Private web browser?

Even microsoft is moving to chromium, google is gaining monopoly over internet and google is google. Which browser or browser modifications/forks would you recommend as privacy oriented? Chrome is for sure not private at all dunno about firefox but i guess it's not 100% private aswell. Opinions?

Tor Browser

I was thinking about this the other day. If privacy is the main concern I don't think there is a lack of software since anyone can whip up a privacy focused browser using the same engine as chrome/chromium. But giving google monopoly over the browser engine market means google decides how web traffic should be interpreted which is a bigger problem than privacy. Mozilla seems to be on top of things still, but they spend more time and money on identity politics and outreach programs than protecting the open web and developing technologies as the time goes by. I'm sure there are other browser projects on the works that can be used. One thing that I saw was netrunner on gitgud.io although I didn't use/compile it. I would love to know if there are other projects like it where they are building their own engines and browsers from the ground up

There's a thread in lambda about this very problem, the op seems to have some ideas worth exploring beyond the now-enclosed web.

>>7636 This 100%. If you can't be bothered to use Tor, then at least use Firefox. The last thing we need is a browser monoculture. It's like people learned nothing from the 90's.

>>7644 Agreed completely, and if you don't trust Mozilla just use one of the forks that rip some stuff out. Just make sure they stick close to LTS releases because it's fuarrrking impossible to keep a modern browser secure these days.

it's worse. Everybody makes webpages that fit google standards so it will be higher up in google. Search engine is google so google can filter/cenzor websites. With article 13 everybody will buy content filters from google so whole internet content will go through google. most used browser is made by google, most used mobile os is made by google, chromebooks kick in as easy solution for end users. Google will control whole internet.

>>7635 I stumbled upon this page, seems like good info/advice: https://digdeeper.neocities.org/ghost/browsers.html

>>7648 >Maybe it's a kind-hearted idea, but in my opinion, the capitalist ad-run Internet has no business existing anymore

>>7636 Tor is impractical for regular browsing, as >>7644 said, you should just use firefox or one of it's many forks, and probably a VPN or proxy if you really want to be safe.

>>7656 >Firefox >Telemetry Although without telemetry firefox is kino

I use modified firefox for casual browsing user.js: https://github.com/ghacksuserjs/ghacks-user.js + VPN and about 25 extensions life is good this way

>>7648 I take anyone that recommends Pale Moon about as seriously as I take anyone who recommends Devuan. Keep fragmenting the ecosystem and diverging your efforts, Google appreciates it.

>private >web browser pick one. I've given up on web browsers. It's only downhill from here. FF was the last hope, but that went in the trash with Quantum. Forks maintained by lone haxor dud3s are useless, because he will get bored and abandon when dreams of browser domination never materialize and it becomes nothing but a lot of hard work. Chrome based stuff like Brave will suffer the same sabotage as FF. My hope is in the next evolution of internet protocol. www needs to die and join the likes of nntp and gopher. Browser was originally intended to browse pages like a big internet magazine. Into that, everyone has tried to shoehorn an entire application platform. It's a very poor fit. Just look at how bad tables are in html for example. They're nothing like native table widgets even though that's what every single web developer wishes they were. Thousands of man years have been wasted trying to implement tables with sticky headers and scrolling bodies with resizing sorting columns. The browser is just soykaf. Offer developers a way out of this horrible mess and win.

>>7659 Yea, and I have a hard time believing a team that small can keep a web browser secure

>>7660 >forks maintened by lone haxor dud3s Nobody is talking about those really, the main players in the fork front is GNU IceCat and ungooglechromium which have lots of contributors. >>7659 >Keep fragmenting the ecosystem, google appreciates it. Yeah because keeping the ecosystem in the hands of giants like mozilla really showed google who is boss. What a weird thing to say when it is agreed google monopoly over the web is one of the main problems here. No filthy capitalists in my web, no ads no moneymaking now. Also DO NOT work on other libre projects that you seem to like, only work on this one I like. What will be the incentive for new people to create competing software without ensuring these?

>>7662 > the main players in the fork front is GNU IceCat and ungooglechromium which have lots of contributors. Icecat is just firefox with a different name and logo because the branding license isn't "libre" enough for the GNU autists. I guess that's still technically a fork but the point is there are no functional changes.

>>7664 ungoogled-chromium should be good but it's being part of google monopoly sadly (tho as a webdev chromium has best tools)

>>7660 New user here, why is Firefox Quantum a bad choice? I thought Mozilla was part of the current standard of security conscious companies.

>>7666 It's not a bad choice, the defaults just aren't optimal. You can still modify it however you like and it is fully open source.

>>7665 yes that's what I was trying to say, the discussion on this has lost focus. Some people are strictly speaking about the google monopoly over the web and some people are talking about privacy features in contemporary browsers. Ungoogled-chromium is a plus in privacy, but is furthering googles reach over the web, correct.

>>7668 Everybody makes websites for google and chromium anyway. i lost any hope in this world but that's more like topic for /hum/

>>7662 The efforts can be much better spent. Rather than screeching about broken add-ons and forking the entire browser, maybe they could look at why that was deprecated. Moving to WebExtensions was necessary. XUL was insecure and had become a bloated mess. If you think you can do a better job by maintaining Gecko instead of directing your efforts toward extending the WebExtensions API in Servo, then by all means, continue in that endeavor. Terry Davis may have been a genius lone wolf, but what impact will TempleOS have on the rest of the world? There are better windmills to tilt at.

>>7656 >Tor is impractical for regular browsing Tor is not impractical, people just assume it is. In reality it's perfectly fine

>>7669 but that's exactly something you support if you use chromium-based browsers. we need more users for other browsers (or rendering engines) to not make google's irrelevant (too late maybe?) so google can't dictate their own standards for the whole web.

>>7671 In my experience it's really fuarrrking slow, probably because of how it works, but then again, I do live in the country in america, so that probably has something to do with it.

>>7673 It's not slow at all for me.

>>7674 It's pretty fuarrrking slow if you take the steps to block 14 Eyes nodes.

>>FF was the last hope, but that went in the trash with Quantum. >New user here, why is Firefox Quantum a bad choice? >>7666 I was primarily referring to rewrites. Rewrites like Quantum are a ridiculous waste of time. Mozilla handed a 2-3 year lead over to Chrome doing that. This is not the first time in Mozilla history to do it either. When they rewrote netscape, they handed the market to Microsoft. Did they learn the first time? No. They did not. Does that mean FFQ is still a good choice? No, it's a worse browser for being rewritten. It's "incompatible" with the web that is now dominated by Chrome. That's not something Mozilla can fix. Average developers now target Chrome and don't really care if things work on FF anymore. Just like they write soykafty React sites that are nothing but an empty div with JS disabled. The user can't fix it. It's on web developers to care. Developers don't.

>>7676 And just so I'm not straying from the topic too much, privacy is the same way. It's on web developers to care. Developers don't. They don't get paid to protect your privacy. They get paid to sell you stuff. How do they do that? They collect as much information as technically possible to analyze your every move on the web in order to improve their "web marketing funnel" for the marketing dept. There is enormous disincentive to protect your privacy among this group of people. Even if all the browser makers cared about privacy, it would still not be private. It would be an eternal cat/mouse game between web developers and browser developers. Even now, browser fingerprinting techniques are closely guarded trade secrets of web marketing companies. Having a good fingerprinting technique that browser devs don't know exist is marketing gold.

>>7676 What the fuarrrk are you talking about, FF was lagging way behind chrome before quantum and it changed FF to be *more* like chrome, several add-ons that were previously chrome-only are now quite easily ported to FF.

>>7678 Because they removed the unique and useful add-on system and moved to google devised web-extension system Present Day, Present Time! AHAHAHAHAHA!

>>7678 FF was behind and is now much further behind. When I say they gave Chrome a 2-3 year lead, that does not imply FF was leading at the time they did so. Furthermore, changing to be more like Chrome is what alienated their remaining users, costing them even further. back to the original declaration >private >web browser pick one If the web browser market has healthy competition, users are easy to fingerprint because of their odd little browser quirks. If it is homogenous, the browser is owned/purchased by a marketing company like doubleclick. Either way you lose on privacy.

>>7679 I find the current extension selection to be better than it was previously. Most things got replacements literally within a few days after the switch to quantum, and most of them are just as good as the previous ones were. >FF was behind and is now much further behind. When I say they gave Chrome a 2-3 year lead, that does not imply FF was leading at the time they did so. Except FF now uses far less RAM and is faster than chrome >Furthermore, changing to be more like Chrome is what alienated their remaining users, costing them even further. speak for yourself.

>>7688 >FF was behind and is now much further behind. the fuarrrk are you talking about? I haven't been happier with Firefox in years. upgrading to quantum made a HUGE difference in performance

the only people talking soykaf about firefox are /g/tards who would rather make 1 million threads bitching about bitches in tech rather than 1 actually interesting thread.

