# Firefox for Android vs Windows **URL:** https://discuss.privacyguides.net/t/firefox-for-android-vs-windows/19121 **Category:** Questions **Tags:** browsers **Created:** 2024-06-26T13:45:06Z **Posts:** 38 ## Post 1 by @win11.shading291 — 2024-06-26T13:45:06Z Why is Firefox for Android considered not private enough? Is it because you can’t configure it with the about:config page? What if I use ublockorigin hard mode on Android as well? Thanks for your thoughts! --- ## Post 2 by @anon48875053 — 2024-06-26T13:48:06Z > [@win11.shading291](#): > > Why is Firefox for Android considered not private enough? The problem is security, not privacy. > [@Revise statements on Gecko browsers (Android) to make security shortcomings clear](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840): > > Proposal Drop recommendations for all Gecko-based browsers on Android, except Tor Browser (lacks alternatives), due to very lacking security and add statement of reasons. Alternative proposal If above proposal does not succeed, at least change statements below to make the security shortcomings very clear, and that they apply to all users, not just high-risk. Add statement that Chromium browsers are generally preferred for security reasons. Affected section Statements to revisit Firefox (Gec… > [@win11.shading291](#): > > Is it because you can’t configure it with the about:config page? You can. > [@win11.shading291](#): > > What if I use ublockorigin hard mode on Android as well? It’s recommended to use the default settings for uBO if you don’t want to stand out and increase your attack surface. --- ## Post 3 by @win11.shading291 — 2024-06-30T04:53:52Z I just read the whole thread and my opinion is similar to others, especially Jonah’s points and also this one: [Revise statements on Gecko browsers (Android) to make security shortcomings clear - #54 by ddsn](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840/54) There is one thing I don’t understand, probably because of my lack of knowledge. If I understood correctly, using uBO hardmode increases my fingerprinting (stand out and attack surface). Why using Brave and changing all sorts of settings wouldn’t, then? --- ## Post 4 by @yes — 2024-06-30T05:23:21Z > [@win11.shading291](#): > > Why using Brave and changing all sorts of settings wouldn’t, then? It would and does stand you out. --- ## Post 5 by @win11.shading291 — 2024-06-30T05:36:07Z This seems contradictory then: [Revise statements on Gecko browsers (Android) to make security shortcomings clear - #65 by SkewedZeppelin](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840/65) I know it’s a pain to use hard mode on uBO, but I don’t mind being it a pain for a month or two until no page breaks anymore. I also feel like for a security stand point, that would be the best recommendation no? The issue would then be fingerprinting, but I don’t understand how Brave is better when you have to tweak settings (and thus making you more stand out) then Firefox + uBO hard mode? Thanks for your inputs! --- ## Post 6 by @anon48875053 — 2024-06-30T06:07:21Z > [@win11.shading291](#): > > I just read the whole thread and my opinion is similar to others, especially Jonah’s points and also this one: [Revise statements on Gecko browsers (Android) to make security shortcomings clear - #54 by ddsn](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840/54) Yeah, sure, use whatever you want; just understand the risks you’re taking. Some people, like @sha123 are purely technical and operate on facts, and I think it makes sense to listen to those and not opinions. My personal opinion is that Jonah and the others downplay the lack of security of Gecko-based browsers, and there is some bias involved just because Mull is Gecko-based and Chromium is a spooky boogeyman that will take over the world. On the other hand, Mull is the best Gecko-based browser, and it makes sense to have it on Privacy Guides so people who choose to be ignorant about the security issues can pick the best possible choice and not just vanilla Firefox. --- ## Post 7 by @anon21666177 — 2024-06-30T07:27:56Z Obligatory reference: [Firefox and Chromium | Madaidan's Insecurities](https://madaidans-insecurities.github.io/firefox-chromium.html) This was last updated in 2022 but still contains many relevant points today. --- ## Post 8 by @yes — 2024-06-30T07:41:58Z I’ve adjusted my browser according to my preferences, mainly based on the suggestions by [him](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840/65) and Privacy Guides. I think it doesn’t matter that much unless you’re using Tor Browser, like others said, it’s up to you to decide. Escaping from fingerprinting is almost impossible, so you know. --- ## Post 9 by @anon48875053 — 2024-06-30T07:44:12Z Do you want to have the best privacy and also support Gecko-based browsers? Use Tor Browser, and then use a proper Chromium browser for everything else. --- ## Post 10 by @yes — 2024-06-30T13:21:26Z This. Since Tor is not convenient for daily-use I prefer Brave, other than that Tor is the best option. --- ## Post 12 by @yes — 2024-06-30T13:46:12Z I was using Cromite as my daily-use browser, but decided that Brave is is better for me as it has forgetful browsing. Cromite doesn’t have bloats unlike Brave, that’s a positive