branch "patch-8"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Description: Add More Privacy-respecting Browsers
Why? Currently there are only 2 major open-source web browsers, Chromium and Firefox. Giving to much market share to a few companies can be harmful especially when there are plenty of alternatives.
What software does this add? The following have been added to "Worth Mentioning":
All of these meet the PrivacyTools.io Criteria.
Can you test how they perform on panopticlick?
Privacy respecting isn't the same as Fingerprint resistent.
And non of them have a big userbase so the fingerprint is nearly unique
And "Cliqz". Remember the story with Ghostery add-on? Same company so this isn't privacy friendly
Fingerprinting is based on the number of users and how hard it would be to guess. It is generally a very hard to use metric. That being said, I will try this and come back and edit this post to include them.
Edit:
Basilisk:
Dooble:
NetSurf:
I would like to note that if you tried the same test with a non-upgraded Firefox you would see similar results. If there is any more data you would like to see, please reply so.
I actually don't, could you please refresh my memory? If there is a genuine security/privacy flaw then I would be willing to remove it from my pull request.
@beerisgood @Shifterovich
I don't want to see any more browsers based on the same rendering engines.
Use the Tor Browser, Firefox or Chromium.
The largest attack surface is the underlying rendering engines, we don't need more browsers which are just the same thing with a new name. 👎
I don't see how market share translates itself to decreased security.
I also don't see how alternatives that use the rendering engines created by those companies that you claim are "too big" are a valid solution.
In fact I believe we should replace Brave with Chromium.
You must be as stupid as @ciampolo.
https://github.com/privacytoolsIO/privacytools.io/issues/649#issuecomment-446340793
If I refused to remove Brave, I obviously wouldn't have had opened an issue to remove Brave and I wouldn't have even participated in that discussion (#649), I would just close it. It's really annoying when you spend a fuckton of time participating in meaningless discussions, rather than closing them after first sign of retardedness (such as the original post by @ciampolo) because @0ndrey and @ciampolo's brain capacity is limited to accusing people of nonsense. And after you put in so much time people still say retarded shit like that.
@kewde Yeah it's possible ungoogled chromium would score better on fingerprinting tests. Can you try that out? It seems like it's possible to detect Brave right now. If ungoogled chromium was (almost) indistinguishable from Chrome/ium, it might be a better choice.
@Shifterovich
I think there's a credible source for Brave detection available.
https://www.ctrl.blog/entry/brave-user-agent-detection
I had a lot of hopes for
muon. I had a slight hope that it would beat some common sense into developers using electron but the project has been deprecated.As far as a substitute goes, I've had my fair share of experience with Chromium and believe that its sandbox capabilities are reliable. It should have a lot of users, so there is no obvious fingerprint available. I haven't tested out ungoogled chromium yet - but I will be delving deeper in
@diracdeltas are you aware of what the blog post @kewde sent mentions?
Hmm, upon further inspection it seems like the problems might have been mitigated by the move to the pure chromium based browser.
I believe they deployed the 'pure' Chromium-based browser on the 7th of December whilst the detection method was published a lot earlier. So this might have been behavior that was inherited from the electron codebase.
Still worth checking with Brave devs.
@Shifterovich @kewde https://www.ctrl.blog/entry/brave-user-agent-detection indeed refers to the old muon-based Brave.
I would be surprised if this worked on new Brave which is more similar to Chromium than Electon was.
This or similar functions will work to distinguish Brave from Chromium. For instance we spoof 3rd party referer (by setting the 3rd party referer to the origin of the first party), which is something no other browser does (except maybe Tor browser when visiting .onions). If a site wanted to, it could abuse this feature to distinguish Brave.
Anti-fingerprinting features are a pain. By trying to mask one value ("3rd party referer"), you often end up creating another value ("spoofs 3rd party referer") that can be used for fingerprinting. Seems like it's a lot about finding the right balance, since masking some values does more harm than good.
@Shifterovich
Insulting other users does not make you taller or smarter than them. @ciampolo gave very well-reasoned comments, unlike you. You for no apparent reason refuse to delete this browser. The links that you provide are only an attempt to remove suspicions of your interest in Brave being present on the site.
@ciampolo:
Clearly mentally deficient.
I generally do that when people who waste my time do that. More of @ciampolo
Why did I open an issue to remove Brave then? Why was I against adding it in the first place? Please do your research for at least 5 minutes before accusing people.