>>7713 In their defense the fact that firefox keeps breaking add ons and extensions every update for some unforseen reason is a valid complaint when chrome based browsers don't experience the same problem as frequently. That and the about:config in firefox changing everytime to complicate privacy settings the user may be setting every update is another thing to complain about. There are valid complaints, but /g/ is as you said out of their fuarrrking mind since they don't know what they're talking about and think their boxkit guide from the arch wiki gives them the best system in the world

have a look at: https://www.privacytools.io/browsers/#browser (There is a reason that Tor is run through firefox)

>>7716 >(There is a reason that Tor is run through firefox) Yes, because Tor is older than Chrome.

>>7700 >speak for yourself http://forums.mozillazine.org/viewtopic.php?f=7&t=3039067 Speaking of the general trend. Market share for FF since Quantum released has fallen from mid-teens to single digit percentages. It's been a bloodbath. Quantum has killed Mozilla.

>>7712 I'll just refer you to this study, https://news.mit.edu/2015/harbinger-failure-consumers-unpopular-products-1223 My guess is that you and other FF users enjoyed crystal pepsi and watermelon flavored oreos as well.

>>7720 I'm a different lainon. A bit after quantum was released and things set down on the add-ons side, I moved back from Chromium to Firefox. I moved to Chromium to begin with because it was faster, and Quantum put Firefox on the same level for me. The add-ons suck on both Chromium and Quantum, and are far away from old Firefox, but things are getting progressivelly better in Firefox to the point it is better than Chromium, for my own biased individual needs. Your article suggests that some people take risks to try new products conscientiously, instead of sticking to the norm. Yeah, that's exactly why I tried Chromium, and then tried back Firefox. I have a different name for it though, open mindedness.

>>7635 We recently had a discussion about this on the #lainchan IRC channel. This all depends on your definition of privacy orientated and your threat model from an information security standpoint and your information distribution models for online interaction , e.g. your online OPSEC and COMSEC. First you need to think about these questions and your own personal answers and circumstances before you can actually evaluate whether other people's recommendations work for you. Then you have to identify what trade off you want between functionality, usability , security and privacy. As the joke / adage goes, the most secure computer is always powered off in a series of locked rooms in a maze nobody knows about (or perhaps https://orwl.org/) , the most private information is the information you yourself don't even know or know you know or know if other people know. Regarding your first point on monopoly is using Blink or Webkit or WebEngine being part of the monopoly ? Does Webkit / Blink derivatives & Gecko + Servo comprise of a duopoly ? Browsers are made of many parts. Starting at the start First you have Browsers that don't give you the choice of a Browser rending Engine. E.g. Chrome / Chromium uses Blink Firefox uses Servo or Gecko depending on the version but doesn't let you choose for a given version. Ditto uses Ditto's own rendering engine. Links uses Links own rendering engine. Netsurf uses Netsurf's own rendering engine. w3m uses w3m own rendering engine. Dooble uses QtWebEngine. Then you have browsers that give the choice of rendering engine Otter Browser (https://otter-browser.org/) lets you choose between QtWebEngine and QtWebkit As does qutebrowser (https://www.qutebrowser.org/) Then you have Konqeuror (https://konqueror.org/) which lets you choose between KHTML, WebEngine, Webkit, with KHTML not being part of Google's monopoly. In this category the browsers with the most functionality that were not strictly tied to Blink / WebKit / WebEngine were 1. Konqueror 2. Netsurf 3. Dillo but that was just for one person's non WebKit / Blink web browser options, please see for further comparisons of browsers https://en.wikipedia.org/wiki/Comparison_of_web_browsers https://en.wikipedia.org/wiki/Comparison_of_lightweight_web_browsers https://en.wikipedia.org/wiki/Comparison_of_browser_engines So now that you have made your choice , either you are using Konqueror for its freedom to choose different browser rendering engines and use KHTML which isn't Blink / Webkit, or you are using a using a browser that lets you choose between QtWebEngine and QtWebkit , and you choose QtWebEngine because as per https://wiki.qt.io/QtWebEngine#Relationship_to_Chromium , Qt WebEngine uses code from the Chromium project. However, it is not containing all of Chrome/Chromium: Binary files are stripped out Auxiliary services that talk to Google platforms are stripped out The codebase is modularized to allow use of system libraries like OpenSSL We do update to the latest Chromium version in use before a Qt release. After a release some bug fixes and security patches are backported. For LTS releases of Qt we might also update Chromium in a patch level release. Or you use a Single Rendering Engine Browser that uses WebEngine like Qupzilla or Dooble (which has been praised for its privacy features and functionality at least in 2015, https://textbrowser.github.io/dooble/) or you say that Webkit is ok and you use a Webkit based browser or you say that Servo is ok , and you use Firefox or say that Gecko or Goanna is ok, and you use a Gecko / Goanna based browser. or Say that Chromium is ok and you use chromium or a fork / derivative of Chromium with security and privacy features. So now you have picked your browser based on rendering engine, Chromium is not Chrome, but still has more Google callbacks and functionality than QtWebEngine, so you try a variety of Chromium forks based on less Google integration and more security privacy ( Iridium, ungoogled-chromium, Brave, Bromite, etc) and configure them with chrome extensions for additional privacy and security use cases. Your only issue is the delay in security updates and fixes they have from upstream chromium / chrome, which is a trade off between security & usability vs privacy and other factors. Or you could use Dooble based on QtWebEngine and customize it to your usecase. Or you choose something like Otter, whose tag line mentions Controlled by the user, not vice versa . Or you choose Palemoon or IceCat or Firefox and attempt customize it with relevant extensions, but bear in mind that Firefox also has its own telemetry which whilst not Google , still impacts your privacy as user. Or you choose something that doesn't implement all of HTML5, CSS2, CSS3 and JavaScript, whether Netsurf, Dillo, w3m or links, but is its own rendering engine and has a smaller code base to audit for privacy issues, and less features to leak private information, so you are happy to make that trade off. As other posters have said, the browsers that use custom web rendering engines have much smaller development teams, and get security fixes much slower, they are not always lone hacker maintained but it is yet another trade off. I don't have a list of extensions for Chromium or Firefox that change specific aspects of a user's privacy to provide in this thread, but other users of those browsers could suggest them. You can also use Tor browser which is a Firefox derivative or proxy your browser traffic through Tor as an additional step to impact your privacy if your threat model and use case justifies it . VPNs are other tools that can change the privacy of your web browser experience if your threat model and use case justifies it.

>>7660 technically speaking IP and www are two things...

>>7664 doesn't icecat use librejs extension by default? that would be a change... not a big one, but it would be one... >>7688 >is what alienated their remaining users, costing them even further. source? >>7700 >Except FF now uses far less RAM and is faster than chrome it still uses too much RAM though :P >>7715 honestly i've never noticed any changes in my about:config after updates >>7720 there was watermelon flavoured oreos? :O

>>7723 Whoa thank you for such long post. otter browser is from Polish fella and is looking pretty sweet maybe ill try it.

So I recently repaired an old laptop. I had it when I was very young so it's full of who knows what viruses and stupid software. I'm not able to factory reset it due to reasons so I'm manually uninstalling and deleting everything. This leads to my question... > What's the best, private browser? As much as I'm comfortable with Chrome on other computers, it's definetely not the mostt private one. Who knows how much metadata the government has on me from Google ALONE. Another thing that sparked my mind is... > If I already had Chrome on the laptop, (which I did), are there any hidden precautions that are still possibly inside my computer that can give out info of my Chrome? Like if I got hacked by some god-like hacker, is there any possible way that they could still get my old information from Google Chrome that was logged on there, post-uninstallment? Anyways sorry if I sounded too broad or stupid. Not my subject, that's why I'm here.

>most private browser tor browser bundle with "safest" security setting. >Like if I got hacked by some god-like hacker, is there any possible way that they could still get my old information from Google Chrome that was logged on there, post-uninstallment? yes, all the old program files will still be on your computer. Delete them.

I usually hear people wage slave firefox, probably because it "cares" about your privacy thus making it more secure, but there is a niche voice coming from some people such as security researchers and people who know what their doing saying Chromium is the better choice in terms of security. All I know is that Chromium has an amazing sandbox but what else?

Follow your heart.

>>8394 You're conflating "security" with "privacy". Chromium is fine if your threat model doesn't include "track all the things" anti-privacy Google. Firefox is for those of us whose threat model *does*.

Use a Chromium based browser for things that need to be over your home connection and Tor Browser for everything else

> firefox - Has perpetual performance issues - Has better features than chromium (screenshots, pin tabs not sucking) - Not maintained by Big G. - Considered Bloated Chromium - Industry "standard" - Has 85%+ of the userbase because of Big G - Inferior Extension Support (imo) - Maintained by Big G - Did I mention it was maintained by Big G?

