The Tor overview says that all browsers being the same is a weakness unique to Tor (and probably Mullvad as well). But aren’t all up-to-date Brave browsers also the same?
Can you provide us with a full quote and link?
Tor Browser is not the most secure browser
Anonymity can often be at odds with security: Tor’s anonymity requires every user to be identical, which creates a monoculture (e.g., the same bugs are present across all Tor Browser users). As a cybersecurity rule of thumb, monocultures are generally regarded as bad: Security through diversity (which Tor lacks) provides natural segmentation by limiting vulnerabilities to smaller groups, and is therefore usually desirable, but this diversity is also less good for anonymity.
It just means single bug in Tor or the base browser applies to all users using Tor browser.
But it also means when there isn’t such bugs, there’s safety in numbers: you look like a whole lot of other Tor users.
Chromium based browser with Tor might add protection in immediate case of Firefox having a vulnerability, but it would also double the attack surface and require even bigger organization to support two browsers.
IMO it’s better to focus on single browser, than cause fear in users with constant “use Firefox today, no wait chrome, no wait neither as both had a bug!” announcements. (This has a slippery slope to don’t use it at all as there’s bound to be an unpatched zero day somewhere.)
The browsers simply aren’t built for a threat model of no bug ever affects it. They’re best effort.
Just ignore that nonsense. While there is such an effect in theory, most security bugs stem from the underlying base, in this case firefox, not from the code tor browser adds on top. So, if this warnung really mattered in practice, you would need to add it to any Chromium-based browser first, since there are way more users of Chromium-based browser than anything else.
Shouldn’t that also go for every browser? Why is Tor specifically singled out?
Because Tor browser is the king of anonymous browsing. And because you were reading about that particular browser. Having everyone in a single bucket improves the anonymity but makes that bucket valuable to attackers, and successful attacks affect everyone in they bucket. It’s worth pointing out, even if you have no solution for the problem.
When you remove the anonymity requirement you’ll get more browsers but that welcomes the discussion about monoculture of ~everything being chromium based 
Sure there’s still Firefox and its forks but the point stands, and this is not browser problem or even IT problem but a capitalism problem.
It sounds to me like you’re saying that this isn’t actually a problem unique to Tor, or a bigger problem for Tor than other browsers, and the guide page is just highlighting it as an imperfection to counteract its reputation as the ultimate invincible browser. Do I understand correctly?
True security comes from knowing the good and the bad of any tool and using the best tool for the purpose. so yeah it’s doing that, warning against trusting it blindly.
My first interpretation of this quote would be that it’s the similarity between users that both makes it anonymous and increases the monoculture problem. I think this is just unclear wording that I hope gets fixed.
The problem with monocultures is that it makes finding vulnerabilities more valuable
I have to agree. It seems like a bad example to illustrate a correct point: tor browser is not built for security above all else. The example is not wrong, strictly speaking, but other factors are likely to matter much more.
Tor Browser is probably the worst of the “main stream browsers” you could be running for security. If it didn’t have its strong fingerprinting protections, it would not be worth using at all.
This would be worth elaborating if you find the time to write about it!
Disclaimer: This is not meant to attack the Tor Browser devs, since they are in a pretty unique situation which forces their hand for many of these regressions.
The biggest regression is using ESR and all the baggage that comes with it. Partial security backports, fewer eyes for security issues and missing the churn that regular releases get. I’d argue the new code being added is better, largely thanks to the AI usage Mozilla has integrated.
Because of fingerprinting concerns, there’s no content‑blocking at all (except in the Tails version, which ships with uBO), so you have to “raw‑dog” the internet.
CRLite is also disabled, forcing reliance on OCSP for certificate revocation, a system that’s being phased out.
On Linux you’re forced to run it under X11 or XWayland, which defeats the improvements Wayland brings over X11.
You can’t selectively disable settings to improve security without breaking the fingerprint‑protection it provides, so you have to switch modes instead, introducing its own set of caveats.
This is all on top of the security issues Firefox by itself already has.
There might be some more stuff I am missing, but I don’t wanna spend too much time on this.
So would you say it’s the need for less fingerprint diversity leading to decisions that weaken security, rather than the lack of fp diversity itself somehow making a piece of software more vulnerable?
Kinda both, since Tor Browser is a very interesting target due to how it gets used.
Just an observation, that is subjective to the reader experience, but this can also be applied to Mullvad browser.
Have the Tor devs given any reason for this? I’d imagine they want to minimize attack surface and they won’t have control over upstream bugs.
But in general you wouldn’t want Tails users to stand out so it’s interesting there isn’t attempt to reach consensus about what both projects should do.
https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/17569 https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/43365
It was supposed to be part of the next stable release in a couple weeks, but it got pushed back to 17.0
https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/17569#note_3328065