Way too many issue with Chromium. Too many non-free services.
Besides, the only decent open-source layout engine besides Gecko and Blink is NetSurf and my pull request would add NetSurf. Many of these browsers also utilize modified versions of their layout engines.
The layout engine market has become an Oligarchy.
@asddsaz
What security measures does the NetSurf rendering engine provide that would compel me to add them? I don't care about oligarchies in the rendering engines - in fact for fingerprinting privacy it is beneficial to have an oligarchy or monopoly.
I think you are missing the big picture.
Besides, @asddsaz already did a fingerprinting test:
This is significantly better than what you would see if you tested this in Firefox without making any changes. Besides, it isn't like this PR is for adding it to main, it is just to add it to worth mentioning.
To be fair, most of these browsers like Brave are made to make private browser easier and by default. This is something, the privacy community has historically supported. :/
Are you even a privacytools.io developer, @kewde?
@David-Beetle Those 18.29 bits are on NetSurf? Similar numbers can be reached on FF with some tweaking.
To be fair, you can also tweak NetSurf. :)
A while back I tried to get my family to utilize a more private web configuration, but as soon as the about:config warnings nobody wants me to mess with their browsers.
They all think it is gonna blow up or something.
Firefox is good, but if you are like me with lots of friends and family that lack tech skills, you are better off using a privacy-by-default browser. Brave is great, but it hands over a monopoly to Blink.
You appear to have forgotten the exact scale of which a monopoly can affect an industry. Many people in the privacy community HATE cell phones for their clear monopolies. They have successfully made it impossible to compete and have stunt the market from moving toward e2e encrypted solutions.
Another instance, the hardware space is ruled by a few companies. Because of this nobody can compete and free hardware is dying1.
And, if you find this all acceptable please read the Wikipedia page on monopolies:
https://www.wikipedia.org/wiki/Monopoly#Monopoly_versus_competitive_markets
@kewde @Shifterovich
I've grown to become cautious of fingerprinting tests.
The data sets are often skewed, I don't know what data source most of them use but people doing fingerprinting test are often people who are already privacy conscious.
Also, I highly doubt the fingerprinting test above includes the user agent?
I don't know anyone who uses NetSurf and their custom user agent is rather uncommon. Is that reflected in the fingerprint tests? Are the fingerprinting techniques even optimized for the NetSurf browser and rendering engine?
I don't trust new browsers that roll their own rendering engines. I've seen so many jailbreaks based on exploits in the rendering engines that I've become very distrustful of any product that relies on it. Perhaps NetSurf is different, but I don't want to advocate for the next WebKit fiascos.
You have a clear stance on monopolies and oligarchies. You don't like them.
But I don't see how more homogeneity caused by such market characteristics decrease privacy.
From the privacy perspective, everyone using the same browser is the best solution. A bigger set of people to mix in with. You could make the case that diversity of browsers is more resilient against a very specific security vulnerability, but that's a very thin argument as it only applies in on specific instance of a discovered exploit. More code, generally means more bugs. The only thing I currently like about NetSurf is that it doesn't even ship with JavaScript at all. But I haven't been able to find any documentation about the security mechanisms in the browser. Nonetheless, I love the project and I'm keeping tabs on it, glad to know that it exists and is being actively developed. With a big experimental warning, it might be worth mentioning but I wouldn't consider it more private or secure in any manner.
My conclusion is that all the browsers you mentioned are either recycled rendering engines, or they're "worth mentioning" overal but that merit has not been based on any dimension that we care about (privacy and security).
@kewde fingerprint tests of course test your User-Agent. It even exist useragent-only tests
I agree. The argument against monopolies doesn't take into account that browser engines are probably the second most difficult thing to make securely, right after operating systems. Per se -- browsers literally execute arbitrary code on the client's device and have to manage privacy, sandboxing, etc properly. If Chrome & FF have security issues while being developed by a huge team, a browser with a small development team will be full of vulnerabilities assuming basic features like JS.
@beerisgood
It is very counter intuitive that the NetSurf produces a more private fingerprint than rendering engines based on Blink. Even based, merely on the user agents detection, intuitively it should stick out a lot more than the results of other browsers.
It raises the question whether fingerprinting tests are suitable means to make rank-ordering decisions. It's practically speaking the best solution we have, but is it therefore theoretically a "good" solution?
I can only explain it with the following observations:
Be nice to each other, guys.