>>8394 Huh, I wrote a huge post about browsers here, but my network connection died today, because of a storm, so I have to write a new one. Generally both FF and Chr are spyware, but Chr is more. Here you go, two good enough articles about these browsers: https://spyware.neocities.org/articles/firefox.html https://spyware.neocities.org/articles/chrome.html >All I know is that Chromium has an amazing sandbox but what else? Yeah it also downloads binary blobs from Google, changing Chromium into Chrome What's good about these browsers is that you have the source code, which allows making forks that are not spyware - best ones are: GNU Icecat - as you should know, GNU Project is an effort to create a fully free (as in freedom) operating system. Being a GNU package means the program is free software, respects users' freedom and by that should not have malicious features. Icecat as a FF fork has some cool built in features - like an API for blocking website content, this allows great control over your privacy using addons like Umatrix - basically a firewall inside a browser or Ublock Origin - adblocker. https://spyware.neocities.org/articles/icecat.html Ungoogled Chromium - is just Chromium, but with Google's soykaf removed. Don't know the current state of Chrome, but Google, as they control meaningful part of overall advertising on the Internet, decided to make it harder to block content including ads and analytics. Ungoogled Chromium still supports Umatrix and Ublock, but don't know what are they going to do, if Google disables it. It was called the Manifest V3. https://spyware.neocities.org/articles/ungoogled_chromium.html There's also Tor browser (a firefox fork), but it isn't suitable for like 90% of all websites, because they require JavaScript to work.

>>8402 Also, forgot to mention - Google is a motherfucking company. "Be evil" is their main motto, they have to much power, stay away from them at all cost. https://www.gnu.org/proprietary/malware-google.html https://stallman.org/google.html

Just because one thing is technically 'more secure' doesn't mean the other is inadequately secure. Enjoy getting probed by Alphabet. It's worth it just to take away that much of their market share. Chrome's engine represents way too much of how people view the internet, and it's dangerous. Especially considering how incredibly unscrupulous Alphabet is. I mean you can say you don't care, that's your prerogative, but the situation is pretty clear.

chromium *used* to be objectively superior. Nowadays firefox is just as secure as chromium, having adopted most of the same security mitigations as chromium.

It depends. For example, you should NEVER use Firefox based browsers on an Android device: https://grapheneos.org/usage#web-browsing

>>8406 This is some great info, thanks for bringing it. Ugh I kind of hate Android, linux phone when?? I feel like we'll never get a FOSS cellular radio stack, and that's always gonna be an Achilles' heel. Huge bummer.

>>8407 And before somebody says it—yes, I know android is based off linux. But it's no longer linux; it's become proprietary in areas that are too critical to still consider linux in spirit imo

>>8407 >>8408 You've fallen into a trap of calling Linux an OS, whereas it is just a kernel. The real OS you think has "linux in spirit imo" is GNU/Linux. https://www.gnu.org/gnu/gnu-linux-faq.html.en#usegnulinuxandandroid https://www.gnu.org/gnu/gnu-users-never-heard-of-gnu.html https://www.gnu.org/gnu/gnu-linux-faq.html.en Generally speaking the GNU operating oystem was started in 1984 by Richard Stallman - GNU devs finished everything but a kernel (but they started developing one https://www.gnu.org/software/hurd/) , Linus Torvalds started Linux as a Minix clone in 1991 - it was intended to be a complete OS too, but distrubutors merged GNU with Linux, created GNU/Linux and Torvalds and other Linux devs never did nothing more than the kernel. And there are some efforts: https://puri.sm/products/librem-5/ https://www.crowdsupply.com/libre-risc-v/m-class <- this one is more a fundamental to make it possible to run a fully free GNU/Linux distribution on a phone.

>>8409 >never did nothing more than the kernel. *never did more than the kernel

>>8406 >It depends. For example, you should NEVER use Firefox based browsers on an Android device: Horseshit. Tor Browser for Android is Firefox-based.

>>8409 Don't be such a PITA. It just makes GNU look bad. Also, take your OCD meds.

>>8409 Oh I know what GNU is. Using linux as shorthand for the spirit of all that is perfectly well understood and common shorthand by now. Thanks for posting the info though. I'm still waiting on Librem as well, but afaik they aren't trying to do the cellular radio stack. They're just providing a hardware switch to positively shut it off. Would be nice if that part was also FOSS, but so far there's nothing but proprietary that I know about in that area. The Gemini PDA also has some attempt at linux on a phone, but it's pretty full of problems and also has an owned baseband processor.

Seamonkey way better than firefox from privacy standpoint and it seem to continue supporting the original addons. Official addon site: https://addons.thunderbird.net/en-US/seamonkey/ A lot of addon creator didn't know I think they can migrate to the above... so there is... an unofficial collection of original addons, too: https://legacycollector.org/ Cons: as with the original firefox, it's slow as hell compared to chrome, but who said you need to use it for everything

>>8417 >Don't be such a PITA. It just makes GNU look bad. I had no intention to be offensive and I just wrote the truth and links supporting it. I'm correcting people, because calling the freedom respecting system only after Linus Torvalds, who added just the kernel and adds binary blobs into it is not okay. It caused lot's of harm to the community. >Also, take your OCD meds. At this point you are assmad, I didn't write any personal attack in my post, you did. >>8418 >Oh I know what GNU is. Using linux as shorthand for the spirit of all that is perfectly well understood and common shorthand by now. Thanks for posting the info though. The problem is nobody knows about GNU, its mission, and calling the system after the kernel is confusing, for example when you talk about Android and have to add another layers of abstraction to make it sensible. It is also really unjust to ignore all these developers, who contributed to GNU, by calling their system Linux. People know that little about the system, they write things like "linux bash", while bash is a GNU package. It really hurts when someone hijacks your system and takes all credit for it. If you don't want to spread misinformation and you do respect the mission and hard work of the developers of the system, call it GNU/Linux please. https://www.gnu.org/gnu/gnu-linux-faq.html.en#everyoneknows2 https://www.gnu.org/gnu/gnu-linux-faq.html.en#everyoneknows

If you want privacy and security you have to run Firefox in a dedicated VM

>>8421 >If you want privacy and security you have to run Firefox in a dedicated VM A VM won't fix fundamental privacy flaws of Firefox - it is only going to hide your real system from the browser, but it will still send telemetry data with your IP to Mozilla and websites you visit to google (protection against phishing and malware is provided by google). Better solution would be running a privacy-respecting browser iside a VM, or a sandbox - there's a cool lightweight tool on GNU/Linux called "firejail" - it uses native sandboxes of the Linux kernel. https://firejail.wordpress.com/

>>7635 Every browser claims to be private. Your question is asking for a retarded answer like "Brave".

>Which browser or browser modifications/forks would you recommend as privacy oriented? Chrome is for sure not private at all dunno about firefox but i guess it's not 100% private aswell. Opinions? Icecat, tor and similar firefox forks are fine but at the end of the day it all comes down to which websites you're using. You can have 100+ privacy oriented extension on firefox, it does't make a difference if you're using horrible services such as google/fb/twitter/youtube etc. If you want privacy while browsing don't use these services and you should probably just straight out block them completely.

I would take a primitive af browser if I'm guaranteed it'll just get the text and relevant media, nothing else. The frontend can be a slightly disorganised black screen with white text for all I care

>>8451 If you're not already on an OS with a good CLI available to you, get that and then get elinks or lynx or something along those lines

>>7675 What are those steps?

lain >>>6861 recommends: >>8276 >SecBrowser is essentially Tor browser without Tor, but with all of the other hardening improvements. >https://www.whonix.org/wiki/SecBrowser

>>8456 isn't this just firefox with security addons? >Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0

>>8457 >isn't this just firefox with security addons? I don't think so. The linked wiki page refers to "patches". The tor browser has a "design document" at "https://www.torproject.org/projects/torbrowser/design/", which describes its eg. security model. This design is maintained by the Tor project, not Mozilla, recording their differences in goals and views. Both link to "https://gitweb.torproject.org/tor-browser.git". If you check the "refs", you will see names like "tor-browser-38.5.0esr-5.0-1" or "tor-browser-38.5.0esr-5.0-2". (Another way to quick insight is where they track moving their patches from one Firefox release to another, https://trac.torproject.org/projects/tor/ticket/15197 is one example). If you check the logs for such a ref, you will see commit messages with bug numbers. These numbers refer to bug numbers on their tracker such as https://trac.torproject.org/projects/tor/ticket/15502 (picked at random). I don't know how much of these bugs applies to clearnet browsing or how much goes back to Firefox, but I would say they are definitely more than "just addons".

>>8458 >>8457 The design document link is: https://www.torproject.org/projects/torbrowser/design/

>>8456 Disclaimer that trusting some random person's reinvention of the wheel of Tor is potentially extremely dangerous. Takes a lot of effort and resources to make something secure and hunt down every possible bug and exploit.

>>8459 i still dont see how this is anything but a firefox client with various privacy settings and modifications that are already available.

>>8457 Also, what? This thread is about privacy, not security. SecBrowser is very explicitly not designed around privacy, just reducing the vectors for malicious attack. It strictly says it's not anonymous.

>>8462 anonymity and privacy are related but not the same thing. It is perfectly valid to want to avoid being fingerprinted(which would fall under privacy) but not wanting to use Tor. Your IP address is one of many, many, many ways you can be tracked, and it's not the most unique one.

