4

I just tried Chromium, which in its fast rendering and lightweight feel really appealed to me, so I considered switching.

But looking at the project, I see that the Chromium project has strong links to Google, just as Gecko has to Mozilla. I therefore assume that the people at Mozilla and Google thus do the majority of development on the respective engines.

Both of these have cloud services they try to link you up to for you to give away information to them for analysis - and most likely exploitation at some level.

That got me to thinking;

  • Is there a serious browser alternative that's not tied to an entity possibly wanting to exploit information about you?

  • Is the vigilance and number of the projects' unaffiliated developers sufficient to couteract attempts from the "insiders" to sneak malicious code into the engines?

closed as primarily opinion-based by Steffen Ullrich, wireghoul, Stephane, SilverlightFox, Matthew Sep 13 '16 at 7:21

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm curious, specifically what Mozilla cloud services are you referring to? – Alexander O'Mara Sep 10 '16 at 15:29
  • 1
    https://www.mozilla.org/en-US/firefox/sync/ - afaik previously it was possible to set up your own sync server with firefox (it's hinted upon via an older owncloud plugin for the purpose), but I think they changed it so they lock you to their own service. But that's only guessing on my part. – lash Sep 10 '16 at 15:55
  • you have it more backwards with google and chromium... – dandavis Sep 10 '16 at 17:44
  • Maybe, but the question wasn't about the lesser of two evils ;) – lash Sep 10 '16 at 17:51
  • 2
    Looks like you still can run your own Mozilla sync server if you want: docs.services.mozilla.com – Alexander O'Mara Sep 10 '16 at 23:04
2

The ecosystem works a little differently than this description implies.

For chromium/google and firefox/mozilla, the vast (vast!) majority of revenue supporting the development efforts comes to the parent companies via searches you perform. The browser itself is incidental to this model, and the browser does not do anything unpleasant or unexpected other than follow standards, which themselves allow for tracking and other activities by ecosystem participants to facilitate the delivery of advertising.

There is out of band communication between browsers and their parent cloud services but it is in service of safety- retrieving lists of compromised sites, revoked certificates, pinned certificates, etc.

The browsers do not communicate site visit data directly to their clouds without your permission. Instead, google relies on publishers near ubiquitous use of google analytics to associate visit data with a cookie.

The integration of analytics and advertising on publisher sites directly is the far more problematic machinery. It is this machinery that is targeted by Ad Blockers.

So the browsers themselves can be used safely, but ANY browsing- even using text browsers- triggers activities that you may be concerned about.

In terms of answering the specific questions-

There are a ton of browsers at different levels of maturity and with different postures when it comes to privacy. Very few can be considered serious. A browser is a huge, huge engineering effort these days, as complex as an operating system. Long gone are the times when a single person or even small team can produce something meeting even basic levels of capability.

Big teams need funding, and funding a big effort without sponsorship dollars, like those from advertising, is a nut that has not been cracked.

An ostensibly serious recent entry, with a bitcoin-integrated revenue model, is Brave:

https://brave.com

CEO is Brendan Eich, creator of javascript and former longtime CTO of Mozilla.

In terms of the chromium and mozilla codebases, they both have a huge amount of oversight and testing. Their core code is not a candidate for injected compromises. However, plugins for both are far less well policed and monitored and have been abuse vectors in the past. Be very very careful when installing plugins, especially ad blockers and others that purport to protect privacy. Some do the opposite.

  • Also worth considering that while the browsers just try to follow standards, the parent companies have (some/major?) influence over the standards. An oldie but a goodie is the Do Not Track header, which Google wasn't wanting to ship on by default (value of header pro or con aside). – Steve Sep 10 '16 at 15:23
  • Definitely true that the only folks with enough money to sponsor the brainpower to produce sufficiently precise and well crafted standards are big vendors. DNT proves the rule- it is, frankly, a poor and immature piece of technical work- the product of part time effort from a couple of grad students- and never became a standard in part because of that. – Jonah Benton Sep 10 '16 at 15:28
  • 2
    The european data protection standards- legislation, not technical specs- are in contrast a remarkable achievement, and hopefully some well heeled org will see the wisdom to fund a rendering of that posture into sensible RFCs. – Jonah Benton Sep 10 '16 at 15:31
  • @Steve On the other had, Microsoft got a lot of backlash for making it on-by-default, and services started ignoring it for their browsers entirely making it almost useless. I totally agree with the point that these parent companies have a lot of influence though, and sometimes even violate the spec for their own agenda. – Alexander O'Mara Sep 10 '16 at 15:33
2
  1. No.
  2. Probably!

Whilst there may be links back to Google in the case of Chromium, there are also many other people with eyes on the code. That's the (potential) benefit of open source.

You could possibly argue that Mozilla is more independent since they don't seem to have many significant reasons to be doing bad things with people's data. Google are somewhat more suspect in their intent. However, Chromium is used in many contexts so rogue code is very likely to be found out.

Also, lesser known browsers, though they may not have so many ties, also don't have so many eyes on the code. The Maxon (sp?) browser is a good case in point having just been discovered sending vast amounts of quite sensitive data from user PC's to some central location in China.

If you haven't yet found a trusted source of security information that you can monitor for browser related issues, that is where I would start. Then you will see quite quickly what is going on and what people are discovering.

PS: I should say, for clarity, that you've asked for opinion related answers as I don't think anyone can really know if a browser is compromised until someone discovers an issue. This is my opinion.

Not the answer you're looking for? Browse other questions tagged or ask your own question.