point for Cromite. I also love the dev too, he’s active and always tries to answer every issue --- ## Post 13 by @win11.shading291 — 2024-07-01T18:30:58Z @anon48875053 I like to go by facts too. From my understanding, the security risk of using Firefox is linked with navigating on “unknown” websites and a script running when you visit that website that could attack you (I’m summarizing from my readings on the other thread). I understand lot of people don’t want to recommend uBO hardmode because it brakes pretty much every website in the beginning. But if I am willing to make this sacrifice, and live with site breakings for one or two months, wouldn’t that be the “best” recommendation to make? Thus, aside from fingerprinting, the security part would be covered? Also, am I correct in my assumption that using uBO hardmode or changing all sort of settings on Brave as per [this](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840/65) makes you stand out either way? Pinging @sha123 as well. Thanks to make me understand my lack of knowledge on the matter. --- ## Post 14 by @anonymous176 — 2024-07-01T18:39:44Z to be honest, you’re probably standing out already (i don’t think theres many fingerprinting protections on vanilla firefox for android compared to hardened browsers - see [https://divestos.org/pages/browsers](https://divestos.org/pages/browsers)). so i dont think the downside is big enough to warrant not using it. my reason for not using hard mode is that its too inconvenient, but it is a tradeoff. although, i would recommend using mull over firefox for android. but not sure what @anon63378630 thoughts are on hard mode for ublock --- ## Post 15 by @anonymous176 — 2024-07-01T18:46:17Z also worth reading [3.3 Overrides [To RFP or Not] · arkenfox/user.js Wiki · GitHub](https://github.com/arkenfox/user.js/wiki/3.3-Overrides-%5BTo-RFP-or-Not%5D#-fingerprinting) --- ## Post 16 by @sha123 — 2024-07-01T19:22:35Z > [@win11.shading291](#): > > I understand lot of people don’t want to recommend uBO hardmode because it brakes pretty much every website in the beginning. How do you know in advance which first- and third-party resources can be trusted and can be safely whitelisted? Also why make your life more uncomfortable than needed? Security measures in browsers are there to protect you independently of that, because you can’t know that for sure for every resource. > [@win11.shading291](#): > > Pinging @sha123 as well. Nothing has changed since then. I stand by my point made in the proposal and wrote a lot to explain it. --- ## Post 17 by @anon48875053 — 2024-07-01T20:06:13Z Security by badness enumeration has never worked, doesn’t work, and will never work. You need strong, systemic security and privacy features that protect you regardless of whether the site or a script is malicious or not. --- ## Post 18 by @win11.shading291 — 2024-07-01T22:00:33Z @sha123 Most of the time, either akamai related scripts, cloudfront or [google.com](http://google.com) (recaptcha) scripts will break websites. It’s a pain in the beginning, but really not that bad when you see the patterns. It’s also a learning exercise and eye-opening for me to get control on each tracker. It also gives me a sense of how much a certain company really cares about user privacy. I will even make financial decisions based on that fact alone. And it provides great security on top of that as well as privacy (so many websites work well with so many trackers off, it’s shocking). So, there are many reasons as to why I do it. @anonymous176 Interesting read. From what I understand, except using Tor or waiting for Mullvad Browser to have more users, it’s impossible to really protect against fingerprinting. I have already another open topic on that though [here](https://discuss.privacyguides.net/t/fingerprinting-on-firefox/19127/) @anon48875053 What is badness enumeration? --- ## Post 19 by @moonwriting — 2024-07-01T22:10:06Z > [@sha123](#): > > How do you know in advance which first- and third-party resources can be trusted and can be safely whitelisted? The way Ublock Origin’s dynamic filtering works is that you use noop rules instead of allow rules, which means that even if you noop a potentially malicious script, you won’t be automatically exposed because noop rules don’t override static filter lists. I would recommend reading Ublock Origin’s [official documentation](https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide) where this is explained in more detail. > [@anon48875053](#): > > Security by badness enumeration has never worked, doesn’t work, and will never work. Blocking third-party iframes or scrips by default is not security by badness enumeration. Relying on filter lists would be. --- ## Post 20 by @sha123 — 2024-07-02T07:27:17Z > [@moonwriting](#): > > The way Ublock Origin’s dynamic filtering works I know how it works. --- ## Post 21 by @anon48875053 — 2024-07-02T08:02:39Z > [@win11.shading291](#): > > What is badness enumeration? > **[Badness Enumeration](https://privsec.dev/posts/knowledge/badness-enumeration/)** > > Badness enumeration is the concept of making a list of known bad actors and attempting to block them. While it seems intuitive at first glance, badness enumeration should not be relied on for privacy or security. In many