>>8458 >I don't know how much of these bugs applies to clearnet browsing or how much goes back to Firefox, but I would say they are definitely more than "just addons". The end goal is to have as many of the Tor modifications included upstream into Firefox as possible. Who knows, maybe some day Tor browser will just be Firefox's "extra-super-private browsing mode". https://wiki.mozilla.org/Security/Tor_Uplift

>>8460 TLDR: the secbrowser is just a starter script for vanilla tor browser with a few settings changed to disable tor. > reinvention of the wheel of Tor It is not "Tor" they are reinventing for sure. It is about the browser component. The Tor component is about the networking (and they remove it). >potentially extremely dangerous. Right. (Vigilance can be good.) >trusting some random person's The thing is, you don't have to. >Reproducible Builds is a feature they highlight right on that wiki page. (Random pic mildly related.) I made a post showing how to go directly from https://www.whonix.org/wiki/SecBrowser to building the deb on your own machine. You can read it here: >>>/sec/8476

I use Qutebrowser

>>8481 I love qutebrowser. It works great for sites that I trust but I've found that the options for content blocking (just host based blocking and blanket "turn javascript on/off" type options) are a little too limited for general web browsing. If there were a plugin that replicated the functionality of umatrix I'd use it exclusively.

>>8482 Umatrix is one of the big reasons I'm still using Firefox. Mozilla's made some questionable decisions in the past few years, but that extension is utterly unmatched for controlling complex website behaviour in an easy and fast way. I won't switch browsers so long as Umatrix-like control is unavailable elsewhere.

>>8483 to be honest re-implementing umatrix for qutebrowser would make a really good lainchan group project. writing extensions for qutebrowser is much easier than writing webkit extensions imo because it's just python and you get pretty much free reign over the browser's internals (it's kind of like extending emacs in that sense). i don't have the time or domain-specific knowledge to lead it at the moment but i'd contribute if someone got the ball rolling.

>>8484 wait... maybe i'm thinking of something else. i don't know what qutebrowsers extension api looks like but worst case we could probably fork it. the code isn't that convoluted since its a relatively new project.

>>8486 for reference: https://github.com/qutebrowser/qutebrowser/issues/30 https://github.com/qutebrowser/qutebrowser/issues/28

My 0.02 cents: >Hardened Firefox for day to day browsing on most systems, as it gets quick security patches compared to its forks >Iridium on OpenBSD (or Ungoogled Chromium if you can maintain it) because of pledge/unveil support >Tor browser for anonymous browsing >Bromite on Android phones because it properly integrates with Android security unlike pretty much everything else >I have heard that SnowHaze is good on iOS

Tor Browser Ungoogled Chromium Gnu IceCat WaterFox Pale Moon/Basilisk Konqueror

>>7636 this , its also the fastest one also fuarrrk java

>>8567 there's nothing """private""" about any of those

>>8595 >any Okay

>>8595 >there's nothing """private""" about any of those Explain why. >Tor Browser >Ungoogled Chromium >Gnu IceCat These three are good ones actually.

>>8456 This.

I've been messing with Dissenter Browser, Seems to have a pretty decent ad block along with it. They forked Brave and further took out things implemented in Brave and added functionality to let you open a private browsing window with TOR.

>>8639 >private browsing window with TOR That's already in Brave

The most private you can get seems to be VM instances hooked to different vpn outlets to separate data. Don't have to rely on browser quality. Just assume it's broken and separate into multiple online personas. So one instance runs all the broken crap unhinged, one is more secure and a final one runs the important soykaf.

Brave disturbs me for some weird reason.

>>8719 >Brave disturbs me for some weird reason. Brave disturbs me because the developers are trying to get in bed with advertisers. I don't want my browser to cooperate with that industry. I want my browser to be ultra-hostile to anyone even remotely connected to the advertising industry. Even though Mozilla's pulled some weird soykaf in the past few years, I'll still take Firefox with a bunch of ad/tracking-killing extensions over Brave anyday.

>>8598 no, explain why any of those (except Tor Browser, obviously) have ANYTHING to do with privacy >>8639 >>8640 ALL BROWSERS WORK WITH TOR. YOU MORONS >>8720 Brave replaces ads with "ethical" ones. Post proof that they actualy want to "get in bed" or whatever the fuarrrk. I'm too tired to read your garbage hearsay. But I agree, Brave is utter garbage. The web SHOULD NOT be commercialized. "Ethical" ads are still commercialization, and lead to garbage inaccessible content. Case in point, go on Google Images right now. Can you actually look at the image you search for? Of course fuarrrking not, because fuarrrk you, give us a $1 tip first, this is a business, not a tool.

>>7635 The only private browser is the Tor Browser, and even that is a piece of soykaf because it's a browser. Ad Blockers etc are for improving your experience - they don't provide privacy. Threads like these are pointless.

>>8804 finally a sane comment in a browser thread you win 9000 internets

>>8803 > Post proof that they actualy want to "get in bed" or whatever the fuarrrk. I'm too tired to read your garbage hearsay. They force you to use Google Play because they don't understand attestation. It's essentially becoming a DRM platform for ensuring that ads are delivered how they want them to be. See: https://nitter.net/DanielMicay?max_position=1154510347656560640 https://nitter.net/DanielMicay?max_position=1155169130997256198

>>8803 >ALL BROWSERS WORK WITH TOR. That's like saying all colors work with camouflage.

>>8831 It's not at all like saying that.

>>8831 Can you elaborate? Custom patching different from the Firefox main for is for anti-fingerprinting. https://2019.www.torproject.org/projects/torbrowser/design/#app-data-isolation https://wiki.mozilla.org/Security/Tor_Uplift/Tracking All of the techniques described that aren't reconfigured FF settings are available as patches.

>>8833 >>8834 Yes you can use Tor with any browser but then you're wearing pink hotpants in the middle of the jungle and it kind of defeats the point of using Tor because you'll be easy to identify and track everywhere you go. This is especially if you're temped to use your super private hipster browser for Tor + non-Tor browsing, that will link your Tor and non-Tor identities together with the same fingerprints and break anonymity as well as privacy.

>>8835 Yeah but that's conflating the *ability* of use with your personal configuration and use case. If you use any browser like a moron you're going to have a bad time. This isn't Tor specific. Please lmk what the difference is in fingerprinting between FF latest with the Tor patches/settings applied and the TBB if you use them the same way (segregated from your personal life).

>>8839 >Please lmk what the difference is in fingerprinting between FF latest with the Tor patches/settings applied and the TBB >Firefox 60.9.0esr + TBB patches (official TBB) >Firefox 69.0.3 + TBB patches (your thing) >How are they different? Derp.

>>8840 >please let me know what the difference is in fingerprinting >fingerprinting derp

>>8842 Not him but different versions of the same browser can have different fingerprints if they enable different features. e.g. your newer firefox might have new features or APIs or configuration options which the TBB patches don't fix yet because they are based on the stable ESR release. It seems like you should calm down and think this through a little more.

>>7635 I mean if you want a private and secure web engine you need webkit, gecko etc. Assuming the engines themselves are stripped of botnet they are the most secure thing you will get due to the fact that they are mature and a lot of people work on them all day. While the engine can be considered secure what is the real security is the implementation around it like what you block. The engine's job isnt to be secure but to handle all the javascript html and other crap. If you want an alternative web engine look at netsurf and serenity's libhtml

>>8850 No one is upset, but thanks for trying.

>>7636 >>7644 TOR is only actually private and secure when browsing within the TOR network. It is absolutely not secure otherwise. Furthermore, connect to a VPN, then connect to TOR. This prevents your ISP from knowing you're on the TOR network.

>>8850 >>8840 >different versions of the same browser can have different fingerprints if they enable different features I see your point, you are correct and I am wrong. My point being, if no new visible features are added to another FF release, what's the difference? There's nothing inherent to the TBB that you can't accomplish yourself manually with a similar version of FF.

>>8856 i agree with your first point but the other one is bad advice, if you want to hide the fact that you're using tor you should use bridges. connecting to tor with a VPN is a bad idea, the tor project specifically recommends against it, see https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN. i think this sums it up perfectly, "A VPN/SSH acts either as a permanent entry or as a permanent exit node." basically, unless you have something specific in mind, you should not use a VPN with tor. good OPSEC is much more efficient than layering yourself in connections.

>>8858 good point. bridges alone can be a better option due to the possibility of VPN/Proxy fingrprinting attacks. But much like all things in security, nothing is safe-- but we can move risk around a bit. if your VPN provider is competent, it does hide TOR from you ISP and if TOR breaks, it shields your real IP from the TOR leak. The problem is when using a public VPN, you are now putting your trust into the private party running the thing.

>>8856 What about herd immunity? I'd think that unless you're doing deep dark soykaf you should go ahead and be part of low-opsec TOR to shelter others. Then dig down when you need to get funky. Part of this equation is the greater good. Lots of people using it openly makes it less sus.

>>8860 yeah i see what you mean, i wonder how effective a pfsense firewall would be for that scenario.

>>8864 Why argue about the freedom to talk about :edgy" stuff but never do anything? The only freedom of speech that matters is the freedom to speak with action, everything else is a ploy by the status quo to maintain it's regime.

