I am in the privacy game for about 2 years now and I’ve become the go-to on privacy questions in my family (which makes me proud, cuz this means, I am not just this privacy nut that cant be reached on whatsapp :D). I was asked about a browser for Graphene OS. Clearly I recommended the one I use atm, which is Waterfox (was recommended once in this comm). The person who asked me is using bromite (which looks good too). After thinking about the recommendation, there is one open question:

Does it really matter which alternate browser you choose, if it is of course not something like Google Chrome, Mozilla Firefox or Safari (especially regarding the outcome in this comm, where someone compared Chromium and Firefox without any real conclusion)? Also doesnt it also come down to the plugins? Like, what difference does it make, if I use Waterfox or Bromite, if I also use Privacy Badger, uBlock Origin and maybe JShelter?

Hope too read a lot of your toughts on this :)

  • Onno (VK6FLAB)
    17•1 day ago

    Excluding Chrome, Firefox and Safari means that you are now relying on some random developer to understand security and privacy and as a software developer for over 40 years I can tell you that this is a fools errand.

    Don’t get me wrong, the big three absolutely have privacy issues, but they can be mitigated in many different ways without compromising on security.

    For example, you can force DNS requests to one of your choosing, you can run them in incognito mode, refuse cookies, run them inside user accounts without personal information, etc.

    I tend to run individual instances of a browser in incognito mode and am very conscious of which tabs are open in which instance, so websites cannot steal information from other tabs.

    • @[email protected]
      4•20 hours ago

      I tend to run individual instances of a browser in incognito mode and am very conscious of which tabs are open in which instance, so websites cannot steal information from other tabs.

      Isn’t that the purpose of Firefox’s multi-account containers? Compartimentalising cookies to prevent cross pollination?

      Noob here, just asking honestly.

      • Onno (VK6FLAB)
        1•18 hours ago

        I don’t know. When I built this, several years ago, none of that existed.

    • @[email protected]
      6•1 day ago

      You can even run the browser in a docker container if you’re extremely paranoid (I’m on the verge)

        • N.E.P.T.REnglish
          1•23 hours ago

          Docker guest still shares a kernel with host. Use a custom OCI runtimes like kata-containers (VM) or gVisor/sydbox-oci (unprivileged application kernel) to reduce the kernel attack surface and protect against privelege escalation.

          • Onno (VK6FLAB)
            1•21 hours ago

            This is true.

            However, I’m running trusted software, not the backyard efforts of someone randomly selected off the internet.

            Additionally, the Docker container is running on a dedicated Debian virtual machine with only Docker installed.

            What’s of deeper concern is that all instances are running on X11 which means that they all share information via the clipboard for example.

            • N.E.P.T.REnglish
              1•15 hours ago

              You could set up Wayland probably. Just make sure you use GNOME (Mutter) since it is the only Wayland DE that protects the screencopy API.

              • Onno (VK6FLAB)
                1•15 hours ago

                So far the Wayland implementation requires embedded X11 which puts everything in the same environment again.

                I’ve not yet discovered how to run separate Wayland screens across the network from a Docker container and I’m also not sure if either Chrome or Firefox actually support native Wayland, from memory they didn’t last time I checked.