Revise statements on Gecko browsers (Android) to make security shortcomings clear

Privacy Guides recommends two mobile operating systems: GrapheneOS and DivestOS.

GrapheneOS comes with Vanadium, which is a browser that I strongly recommend. It’s a browser that is good right now and will be even better in the future. You can read more about its current state and future plans here.

There is already a PR opened for adding Vanadium: (Can’t add more then two links in one post.)

DivestOS comes with Mulch, which is a browser that is similar to Vanadium. One big advantage that Mulch has over Vanadium is that you can use it on other Android operating systems, not just DivestOS.

Mulch currently doesn’t have the adblocking implementation that Vanadium introduced recently, but the developer says that he could probably include it, but there is no ETA: Mulch (Android Browser) - #8 by SkewedZeppelin

We also have Brave, but it has a downside, which is that you need to disable a good amount of junk.

And there is also Cromite, but it seems that it has some kind of issue with licencing or something.

As far as Gecko-based browsers go, PG recommends Tor Browser, which is the only browser that can offer you anonymity.

So why the hell recommend another browser with inferior security when we already have 3–5 good options? Apart from idelogical reasons and nonsense like “Google is bad, which means that Chromium-based browsers are bad, we should use Firefox.”

The only justification for a Gecko-based browser to be a recommendation and not an anti-recommendation is that “there is no evidence that this is an issue in the real world.”

But where is the evidence that this isn’t an issue for most people? So far, people have provided factual and technical information on the security issues of Gecko-based browsers, and the response that they got was: I think that this is not an issue for most people.

The percentage of people using Gecko-based browsers on Android is really small compared to the percentage of people using Chromium-based browsers. We should also consider that only a small number of vulnerabilities that are used in the wild are actually caught being used in the wild. Which leads to the conclusion that these two points alone make the logic of “It’s not the issue unless it’s abused in the real world” completely flawed in this scenario.

4 Likes