What is a reason for wanting to hide the fact that you are using tor from your ISP? Am I missing something?

>>8454 > What are those steps? Restricting the connection to nodes based on their GEOIP. Example, in your torrc/tor.conf: ## NINE EYES Exclusion ExcludeNodes {??},{US},{CA},{GB},{AU},{NZ},{ZA},{DK},{NL},{FR},{NO},{CN},{MN},{KP},{TW},{VN},{KH},{LA},{RU},{UA},{CU},{BY},{LT},{LV},{EE},{GE},{KZ},{UZ},{TJ},{IL},{PS},{IQ},{IR},{AF},{SA},{SY},{AM},{TR},{AZ},{LB},{JO},{EG},{LY},{AE},{YE},{KW},{BH},{KG},{OM},{QA},{TM},{PK},{SD},{SS},{ET},{SO},{ER} ExcludeExitNodes {??},{US},{CA},{GB},{AU},{NZ},{ZA},{DK},{NL},{FR},{NO},{CN},{MN},{KP},{TW},{VN},{KH},{LA},{RU},{UA},{CU},{BY},{LT},{LV},{EE},{GE},{KZ},{UZ},{TJ},{IL},{PS},{IQ},{IR},{AF},{SA},{SY},{AM},{TR},{AZ},{LB},{JO},{EG},{LY},{AE},{YE},{KW},{BH},{KG},{OM},{QA},{TM},{PK},{SD},{SS},{ET},{SO},{ER} EntryNodes {DE},{AT},{CH},{ES},{PT},{IT},{SM},{VA},{IS},{GL},{BE},{SE},{PL},{CZ},{AD},{MC},{LI},{MT},{GR} ExitNodes {DE},{AT},{CH},{ES},{PT},{IT},{SM},{VA},{IS},{GL},{BE},{SE},{PL},{CZ},{AD},{MC},{LI},{MT},{GR},{CY},{FI},{RO},{HU},{SI},{SK},{MA},{DZ},{TN},{MD},{AL},{MK},{ME},{RS},{HR},{BG},{BA},{IN},{KR},{JP} ## FIVE EYES Exclusion #ExcludeNodes {??},{US},{CA},{GB},{AU},{NZ},{ZA},{CN},{MN},{KP},{TW},{VN},{KH},{LA},{RU},{UA},{CU},{BY},{LT},{LV},{EE},{GE},{KZ},{UZ},{TJ},{IL},{PS},{IQ},{IR},{AF},{SA},{SY},{AM},{TR},{AZ},{LB},{JO},{EG},{LY},{AE},{YE},{KW},{BH},{KG},{OM},{QA},{TM},{PK},{SD},{SS},{ET},{SO},{ER} #ExcludeExitNodes {??},{US},{CA},{GB},{AU},{NZ},{ZA},{CN},{MN},{KP},{TW},{VN},{KH},{LA},{RU},{UA},{CU},{BY},{LT},{LV},{EE},{GE},{KZ},{UZ},{TJ},{IL},{PS},{IQ},{IR},{AF},{SA},{SY},{AM},{TR},{AZ},{LB},{JO},{EG},{LY},{AE},{YE},{KW},{BH},{KG},{OM},{QA},{TM},{PK},{SD},{SS},{ET},{SO},{ER} #EntryNodes {DE},{AT},{FR},{CH},{ES},{PT},{IT},{SM},{VA},{IS},{GL},{DK},{BE},{NL},{NO},{SE},{PL},{CZ},{AD},{MC},{LI},{MT},{GR} #ExitNodes {DE},{AT},{FR},{CH},{ES},{PT},{IT},{SM},{VA},{IS},{GL},{DK},{BE},{NL},{NO},{SE},{PL},{CZ},{AD},{MC},{LI},{MT},{GR},{CY},{FI},{RO},{HU},{SI},{SK},{MA},{DZ},{TN},{MD},{AL},{MK},{ME},{RS},{HR},{BG},{BA},{IN},{KR},{JP} ## 14 EYES Exlusion #ExcludeNodes {??},{US},{CA},{GB},{AU},{NZ},{ZA},{DK},{NL},{FR},{NO},{DE},{SE},{BE},{IT},{ES},{CN},{MN},{KP},{TW},{VN},{KH},{LA},{RU},{UA},{CU},{BY},{LT},{LV},{EE},{GE},{KZ},{UZ},{TJ},{IL},{PS},{IQ},{IR},{AF},{SA},{SY},{AM},{TR},{AZ},{LB},{JO},{EG},{LY},{AE},{YE},{KW},{BH},{KG},{OM},{QA},{TM},{PK},{SD},{SS},{ET},{SO},{ER} #ExcludeExitNodes {??},{US},{CA},{GB},{AU},{NZ},{ZA},{DK},{NL},{FR},{NO},{DE},{SE},{BE},{IT},{ES},{CN},{MN},{KP},{TW},{VN},{KH},{LA},{RU},{UA},{CU},{BY},{LT},{LV},{EE},{GE},{KZ},{UZ},{TJ},{IL},{PS},{IQ},{IR},{AF},{SA},{SY},{AM},{TR},{AZ},{LB},{JO},{EG},{LY},{AE},{YE},{KW},{BH},{KG},{OM},{QA},{TM},{PK},{SD},{SS},{ET},{SO},{ER} #EntryNodes {AT},{CH},{PT},{SM},{VA},{IS},{GL},{PL},{CZ},{AD},{MC},{LI},{MT},{GR} #ExitNodes {AT},{CH},{PT},{SM},{VA},{IS},{GL},{PL},{CZ},{AD},{MC},{LI},{MT},{GR},{CY},{FI},{RO},{HU},{SI},{SK},{MA},{DZ},{TN},{MD},{AL},{MK},{ME},{RS},{HR},{BG},{BA},{IN},{KR},{JP} ## FIVE EYES Inclusion (BYPASS) (use for geoip region locked data in FIVE EYES) #ExcludeNodes {??},{CN},{MN},{KP},{TW},{VN},{KH},{LA},{RU},{UA},{CU},{BY},{LT},{LV},{EE},{GE},{KZ},{UZ},{TJ},{IL},{PS},{IQ},{IR},{AF},{SA},{SY},{AM},{TR},{AZ},{LB},{JO},{EG},{LY},{AE},{YE},{KW},{BH},{KG},{OM},{QA},{TM},{PK},{SD},{SS},{ET},{SO},{ER} #ExcludeExitNodes {??},{CN},{MN},{KP},{TW},{VN},{KH},{LA},{RU},{UA},{CU},{BY},{LT},{LV},{EE},{GE},{KZ},{UZ},{TJ},{IL},{PS},{IQ},{IR},{AF},{SA},{SY},{AM},{TR},{AZ},{LB},{JO},{EG},{LY},{AE},{YE},{KW},{BH},{KG},{OM},{QA},{TM},{PK},{SD},{SS},{ET},{SO},{ER} #EntryNodes {DE},{AT},{FR},{CH},{ES},{PT},{IT},{SM},{VA},{IS},{GL},{DK},{BE},{NL},{NO},{SE},{PL},{CZ},{AD},{MC},{LI},{MT},{GR} #ExitNodes {DE},{AT},{FR},{CH},{ES},{PT},{IT},{SM},{VA},{IS},{GL},{DK},{BE},{NL},{NO},{SE},{PL},{CZ},{AD},{MC},{LI},{MT},{GR},{CY},{FI},{RO},{HU},{SI},{SK},{MA},{DZ},{TN},{MD},{AL},{MK},{ME},{RS},{HR},{BG},{BA},{IN},{KR},{JP} #ExitNodes {US},{CA},{GB},{AU},{NZ},{ZA},{IT},{SM},{VA},{IS},{GL},{DK},{BE},{NL},{NO},{SE},{PL},{CZ},{AD},{MC},{LI},{MT},{GR},{CY},{FI},{RO},{HU},{SI},{SK},{MA},{DZ},{TN},{MD},{AL},{MK},{ME},{RS},{HR},{BG},{BA},{IN},{KR},{JP} #ExitNodes {US},{CA},{GB},{AU},{NZ},{ZA}, From here: https://raw.githubusercontent.com/endwall2/endconf/master/endtorrc

>>8866 In some places you could land in jail for using it. >>8873 >N-eyes >{UA},{CU},{BY} >endwall Nice meem. You are only reducing your anonymity set by using the only left obscure African exit nodes hosted at US military bases lol.

>>8874 > You are only reducing your anonymity set by using the only left obscure African exit nodes hosted at US military bases lol. I never said it was a good idea, they asked how to do it.

>>8874 >In some places you could land in jail for using it. Wait, but isn't that what bridges are for?

>>8880 It is possible to harvest these bridges manually and jail everyone who's connecting to their addresses. ISPs and cell carriers will throttle or drop unknown protocols through DPI in many restricted firewall situations too. A plain VPN protocol usually raises no suspicion since many companies use VPNs for extending their intranets and a user might be one of said companie's employees.

>>8883 Interessting. I never knew that. Thanks Lain!

AAAAAH where did this dude get these extensions in crx2 from?

