I guess I don’t know what you mean, you just install Firefox, configure it how you want, and leave it. Seems pretty reasonable to me. Firefox is still a great browser, they really do a lot to protect your privacy which is why the forks tend to just use Firefox’s built in features. Like someone who installs Firefox and just turns on Strict enhanced tracking protection is pretty well off, and you can configure it as much or as little as you want. The OOTB defaults aren’t even bad either, Firefox even has a really cool system called Prio where they use multiparty computation to split processing of data between two parties, as well as OHTTP. It’s based on multiple IETF standards, namely OHTTP and Distributed Aggregation Protocol, so even their telemetry is privacy-preserving.
I really think it is for the best to keep people as close to upstream as possible, we don’t know when one of these projects will randomly be abandoned as we saw with bromite, and we don’t know whether the devs will end up falling behind on updates or there will be exploits that aren’t there in vanilla Firefox either due to mistakes or malice. I doubt librewolf and zen browser are getting the same level of scrutiny from experts as Firefox itself.
It’s less than 24 hours for security updates. If that’s not good enough for you and 99.99999% of users and you really are worried about multi-stage Chromium sandbox escape exploits targeting YOU, you are either suffering from main character syndrome or should not be using a smartphone at all.
Why do PG’s privacy standards and aspirations get relaxed when it comes to FF? Other categories go for the all-or-nothing approach with severe impacts on UX and functionality. Yet somehow, someone decided that FF analytics and Mozilla privacy policy is totally fine and there is absolutely no present or future risk associated with it.
You’re not simping hard enough for FF here. FF telemetry and analytics is actually good for you!
I know this community isn’t always rational and objective but allowing such a blatant double standard for a silly browser is beyond me.
Fully agree with you here. Firefox by default is not that great, but you just have to go through the settings (turn off telemetry and sponsored stuff, change search engine, strict anti-tracking on) and install uBO and you’re pretty much good to go. On the other hand, browsers like Librewolf by default break a lot of things so if you want to have a browser that “just werks” you end up with an equal amount of tinkering - putting resistFingerprinting back on, enabling WebGL etc.
Personally, I think the community has too hard of a stance compared to what I would put on the Recs list. I would add IronWolf for mobile browsers, I would add Forward Mail to Mail services, iPhones to Phone recs, and SoloKey 2 seems good enough for a hardware FIDO2 Key solution. Firefox and Brave currently have the about the same amount of tweaks on the PG site, so it seems “good enough” to me with that and everything else taken into consideration. I don’t think Privacy Guides is meant for the most hardcore of users, but to give a majority of people the resources to start their journey and to help make the best decisions possible. If my view is not shared by the community and the team, then I do see the argument for removing FF, but if that is the case then we should be removing tools like Tuta and Mastodon for both technological and philosophical reasons.
LibreWolf has been consistently up-to-date for 5 or so years now. Can’t say the same for Zen Browser. By this logic we might as well drop Cromite for Google Chrome on Android.
I guess we all wanted to recommend a browser that wasn’t built on Chromium.
Don’t you mean IronFox? I agree but it should be another honorable mention since Firefox security is much worse on Android than on desktop.
Along with pretty much every Linux distro and instead tell people to stick to Windows and Mac, and every email provider, and every Android app store except for the Google Play Store and GrapheneOS app store, and replace every desktop and Android browser with Chrome and Edge. At this point there wouldn’t be any more recommendations except sticking with whatever Google, Apple, and Microsoft provide.
That is what you get if you “maximize” security over privacy and anonymity. We know that Chromium-based browsers has better features out of the box, but mitigating that one rare instance of malware shouldn’t mean discounting the Tor Browser for being based on Firefox for example.
What most people don’t understand is that security in the real world (i.e. the workforce) means logging almost every activity. The automatic screenshotting feature seen in Microsoft Recall has started to become more commonplace among work computers. Privacy and security can work together, but only if it is tailored to a specific threat model.
Yes, Linux and Firefox has severe issues with sandboxing. No, that does not make it LESS private than MacOS or Windows out of the box. If we keep thinking about security at all costs, we might as well praise the amazing threat intelligence teams at Big Tech companies and ignore the reason why they invest so much into security-related fields. That is because they need to justify their strategic importance to the U.S. government and prevent antitrust actions.
Couldn’t have said it better myself, someone that finally gets it.
Honestly all I’ve been interacting and seeing from most if not some of the community here is FOSS Extremists or people who think privacy is a bit and not a Quantum Bit or are otherwise more extreme on security at the cost of privacy.
Personally same, I would go forward with IronFox as a mobile firefox alternative to use, the project is amazing for what it is and deserves the respect from the creator @celenity for doing what they can possible to make firefox as secure and private as humanly possible within the confinements of Mozilla.
I also think that people may disrespect llibrewolf but I feel like aside from the fact that there’s no auto update (the workaround is to usually let your package manager update it or controversially but hear me out, on flatpak/microsoft store and enable auto update on those, obviously use flatseal with flatpak, anyways), it does do great as an out of the box experience instead of mandating the user to configure.
