Firefox for Android vs Windows

[Critical_Crab5543]

Good, then you can stop scaring people about dynamic filtering because it doesn’t matter if someone accidentally noops a malicious script. You also did this in another thread here.

[sha123]

@Critical_Crab5543

Good, then you can stop scaring people about dynamic filtering because it doesn’t matter if someone accidentally noops a malicious script. You also did this in another thread here .

I won’t stop something, just because you don’t understand it or because you tell me so.

[Critical_Crab5543]

I’m happy to have a constructive discussion with you on this topic, but making these kinds of ad hominem attacks is not part of it. If you think I have misunderstood Ublock Origin’s documentation, then please go ahead and prove it instead of just making these general accusations that I wouldn’t understand these things.

[SkewedZeppelin]

@win11.shading291

What is badness enumeration?

A valid and effective layer, as long as you have other layers behind it.
Those saying it is useless and shouldn’t be done are sticking their head in the sand.

[Lukas (Lukas Dutovas)]

@SkewedZeppelin

Those saying it is useless and shouldn’t be done are sticking their head in the sand.

Nobody said that.

Using the Swiss cheese approach, where you have multiple layers of protection, is good.

Saying that using uBlock Origin somehow justifies
Firefox not having some very important security features isn’t good.

[Critical_Crab5543]

@Lukas

Saying that using uBlock Origin somehow justifies
Firefox not having some very important security features isn’t good.

Nobody has said this either.

[Lukas (Lukas Dutovas)]

@win11.shading291

I understand lot of people don’t want to recommend uBO hardmode because it brakes pretty much every website in the beginning.

But if I am willing to make this sacrifice, and live with site breakings for one or two months, wouldn’t that be the “best” recommendation to make?

Thus, aside from fingerprinting, the security part would be covered?

@Critical_Crab5543 you sure?

[Critical_Crab5543]

The OP was the one who asked about this, and no one has said in their answers that security issues with Firefox don’t matter if you use Ublock Origin.

[win11.shading291]

@Lukas

Thanks for the share. Indeed as @Critical_Crab5543 said, uBO hard mode is not badness enumeration and quite the opposite in fact. From your article, uBO hardmode is like this:

“In short, when setting up a Firewall or some sort of filter list, it is better to start out by blocking everything, then allowing only the traffic that you need. That way, you don’t have to worry about applications that you didn’t care enough to block turning out to be vulnerable. Sometimes, “goodness enumeration” is the solution to the problem.”

Also, from @Critical_Crab5543’s point, I never said that.

If there is any security issues, it should be addressed.

I’m looking to understand how things work to make a better decision for myself. If I still don’t understand, I will simply ask more questions just to overcome any shortcomings that I might have. If anyone else can make decisions based on these discussions, then it is a win for everyone.

Back on topic, even though no one clearly said it, from my understanding and from the answers here, I feel like I can deduct using uBO hardmode is enough to protect myself security wise, from the topic here

@Critical_Crab5543 is this something you could confirm?

Also, could someone explain how changing form uBO normal mode to hardmode increase my fingerprinting?

I thought what was shared when navigating is which extensions is installed, not the actual settings of each extension? Or is that wrong?

Thanks to anyone clarifying.

[sha123]

@win11.shading291

From your article, uBO hardmode is like this:

Every experienced user here used dynamic filtering at some point and knows what medium and hard mode are.

@win11.shading291

I feel like I can deduct using uBO hardmode is enough to protect myself security wise, from the topic here

That topic never was about uBO’s hard mode, it was about FF not having a sandbox and other security shortcomings. These don’t go away by using hard mode, because you’re still exposed to every first-party resource and third-party resources you allow, which you can’t know in advance, whether they are safe or not. Why do you think you know better than security researchers like Daniel Micay?

@win11.shading291

Or is that wrong?

Everything you change in your browser or extensions, which interacts with websites can theoretically be taken into account when doing fingerprinting.