>>8899 function get_browser() { var ua = navigator.userAgent, tem, M = ua.match(/(opera|chrome|safari|firefox|msie|trident(?=\/))\/?\s*(\d+)/i) || []; if (/trident/i.test(M[1])) { tem = /\brv[ :]+(\d+)/g.exec(ua) || []; return { name: 'IE', version: (tem[1] || '') }; } if (M[1] === 'Chrome') { tem = ua.match(/\bOPR|Edge\/(\d+)/); if (tem != null) { return { name: 'Opera', version: tem[1] }; } } M = M[2] ? [M[1], M[2]] : [navigator.appName, navigator.appVersion, '-?']; if ((tem = ua.match(/version\/(\d+)/i)) != null) { M.splice(1, 1, tem[1]); } return { name: M[0], version: M[1] }; } var browser = get_browser(); var browser_version = browser.version + '.0'; var href = location.href; if(href.includes('?')) { href = href.substring(0, href.indexOf('?')); } var ext_id = href.match(/([^\/]*)\/*$/)[1]; var final_url = 'https://clients2.google.com/service/update2/crx?response=redirect&prodversion=' + browser_version + '&x=id%3D' + ext_id + '%26installsource%3Dondemand%26uc'; window.location.href = final_url;

>>7659

>>8883 Because harvesting all Tor bridges which are deliberately obfuscated to make them hard to harvest is ok but figuring out what is a commercial vs corporate VPN is impossible.

>>8912 No its not you just look at the single ip all the traffic is going to. Thats how 4chan disallows posting with certain vpns

Anyone tried the Avast browser?

use antidetect

>>8954 >Anyone tried the Avast browser? Avast is nonfree software, which is malware by design. https://www.gnu.org/proprietary/proprietary.html

>>8954 lmaooooooooooooooo

>>8452 Different Lainon. I'm aware there's much more to do for the benefit of security than just a web browser, but on that topic, I've been browsing Lainchan on Lynx just now. It works pleasantly well, aside from a small problem with the default image viewer which I have fixed. This is to test how plausible it is to both browse and post here.

>>8993 Back again, now I'm attempting an image post. Hope you don't see my directory structure. If this works, Lynx should be fairly viable.

>>8954 Nice bait

>>8994 Nice! And some Planetes to boot, good taste

>>8994 meh, lynx is pretty barebones and is oldschool, but i've never heard anyone mention anything about it concerning privacy. has it been vetted? i still use it on occasion, usually on days that i also do everything with my left hand. at least go for a browser that makes sense, security-wise like this one >>8954 avast is an ANTI-spyware spyware company, folks. That said, stay away from orbot. I was on the android hackers forums when this was being developed. The forum members found some funny business (like backdoor) and the guy building it gave a response that made it pretty clear it was intentional.

>>9226 I think the argument for lynx is that it doesn't run a bunch of javacrap, which certainly puts a dent in the tracking. It has less variables to fingerprint too, but in order for that to be especially effective we'd need more people using lynx. Which I think would generally be a good thing. Modern web browsers are an abomination, they've gotten way too fat. But you're essentially correct, it isn't specifically designed for privacy. I'd love to see an analysis of how it does versus various techniques. Now if you'll excuse me, this old man has an appointment to yell at a passing cloud

reddit.com/r/degoogle

>>7656 Tor has come a long way. I browse using it for almost all of my casual internet use.

>>7671 I hope you enjoy captchas

>>7635 I like Palemoon, but it's not as secure as Tor of course

>>9337 I tried out Pale Moon once, and found it slower than regular Firefox. What do you like about Pale Moon?

>>9487 I use Palemoon right now, for the heck of it more than any real reason. I don't know how secure it is as it's an older FF framework, but the dev seems to be up to date and of course there's no telemetry (for what it's worth on Windows). However there are so few Palemoon users you leave an extraordinarily unique fingerprint which invalidates the whole privacy aspect. I'm not sure it's worth it, but otherwise it works fine and I like the UI.

>>9490 was that comparison to firefox? yes, there's some telemetry on by default but it takes a few clicks to disable it... doesn't seem like such an issue. though go you, even though i prefer firefox myself, i think it's great people use forks and soykaf (diversity and stuff)

Up-to-date and GPG verified Tor Browser.

I stumbled across this site from the chromium team while trying to troubleshoot something for my job. https://www.chromium.org/Home/chromium-security/brag-sheet tl;dr it highlights the security of chromium compared to other web browsers I've been using pale moon for awhile but I'm starting to doubt it's security, should I just go for ungoogled chromium? inb4 google bad, X good

>>9926 >palemoon doubts Your doubts are good. https://spyware.neocities.org/articles/palemoon.html >inb4 google bad, X good Well, this isn't google. So, it's fine. https://spyware.neocities.org/articles/ungoogled_chromium.html

>>9928 People seem to always be recommending to use gecko based browsers, and never chromium. Some examples include people saying chromium is malware by design, you can never remove it's data mining, and that has zero security (lol). I don't get why unless people are forcing FF or desperately want to bring chromium's market share down.

>>9926 > ungoogled chromium Use either that or Firefox, unless you want to go full links/lynx or (suckless) surf or NetSurf. Whatever you do, don't use Opera or Chrome or any other proprietary browsers. They are botnets. One thing worth mentioning is that lynx has built-in support for gopher. BTW, does anyone know whether the Midori browser project (https://www.midori-browser.org) is still alive? See these pages for more info: http://links.twibright.com/ https://lynx.invisible-island.net/ https://surf.suckless.org/ http://www.netsurf-browser.org/ On gopher: https://gopher.floodgap.com/gopher/ https://gopher.floodgap.com/overbite/relevance.html

>>9930 Gecko and Chromium [webkit/webengine(?)] are false dichotomies. It depends on your threat model (or maybe your idea of security), but you're probably not going to use that - You likely want to use a text-based browser. The issue with text-based browsers is that it won't entirely show whatever website you're viewing in the manner it was meant to be shown. (Although, you could argue that is a positive thing.) Anyways, before I go off into a huge tangent: It is true that if you're picking one or the other, Firefox/Gecko is going to be a better option due to the fact that it gives you so much control. >malware by design >never remove its data mining I'm responding to both with one sentiment: I am in the camp that the majority of port 80/443 is malware by design. >zero security That's incorrect. It has 'security' - The argument could be better if someone quantified it, obviously. We can give charity to this, and take it to be hyperbole (which it is) and then I can agree with this sentiment due to my sentiment about port 80/443.

I use GNU IceCat. How fuarrrked am I?

>>9926 some of these points are 10 years old and no longer accurate

What's the difference between Palemoon and Basilisk? I thought Basilisk had support for the new Firefox extensions but apparently they dropped that. Which one is more secure?

Palemoon is silly. The fact is the modern web has become poisonous, and there's not much we can do about it beyond be very selective of the sites we visit and what we allow in and out of our machines at the system level. I use firefox myself, with a few extensions. uMatrix, decentraleyes, and a few others. I have no blocklists enabled in uMatrix, I just block everything and allow them as needed, and use a proper hosts file instead of loading all those blocklists into ram. The fact that we have to load our browsers down with four or five addons just to make the web even cosmetically browsable is a shame. All these dirty mobile peasants and facebook mom's have fuarrrked up the www beyond repair. We should work on developing a new medium, that's technically complicated to access, where we can post our anime girls again in peace.

>>9926 See my existing reply in >>>/sec/7723, this entire thread could be merged with >>>/sec/7635 . Security depends on your threat model. Usage of any browser requires mitigation one way or another. The biggest is with using Chromium forks is the maintenance or updates with regards to security and their mitigations .

>>9932 >Use either that or Firefox lol. Firefox is a malware pile of soykaf. You can modify it to be good, but if you just use plain firefox you are not very far from being as bad as google chrome. Just search for it's antifeatures. Just because it's not proprietary it's still full of malware, and is an actual botnet. A safe fork of firefox is actually tor browser, which you can use outside of the tor network, or you can use it's patches and settings to convert your firefox source code to a good one and compile that. Netsurf in my opinion is basically unusably bad not security-wise but simply bad functionality. links2/lynx is good but of course it's a text browser, you couldn't open this very site we're on currently and read the posts normally.

>>9938 Are there any vulnerabilities in Palemoon as of date?

>>9942 Oops, forgot to actually reply.. Not sure if saging works here >>9940 This so much, I don't get why people recommend that browser and call it privacy friendly. There are other FF forks that are safe of course. GNU IceCat, Librewolf, and Pale Moon come to mind.

>>9941 I don't know. I used it years ago because it still provided a real status bar. I dropped it when my addons started failing on it. Maybe they fixed that by now, or have alternatives. There was a lot of drama between the main developer and other people, and usually projects start to is like kicking dead whales down the beach when autistic arguments start like that. >>9940 What do you use, chromium? I have it on a few of my really low resource machines, and it seems faster to load than firefox, but I just have such an aversion to anything related to google I just can't get into it. If I could be absolutely sure there's no google anything anywhere in it I might use chromium. fuarrrk google though, I don't even want my browsing to affect their market share through an "ungoogled" chromium. They've destroyed the internet, that company is everything wrong with the internet and it should die.