I also feel that we could have had a hardening android guide if not for people harping users to still use GrapheneOS (Which I agree for many they should but not all can as we have seen).
That’s all on my matter, idc if there’s an agreement or disagreement, that’s my take on it.
If someone recommended a real-time communication alternative that is less secure than signal, is less functional than signal and requires more configuring out of the box to reach the same level of privacy, it would never be accepted.
The minimum requirements on the browser page are extremely simple and the only reason I think they are that way is so Firefox can be listed. It fails to meet most of the “best-case” requirements.
So does Mullvad? If a person wants a browser that “just werks” I see no reason we should recommened un-hardened firefox when Brave is an option.
Firefox is a great browser. I install it on all my pc because it is very easy to install and configure. Just go through the settings for 1-2 min and you are ready. A LOT more private than Chrome. Brave has better privacy and security feature sure, but that does not make Firefox useless…
In my company we used to use Brave on the company’s PCs but since many websites broke from all the hardening we switched to Firefox. Everything is great now.
Yes and this seems to be a problem since just because something’s more secure doesn’t automatically make it more private. It’s okay to say Chrome is more secure than Firefox, but Google Chrome offering better privacy than any Firefox browser (even browsers like Tor and Mullvad) is just false.
And this is just another one of countless reasons to avoid Windows at all costs. If Linux distros ever implement a feature like that then I’m switching to OpenBSD.
I’d rather be a “FOSS extremist” than some security extremist who doesn’t care about FOSS at all. There’s more to this journey to me than just privacy and security.
We talk about how Firefox isn’t private out-of-the-box and needs to be hardened with Arkenfox. With this logic we might as well recommend XMPP for instant messaging and I wouldn’t oppose it.
The lack of built-in automatic updates and signed, official builds is particularly egregious to me from a security perspective.
Erm actully maximizing security without ditching computers means GrapheneOS (a smartphone) Desktop Mode, which is private too
But I don’t think it would be far-fetched for a breach to happen where up-to-date Chromium would mean the difference for a privacy and security breach, look at Facebook and Yandex’s recent tracking methods that Vanadium wasn’t affected by
Yes, but security can enhance already private services, like in Brave’s case.
The whole thing stems from the difference between what end users and privsec-adjacent (do not do security for a living) technologists think vs what actual security experts know. It is the classic friction between what the reality is vs what the users want the reality to be. It is the same as people wanting to desperately believe in VPNs [1](Use Tor and/or MPRs like Apple relay), Encrypted Emails [2], and idolize encryption garbage piles [3] like lavabit.
Firefox is well known to be way worse than chromium, and people who matter agree:
If anyone wants to see a slightly dated version of what actual security experts (the giants who built most of the tooling used by privsec projects) suggest overall, this is a list built from surveying them: https://techsolidarity.org/resources/basic_security.html
I say slightly dated because this was pre-GrapheneOS getting its edge over iOS (post pixel 8) and before the downfall of 1Password (before they went cloud exclusive post 2017, removing non-cloud options in 2020 iirc).
Do you have someone important who interacts with you? Do you work in a company that is a good ransomware target? Do you have a computer that can become a part of botnet that attacks nation states? Do you recommend your gramps or your kids to use firefox when they are prone to click around stuff? Congrats, you are a main character. Exploitation is becoming accessible and a tool for the massess and states alike. It is naive to think you do not have anything of value.
I think it is fine to have firefox, or to remove it. I do not think it is fine to constantly defend and downplay reality. On a sidenote, literally ALL security researchers would say use a smartphone, and disagree with the line you said about “should not be using a smartphone at all”.
It appears to do more for privacy than Arkenfox but Arkenfox has been around much longer. Phoenix also promotes several extensions which depending on how you see extensions could be a good or bad thing.
I was too lenient on Vivaldi. Security-wise, Vivaldi is Chrome with much slower updates (iirc, they skip over every other Chromium version leaving users with many unpatched vulnerabilities for 2-3 months) and a lots of bloat giving it huge attack surface. Still miles ahead of QtWebEngine and Firefox but worse than just about any other maintained Chromium browser. Even Opera and Ungoogled Chromium would make a lot more sense from a security perspective.
Privacy-wise, it’s still closed source, assigns unique IDs to users, and has mandatory telemetry. Still better than Opera and Edge but arguably just as bad as Chrome and worse than non-hardened Firefox.
I tend to agree. There is nothing standout about stock FF at this point in terms of privacy, it is essentially on the same level as Chrome. You either have to make significant modifications out of the box (or use arkenfox/userjs) or rely on forks like Mullvad / Librewolf.
I just wish Mullvad wasn’t based on ESR but I know why they do it.
Really? I actually love FF because it is simple and straightforward to use. Brave on the other hand feels bloated even if PG recommends it for its fingerprinting resistance that FF lacks. I just hope FF will get better with time. Plus, wouldn’t it be problematic if FF were to stop improving, or worse even, be cancelled? What about Tor Browser and Mullvad Browser then? Wouldn’t it impact them?
maximizing security without ditching computers means GrapheneOS (a smartphone) Desktop Mode, which is private too