[Critical_Crab5543]

@win11.shading291

Back on topic, even though no one clearly said it, from my understanding and from the answers here, I feel like I can deduct using uBO hardmode is enough to protect myself security wise, from the topic here

@Critical_Crab5543 is this something you could confirm?

I can’t give a yes or no answer here as it is ultimately your decision to choose what things you want to prioritize. The security issues related to Firefox on Android are valid, but in my opinion, the potential danger is not as critical as some have argued here. If you’re just a regular person without a high threat model, then using Firefox on Android should be fine. This is especially true if you use something like uBlock Origin’s hard mode, as you seem to do. However, if you want to use Firefox, I would encourage you to seriously consider Mull, as it has some significant improvements over standard Firefox on both the security and privacy front.

[Lukas (Lukas Dutovas)]

@Critical_Crab5543

The security issues related to Firefox on Android are valid, but in my opinion, the potential danger is not as critical as some have argued here. If you’re just a regular person without a high threat model, then using Firefox on Android should be fine.

It’s completely irrelevant if you’re a regular user, Edward Snowden, or an old grandpa.

If there is a grandpa who uses his phone to read news articles and call his grandchildren and one of his news websites has a zero-day deployed on it, then he is screwed. It’s irrelevant if his threat model is pro max high or bottom of the barrel low.

[Lukas (Lukas Dutovas)]

@win11.shading291

Also, could someone explain how changing form uBO normal mode to hardmode increase my fingerprinting?

Most people just install uBlock Origin and leave it be, by configuring it, you make yourself stand out from the others.

If you want to use a Gecko-based browser, then here is a guide:

1. Don’t downplay the security shortcomings because you’re significantly less secure with a Gecko-based browser. I would personally avoid staying logged in to sensitive accounts, etc. Just try to reduce the damage as much as possible in case you get compromised.

2. Get Mull from F-Droid.

3. Follow this guide: Browsers - DivestOS Mobile

[Critical_Crab5543]

@Lukas

If there is a grandpa who uses his phone to read news articles and call his grandchildren and one of his news websites has a zero-day deployed on it, then he is screwed. It’s irrelevant if his threat model is pro max high or bottom of the barrel low.

This is a very unlikely scenario, and just using a Chromium-based browser will not automatically protect you from all zero-day attacks.

@Lukas

It’s completely irrelevant if you’re a regular user, Edward Snowden, or an old grandpa.

Funnily enough, Edward Snowden is a well-known Tor user, so even he uses a Gecko-based browser instead of something like Brave.

[Lukas (Lukas Dutovas)]

@Critical_Crab5543

This is a very unlikely scenario, and just using a Chromium-based browser will not automatically protect you from all zero-day attacks.

That highly depends on the severity, the vulnerability deployed on a website could range from just stealing your cookies to the absolute worst-case scenario where it infects your whole device and gains persistence. The latter one would cost millions, though.

@Critical_Crab5543

Funnily enough, Edward Snowden is a well-known Tor user, so even he uses a Gecko-based browser instead of something like Brave.

In Qubes OS AKA on desktop, the desktop Tor browser is not only more secure but also more private than on mobile.

[anonymous176]

@win11.shading291

Interesting read. From what I understand, except using Tor or waiting for Mullvad Browser to have more users, it’s impossible to really protect against fingerprinting.

I have already another open topic on that though here

Protecting against advanced fingerprinting is probably as you describe, but naive scripts can be fooled through randomization of metrics, and being “in common” with a pool of users is less necessary

[win11.shading291]

Ok thanks everyone! If I summarize:

As far as security goes, using uBO hardmode along with good practices (delete cookies on exit, etc.) should be enough. The user should know in advance which 3rd party to unblock by researching it. I personally ask AI to know which script does what prior to unblocking it.

If there is a zero-day exploit, you might be screwed either way as we don’t know the zero days and what they do.

As for fingerprinting, only Mullvad (once there will be enough users) + VPN or Tor help. But this is for desktop. On Android, there is pretty much no solution as far as I know.