>>9933 Using Gecko is preferable to preserve the diversity of engines, can't have all the main browsers using chromium

>>9944 I'm really happy with Palemoon. I use a unified system hosts file that autoupdates with a script, and umatrix pretty hard on global that I unblock site by site. That and https everywhere are enough for what I do, but I can understand the issue if you use a lot of extensions. I tried Tor for a little bit but it was too much of a hassle to keep in mind which browser I was on when I needed to login somewhere. It's slow and nodes are blocked everywhere. And knowing my country I might actually get attention for using a weird browser for a little bit of extra privacy while doing sfw stuff and posting on imageboards.

>>9938 >We should work on developing a new medium, that's technically complicated to access, where we can post our anime girls again in peace. We already have. If you haven't found it by now, you never will.

"The most secure browser" isn't an issue for Debian or Whonix users. https://www.whonix.org/wiki/SecBrowser/Debian

for people thinking qutebrowser is still chromium spyware, qutebrowser actually uses qt5 webengine, which is a chromium derivative and not at all dependent on google https://wiki.qt.io/QtWebEngine

>>9938 Just wait a little bit for ads in your sleep. It's gonna be amazing.

>>9926 Long time Ungoogled-Chromium user here. I've been using this browser with UMatrix (for whitelisting of XHR connections, javascript, third/first party cookies, iframes, ect..) for a number of years, and given the fact that Chromium added Pledge/Unveil support in OpenBSD I've been pretty confident in the security of my browser for awhile, however that assumption has been called into question recently. TL;DR: Google is breaking the APIs needed for filter lists and whitlisting functionalities that UMatrix & Ublock Origin depend on. Ungoogled-Chromium is still fine in it's current release, however Google is forcing through a change in it's newest extension API spec (Extension Manifest v3) which sets the WebRequest API to "observe only" and it is asking extension developers to utilize it's DeclarativeNetRequest API instead. The DeclarativeNetRequest API will cap the number of filters 30,000 (rather than allowing whitelisting policies) or filter lists of an unlimited length. For more information on this read the following post: https://arccompute.com/blog/thoughts-on-the-web-browser-landscape-part-1/

>>9954 https://www.youtube.com/watch?v=XPGgTy5YJ-g

>>9949 I just tried this on debian 10 and it installed from the repos, then popped up a prompt claiming it wasn't installed and needed to run a special downloader, which I allowed. Then it requested confirmation back in the terminal which I tried to give and it failed. I don't know.

>>9936 Basilisk only exists for development purposes while Pale Moon is the stable release

>>9960 Package name?

>>9930 chrome datamines the soykaf out of you but you can just use chromium if you dislike google. problem is that firefoxis way more extensible and customizable than chrome. for most people chromium based browser is absolutely fine, though. i use both for various things.

Firefox annoys me with their pocket etc. soykaf and by changing their UI all the time, but at least they make a push for rust. Meanwhile, chromium is a big steamin c++ turd that also runs terribly on me DE (which is a steaming X desktop C turd yes). Anyways, here is a good talk about security research on chrome if you are interested https://media.ccc.de/v/35c3-9579-attacking_chrome_ipc#t=63

>>10007 There is an argument i find more or less reasonable. Have you seen chromium's codebase? Yes is Open Source so what? imo claiming chromium is chrome's good brother is a bold statement, i mean, there is even an 'ungoogled chromium'. At the end of the day, you just have to trust the people contributing to the project, which the majority are google engineers. I'd say if one is really trying to achieve a good level of security and anonymity over the wired and this has been said many times here use tor and a vpn or proxy

>>10024 eh, anonimity is not the same as privacy but yeah if i cared about either of those things i wouldn't use google products at all. for work and studies it's hard to go without their stuff but it's doable if you really want to. also, when i said chromium i meant ungoogled chromium (my bad) since it doesn't phone home to google.

chromium --proxy-server=socks5://127.0.0.1:9050 --host-resolver-rules='MAP * ~NOTFOUND , EXCLUDE 127.0.0.1' 'check.torproject.org' from https://www.chromium.org/developers/design-documents/network-stack/socks-proxy I'm using chromium for soykafty clearnet websites that i *want* to save cookies, because my clearnet firefox is also fairly locked down or whatever. You can isolate them in chromium profiles using --profile-directory="FooBar" (though that features is also kind of soykafty and does not set stuff in the profile menu correctly, at least for me.)

>Browsing the web >Not using tab containers

Any suggestions for a plebeian like me? I don't know any code. I use windows. I just want a browser that isn't google or Mozilla, and has better security than most. It's mainly just to spite the big tech companies, I don't *really* need to protect my data. I just watch youtube and browse imageboards. I'm currently using palemoon, but... Idk, it just feels like it under-performs sometimes. Can I please get spoon-fed some "babies first alternate browser" suggestions?

Shîlling chrome is retarded. Use an independent browser and don't be a fuarrrking sow.

>>9926 I wanted to build ungoogled chromium with MSYS2 on windows, but the build system was nonfunctional. I commented out the broken python2 check, then found it was downloading things I already had. Ultimately there was a build error. Likewise with GNU Icecat. Relies on a no longer functional rust toolchain, UPX something or other. No rustup install available, tried to build it, failed. Didn't feel like bothering. I started testing Brave a while ago and now I've gotten into a position where I have a soykafload of tabs open and don't feel like copying them over. Ultimately I'll just continue using the ungoogled chromium build on woolsys. Firefox has been junk for a while. I remember when Firefox 3 was going to be released, how hyped it was. Using Nightly, every update it just descends further into the same braindead mediocrity I see everywhere else. Cutesy quirky graphics and absolutely horrendous UX, and all. Remember the days of something other than the 3 horizontal lines? Ugh. Bookmarks are also now terrible in firefox.

>>10007 Don't use plain chromium. I had it installed out of curiosity and and dissatisfaction with another equally awful web browser. I ran wireshark, opened chromium and surprise! It sends packets to IP addresses belonging to jewgle. My default search engine wasn't jewgle either and I had completely removed it from the search settings. Needless to say I won't be leaving that garbage installed on my computer. It is really disturbing how many options there are enabled by default in that browser, especially autofill-related ones and in advanced settings things like allow sites access to USB devices, allow sites to install payment handlers etc. No, fuarrrk off and do not install ANYTHING on MY computer! Curse the web and curse Tim Berners-Lee, may he burn in excrement.

Anything expect Tor browser on safest security settings is retard tier at 2020.

Chrome and family are all bullshit. I'm amazed there's a thread on Lainchan, of all places, where people are actually considering using this piece of soykaf. You DO KNOW that it sends special headers to google properties, right? You DO KNOW that it reports back to the mothership about your every move, right? You DO KNOW that it is more targeted and thus more vulnerable than any other browser, right? You DO KNOW that it is for boot lickers and cock suckers, right? The idiocy of lainchan lately is astounding.

>>10506 It's an anonymous image board anon... what are you expecting exactly?

>>10507 lainchan is one person

>>8482 >blanket "turn javascript on/off" type options Late to the party, but I should mention that JavaScript can also be enabled/disabled by host within a custom config.py. The documentation has more about it.

>>7723 >Does Webkit / Blink derivatives & Gecko + Servo comprise of a duopoly ? Absolutely not, Gecko+Servo is a minority and for all of its issues if people stop using Firefox then Google will basically own the entire web for a decade or more.

By reducing Firefox's marketshare you consequently give more power to Google. All these forks and alternatives only serve to splinter the last remaining forces of privacy aware web users.

>>10700 They havent been somewhat undermined already for years. Firefox save browsing uses google and is enable by default. Every website you visit is send to google to get a reply on is it save. So they help google know all the sites you visit with a timestamp. The whole reason people made forks is to clean up firefox.

>>10703 *They have been

>>10703 How the fuarrrk do you suggest we fund firefox development then? All of these forks use firefox code and therefore still depend on google funding.

>>10703 This isn't entirely true. Browsers first check against something like a bloom filter to see if it is possibly a renegade site, and then query if it gets a "maybe-yes". I'm not sure google's policy on what they do with those queries, however. I don't think it attaches any tracking data short of IP address, so exposure would be limited.

>>10712 Just wireshark and log it yourself. From what i saw it doesn't have anything like that. Requests came with a google request even if repeated during the same session. So it didnt even log already visited sites during a session. >>10711 Why not retain status quo? Let google fund firefox and use a cleaned fork for yourself. What else can you do? People wont pay for it. So you have to finance it with adds (get paid which search engine it default) and user data.

>>10713 >people wont pay for it definitely would pay for a browser and search engine. i was pretty excited when i heard about brave before i actually looked into it and realized its as much of a botnet as google.

>>10703 >Firefox save browsing uses google It uses a list from Google. It just downloads the list and checks it locally. It does not send every website you visit to Google. You should be more worried about Google Fonts and things like that. However, if you have search autocomplete in the URL bar and your search engine is Google, it's sending everything you type in to Google. But not every site you visit.