cases, it actually does the... --- ## Post 22 by @moonwriting — 2024-07-02T08:51:21Z Good, then you can stop scaring people about dynamic filtering because it doesn’t matter if someone accidentally noops a malicious script. You also did this in another thread [here](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840/44). --- ## Post 23 by @sha123 — 2024-07-02T09:14:28Z > [@moonwriting](#): > > Good, then you can stop scaring people about dynamic filtering because it doesn’t matter if someone accidentally noops a malicious script. You also did this in another thread [here](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840/44). I won’t stop something, just because you don’t understand it or because you tell me so. --- ## Post 24 by @moonwriting — 2024-07-02T09:39:43Z I’m happy to have a constructive discussion with you on this topic, but making these kinds of ad hominem attacks is not part of it. If you think I have misunderstood Ublock Origin’s documentation, then please go ahead and prove it instead of just making these general accusations that I wouldn’t understand these things. --- ## Post 25 by @anon63378630 — 2024-07-02T12:07:22Z > [@win11.shading291](#): > > What is badness enumeration? A valid and effective layer, as long as you have other layers behind it. Those saying it is useless and shouldn’t be done are sticking their head in the sand. --- ## Post 26 by @anon48875053 — 2024-07-02T12:31:50Z > [@anon63378630](#): > > Those saying it is useless and shouldn’t be done are sticking their head in the sand. Nobody said that. Using the Swiss cheese approach, where you have multiple layers of protection, is good. Saying that using uBlock Origin somehow justifies Firefox not having some very important security features isn’t good. --- ## Post 27 by @moonwriting — 2024-07-02T14:09:20Z > [@anon48875053](#): > > Saying that using uBlock Origin somehow justifies > Firefox not having some very important security features isn’t good. Nobody has said this either. --- ## Post 28 by @anon48875053 — 2024-07-02T14:17:17Z > [@win11.shading291](#): > > I understand lot of people don’t want to recommend uBO hardmode because it brakes pretty much every website in the beginning. > > But if I am willing to make this sacrifice, and live with site breakings for one or two months, wouldn’t that be the “best” recommendation to make? > > Thus, aside from fingerprinting, the security part would be covered? @moonwriting you sure? --- ## Post 29 by @moonwriting — 2024-07-02T15:15:52Z The OP was the one who asked about this, and no one has said in their answers that security issues with Firefox don’t matter if you use Ublock Origin. --- ## Post 30 by @win11.shading291 — 2024-07-03T00:55:18Z @anon48875053 Thanks for the share. Indeed as @moonwriting said, uBO hard mode is not badness enumeration and quite the opposite in fact. From your article, uBO hardmode is like this: “In short, when setting up a Firewall or some sort of filter list, it is better to start out by blocking everything, then allowing only the traffic that you need. That way, you don’t have to worry about applications that you didn’t care enough to block turning out to be vulnerable. Sometimes, “goodness enumeration” is the solution to the problem.” Also, from @moonwriting’s point, I never said that. If there is any security issues, it should be addressed. I’m looking to understand how things work to make a better decision for myself. If I still don’t understand, I will simply ask more questions just to overcome any shortcomings that I might have. If anyone else can make decisions based on these discussions, then it is a win for everyone. Back on topic, even though no one clearly said it, from my understanding and from the answers here, I feel like I can deduct using uBO hardmode is enough to protect myself security wise, from the topic [here](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840) @moonwriting is this something you could confirm? Also, could someone explain how changing form uBO normal mode to hardmode increase my fingerprinting? I thought what was shared when navigating is which extensions is installed, not the actual settings of each extension? Or is that wrong? Thanks to anyone clarifying. --- ## Post 31 by @sha123 — 2024-07-03T08:28:28Z > [@win11.shading291](#): > > From your article, uBO hardmode is like this: Every experienced user here used dynamic filtering at some point and knows what medium and hard mode are. > [@win11.shading291](#): > > I feel like I can deduct using uBO hardmode is enough to protect myself security wise, from the topic [here](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840) That topic never was about uBO’s hard mode, it was about FF not having a sandbox and other security shortcomings. These don’t go away by using hard mode, because you’re still exposed to every first-party resource and third-party resources you allow, which you can’t know in advance, whether they are safe or not. Why do you think you know better than security researchers like Daniel Micay? > [@win11.shading291](#): > > Or is that wrong? Everything you change in your browser or extensions, which interacts with websites can theoretically be taken into account when doing fingerprinting. --- ## Post 32 by @moonwriting — 2024-07-03T09:19:03Z > [@win11.shading291](#): > > Back on topic, even though no one clearly said it, from my understanding and from the answers here, I feel like I can deduct using uBO hardmode is enough to protect myself security wise, from the topic [here](https://discuss.privacyguides.net/t/revise-statements-on-gecko-browsers-android-to-make-security-shortcomings-clear/17840) > > @moonwriting is this something you could confirm? I can’t give a yes or no answer here as it is ultimately your decision to choose what things you want to prioritize. The security issues related to Firefox on Android are valid, but in my opinion, the potential danger is not as critical as some have argued here. If you’re just a regular person without a high threat model, then using Firefox on Android should be fine. This is especially true if you use something like uBlock Origin’s hard mode, as you seem to do. However, if you want to use Firefox, I would encourage you to seriously consider Mull, as it has some [significant improvements](https://divestos.org/pages/browsers) over standard Firefox on both the security and privacy front. --- ## Post 33 by @anon48875053 — 2024-07-03T10:18:38Z > [@moonwriting](#): > > The security issues related to Firefox on Android are valid, but in my opinion, the potential danger is not as critical as some have argued here. If you’re just a regular person without a high threat model, then using Firefox on Android should be fine. It’s completely irrelevant if you’re a regular user, Edward Snowden, or an old grandpa. If there is a grandpa who uses his phone to read news articles and call his grandchildren and one of his news websites has a zero-day deployed on it, then he is screwed. It’s irrelevant if his threat model is pro max high or bottom of the barrel low. --- ## Post 34 by @anon48875053 — 2024-07-03T10:26:00Z > [@win11.shading291](#): > > Also, could someone explain how changing form uBO normal mode to hardmode increase my fingerprinting? Most people just install uBlock Origin and leave it be, by configuring it, you make yourself stand out from the others. If you want to use a Gecko-based browser, then here is a guide: 1. Don’t downplay the security shortcomings because you’re significantly less secure with a Gecko-based browser. I would personally avoid staying logged in to sensitive accounts, etc. Just try to reduce the damage as much as possible in case you get compromised. 2. Get Mull from F-Droid. 3. Follow this guide: [https://divestos.org/pages/browsers#tuningFenix](https://divestos.org/pages/browsers#tuningFenix) --- ## Post 35 by @moonwriting — 2024-07-03T10:45:40Z > [@anon48875053](#): > > If there is a grandpa who uses his phone to read news articles and call his grandchildren and one of his news websites has a zero-day deployed on it, then he is screwed. It’s irrelevant if his threat model is pro max high or bottom of the barrel low. This is a very unlikely scenario, and just using a Chromium-based browser will not automatically protect you from all zero-day attacks. > [@anon48875053](#): > > It’s completely irrelevant if you’re a regular user, Edward Snowden, or an old grandpa. Funnily enough, Edward Snowden is a well-known Tor user, so even he uses a Gecko-based browser instead of something like Brave. :slightly_smiling_face: --- ## Post 36 by @anon48875053 — 2024-07-03T10:50:04Z > [@moonwriting](#): > > This is a very unlikely scenario, and just using a Chromium-based browser will not automatically protect you from all zero-day attacks. That highly depends on the severity, the vulnerability deployed on a website could range from just stealing your cookies to the absolute worst-case scenario where it infects your whole device and gains persistence. The latter one would cost millions, though. > [@moonwriting](#): > > Funnily enough, Edward Snowden is a well-known Tor user, so even he uses a Gecko-based browser instead of something like Brave. :slightly_smiling_face: In Qubes OS AKA on desktop, the desktop Tor browser is not only more secure but also more private than on mobile. --- ## Post 37 by @anonymous176 — 2024-07-03T14:58:37Z > [@win11.shading291](#): > > Interesting read. From what I understand, except using Tor or waiting for Mullvad Browser to have more users, it’s impossible to really protect against fingerprinting. > > I have already another open topic on that though [here](https://discuss.privacyguides.net/t/fingerprinting-on-firefox/19127/) Protecting against advanced fingerprinting is probably as you describe, but naive scripts can be fooled through randomization of metrics, and being “in common” with a pool of users is less necessary --- ## Post 38 by @win11.shading291 — 2024-07-05T17:01:59Z Ok thanks everyone! If I summarize: As far as security goes, using uBO hardmode along with good practices (delete cookies on exit, etc.) should be enough. The user should know in advance which 3rd party to unblock by researching it. I personally ask AI to know which script does what prior to unblocking it. If there is a zero-day exploit, you might be screwed either way as we don’t know the zero days and what they do. As for fingerprinting, only Mullvad (once there will be enough users) + VPN or Tor help. But this is for desktop. On Android, there is pretty much no solution as far as I know.