>>7649 >Maybe it's a kind-hearted idea, but in my opinion, the capitalist ad-run Internet has no business existing anymore this comment's old as fuarrrk but there's a meme here and other security-minded places that the internet is here for us to use as un-governed territory. the entire purpose of the internet itself was developed as a distributed surveillance sensor. originally its purpose was literally gathering and filtering information on north vietnamese geurillas to trigger automated bombing raids. the idea that commercial ad money doesn't have a place on the internet is absolutely fuarrrking wrong, because advertising is the commercial appendage of this surveillance tool. ad-run internet was a foregone conclusion. if you ever wonder why web security is so difficult, it's because you keep acting like ads are an unwelcome invasive species. start thinking about encryption instead of complaining about how the sky is blue or water is wet.

firefox, but unironically if you want to ruin your browsing experience with a ton of captchas then tor

>>10756 Thats how you wish it worked. It literally sends requests. Dont have to trust me, log the traffic or use your search engine - other people reported on it already. Thats the only reason i took notice and decided to log traffic myself to see if its true.

>>10769 >if you want to ruin your browsing experience with a ton of captchas then tor Funny, I do that with both tor and firefox, there are even times where tor will circumvent some captchas while firefox doesn't even display the page correctly.

>>10769 Just don't access sites that use capthas or/and crimeflare.

>>7635 I tried several browsers like Ungoogled Chromium and IceCat. I launched them alongside Wireshark and observed which servers they contact and when they do it. Ungoogled Chromium kept sending Keep-Alive packets to various Cloudflare and Verizon servers every couple of minutes. That was with JavaScript and other features that might affect the test like page preloading disabled, mind you. IceCat already sent some packets at launch without even looking up a website. I honestly don't care what features those calls are supposed to provide and whether or not you can turn them off. I believe that a browser should not make connections until I tell it to and that it should be its behavior by default. That's why I switched to a "dumb" Internet browser. JavaScript support is very poor and turned off by default. When I test it the same way, it only ever sends packets when loading a website, as it should be. I don't want to use Tor Browser because trying to watch a video on Invidious is a painful experience. With my current setup I just use a script that takes the address of a video as an argument and "streams" it using youtube-dl output piped to mplayer. I could do that with Tor Browser too, but any benefits to privacy it provides effectively disappear when using it together with clearnet at the same time, so there's no point. The only real problem I can think of right now is forcing HTTPS on every website, I'll probably have to edit the source code to do that.

>>10860 >IceCat already sent some packets at launch without even looking up a website. I honestly don't care what features those calls are supposed to provide and whether or not you can turn them off. That's something I was unaware of. I agree that's not good, but I stopped using IceCat for anything I cared about trying to keep private years ago. I use the Tor Browser for almost all of my WWW browsing now. >I don't want to use Tor Browser because trying to watch a video on Invidious is a painful experience. I don't watch videos much, but when I do I just go to the page, view source, and locate the URL fragment that looks like this from the video tag, and the video title is further below: /latest_version?id=FFFFFFFFFFF&itag=22 Then it's easy to download the video directly. It's also easy to use youtube-dl with torsocks, so why not just do that?

>>10863 I tried using torsocks with youtube-dl before, but it often gave me the 429 (too many requests) error. I suppose that's because a lot of people share the same IP on the TOR network. But it works fine with direct links like you mentioned, I even included a conversion from watch?v= links to direct links in my script and now it works flawlessly. For some reason the Invidious/Youtube frontend limits user requests while the actual server that the videos are hosted on doesn't. I'll use TOR browser and my script for videos from now on, though there are still things that I'll have to use Clearnet for because they require a lot of bandwidth. For example, torrenting, downloading a lot of videos from Invidious at once for archiving or scraping *boorus. I'll use a SOCKS proxy together with encryption for those.

>>7635 Chrome, ungoogled-chromium or Brave for normal person soykaf, Tor for everything else.

>>10756 >>10775 You obviously need to disable safe browsing when you first install it or it's going to check sites you visit against those lists. Regardless of whether it does it locally or remotely, I don't need a list from jewgle to deem sites I visit kosher. I can't believe people on here use chrome in any form.. What's wrong with you guys?

>>10756 >it's sending everything you type in to Google i've never understood the paranoia around search autocomplete. do you regularly begin typing private things into your search engine and then delete them? i'm usually pretty sensitive to this sort of thing but i can't think of any possible way that a partially completed version of a search query leaks information that the finished search query doesn't. inb4 it sends partially typed urls: yes, you should disable search suggestions in your url bar and use a secondary search field for searches. this is exactly why firefox has this feature.

>>10756 I can not find this list or any way to download it, i would just download it and use it in my firewall otherwise.

>>11002 Go to about:config and search for 'safebrowsing' (or if you want to be more explicit, 'safebrowsing.provider.google') You can read about some of the prefs on their wiki (https://wiki.mozilla.org/Security/Safe_Browsing). Maybe you're going to find what you're looking for. Now when it comes to safebrowsing, here's the interesting stuff (https://wiki.mozilla.org/Security/Safe_Browsing): >... These lists are automatically downloaded and updated every 30 minutes or so ... >... If the site is found on that list, Firefox blocks the file immediately, otherwise it asks Google’s Safe Browsing service if the software is safe by sending it some of the download’s metadata. If you're looking for a blocklist, you can use your hosts file - people provide a couple of these, but this one seems to be the most popular: https://github.com/StevenBlack/hosts One thing I recommend you to do is to add 0.0.0.0 fonts.googleapis.com . Lots of sites get their fonts from googleapis and it drives me crazy - when I tried to read the rust book offline, it didn't fuarrrking work because it was waiting for a response from googleapis. You should know that if you're using a proxy/vpn, you're not directly connecting those sites but to your proxy/vpn, which renders it useless.

>>11005 Both links lead to the wiki x( The second link was meant to be this: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work

I know it's probably a scam but I use Brave. There are some chrome extensions I need that I can't use with firefox and anything is better than using google chrome, so I'm fine with Brave. At least it doesn't make my computer heat up like chrome did, so that's a positive sign.

>>7635 I use Librewolf and I like it, it's a fork of Librefox. It's privacy and security oriented.

>>11005 I have table blocklists in my router, that's not the point. I still don't see a way to download and view the file using the links in about:config. There doesn't seem to be a way to validate what the connection is doing. It just seems like another NSA program to me. I keep safe browsing disabled, there is no point to this lack of transparency other than hiding something. Blocklists are simple textfiles.

I like Icecat, personally.

>>8481 >>8482 >>8484 >>8487 >>8486 >>7723 I like qutebrowser very much and I've been considering contributing to the project. I did not find "up for grabs" or "beginner" tags in github though.

For casual browsing I use Brave. I know it's still probably not 100% safe, but fuarrrk it, anything is better than plain Google Chrome. There are a lot of Chrome only extensions I really like, and I also find Chrome's inspect element really useful for webdev. If I ever need to search for something "risky" (which I never really do), then I use TOR with a VPN.

I still have to find someone with actual arguments against Pale Moon. It's always >It's an old outdated fork of Firefox >It's not secure because the sPyWaRe SiTe that recommends Ungoogled Chromium as not spyware although it connects to Google domains says they have advertisements on their home page >Only one person works on it as a hobby And other nonsense. Not even "my favorite FF extensions don't work on it", just nonsense. Does anybody have actual technical reasons as to why PM is not secure?

>>11857 Old unmaintained code? It's always the old unmaintained code.

>>11856 > For casual browsing I use Brave. I know it's still probably not 100% safe, but fuarrrk it, anything is better than plain Google Chrome. There are a lot of Chrome only extensions I really like, and I also find Chrome's inspect element really useful for webdev. Brave uses Chrome's same web engine fyi. Brave provides no extra anti-fingerprinting whatsoever, and isn't open source. You'd be better off using ungoogled-chromium or something if you really can't switch to Firefox. > If I ever need to search for something "risky" (which I never really do), then I use TOR with a VPN. I hope you know what the fuarrrk you're doing because you can easily fuarrrk this configuration up. Hopefully you're using Tor through your existing vpn connection: VPN -> Tor; and not: Tor -> VPN which would make Tor pointless because your "exiting" IP just becomes your VPN's.

>>11005 I feel like blocking google fonts entirely like that is overkill. Just only allow CSS in umatrix and be done with it.

>>11856 What's wrong with firefox's inspect element? I find firefox's tools are better than chrome's, especially for visualizing the css box model. Of course, that's probably going to change soon now that they fired most of the dev tool team.

Web is fuarrrked for sure. I like how mobile device apps had broken tls implementation so it leaks credentials, I like it when I inspect my network and see a http/80 request of a 1x1 gif file from mountainview IPs, totally not shady right? I like how my clipboard is exposed to background apps that may want to access it, I like how they did that tls middlebox workaround for apps and decided everyone should use soykafty levels of security, I like how my web browser just downgraded overall security so that people could use Zoom to work. I like how some websites actually want poor security and breaks if you force 1.2/1.3 on like say Pale Moon and you will see that those websites are actually MitM either way they still unrecommended ciphers.