8 ms·

How is Chrome more secure than Safari on macOS?

tptacek 9y ago
If you're interested in a detailed answer, read this: https://medium.com/@justin.schuh/securing-browsers-through-isolation-versus-mitigation-15f0baced2c2#.snvaii5dh https://medium.com/@justin.schuh/securing-browsers-through-i... Then try to work back either Edge's or Chrome's approach to security to specific Safari features and design. The Chrome security team is probably the most sophisticated software security team in the industry (lest you think I'm in the tank for Google, I'd say the iOS platform security team is a close 2nd --- and, to be clear: Safari is a different story on iOS).
- AlexandrB 9y ago
  > The Chrome security team is probably the most sophisticated software security team in the industry Unfortunately the Chrome security team can't provide the kind of security I care about - security from Google's tracking.
  - tptacek 9y ago
    If you don't have the kind of security Chrome provides, then in reality everyone can track you, because all they have to do to own up your machine is get you to look at a web page.
    - AlexandrB 9y ago
      So you're saying that privacy is impossible? If that's true, then I'd rather go down fighting (no matter how futile that is) than willingly give up any more private information to Google. I think the time for pragmatism when it comes to privacy is long over.
      - tptacek 9y ago
        I'm saying what I said: if your browser isn't adequately secure, all the anti-tracking features don't much matter, because the people you really need to worry about will be able to own up your entire machine and quietly persist themselves into it.
        untangle 9y ago
        Let me play back what I'm hearing: Chrome is great because it uniquely protects you from 3rd-party hackers on the internet. Fair enough. But do Chrome's protections also protect you equally from intercession by Google? I just want to clarify this point in my mind.
        TeMPOraL 9y ago
        > But do Chrome's protections also protect you equally from intercession by Google? I just want to clarify this point in my mind. I'd say yes, unless Chrome has specific backdoors for Google. If that was ever discovered, I'd imagine a huge shitstorm happening.
        majewsky 9y ago
        Google doesn't need backdoors into Chrome, in the same way that it's technically not cheating if you adjust the rules to fit your demands better than others (see f.i. AMP).
        AlexandrB 9y ago
        > because the people you really need to worry about I think we disagree who to really worry about. I worry more about persistent low-level corporate surveillance more than hacker attacks because while the latter is more acute and can cause great financial harm, the former is whats going to damage my freedom and right to privacy once the government decides it wants to firehose all that data.
  - kartickv 9y ago
    Unless Google can track you better when you use Chrome, that's not an argument against using Chrome.
    - om2 9y ago
      Google can indeed track you better when you use Chrome, since Chrome doesn't have Safari's default-on tracking protections.
- om2 9y ago
  This post has lots of info about Chrome and Edge RCE defenses. Super informative on this front. But is surprising light on detail about what makes their sandbox more robust than Edge's. (I don't know near enough about the Edge sandbox to assess this claim for myself.)

If you're interested in a detailed answer, read this: https://medium.com/@justin.schuh/securing-browsers-through-isolation-versus-mitigation-15f0baced2c2#.snvaii5dh https://medium.com/@justin.schuh/securing-browsers-through-i... Then try to work back either Edge's or Chrome's approach to security to specific Safari features and design. The Chrome security team is probably the most sophisticated software security team in the industry (lest you think I'm in the tank for Google, I'd say the iOS platform security team is a close 2nd --- and, to be clear: Safari is a different story on iOS).

AlexandrB 9y ago
> The Chrome security team is probably the most sophisticated software security team in the industry Unfortunately the Chrome security team can't provide the kind of security I care about - security from Google's tracking.
- tptacek 9y ago
  If you don't have the kind of security Chrome provides, then in reality everyone can track you, because all they have to do to own up your machine is get you to look at a web page.
  - AlexandrB 9y ago
    So you're saying that privacy is impossible? If that's true, then I'd rather go down fighting (no matter how futile that is) than willingly give up any more private information to Google. I think the time for pragmatism when it comes to privacy is long over.
    - tptacek 9y ago
      I'm saying what I said: if your browser isn't adequately secure, all the anti-tracking features don't much matter, because the people you really need to worry about will be able to own up your entire machine and quietly persist themselves into it.
      - untangle 9y ago
        Let me play back what I'm hearing: Chrome is great because it uniquely protects you from 3rd-party hackers on the internet. Fair enough. But do Chrome's protections also protect you equally from intercession by Google? I just want to clarify this point in my mind.
        TeMPOraL 9y ago
        > But do Chrome's protections also protect you equally from intercession by Google? I just want to clarify this point in my mind. I'd say yes, unless Chrome has specific backdoors for Google. If that was ever discovered, I'd imagine a huge shitstorm happening.
        majewsky 9y ago
        Google doesn't need backdoors into Chrome, in the same way that it's technically not cheating if you adjust the rules to fit your demands better than others (see f.i. AMP).
      - AlexandrB 9y ago
        > because the people you really need to worry about I think we disagree who to really worry about. I worry more about persistent low-level corporate surveillance more than hacker attacks because while the latter is more acute and can cause great financial harm, the former is whats going to damage my freedom and right to privacy once the government decides it wants to firehose all that data.
- kartickv 9y ago
  Unless Google can track you better when you use Chrome, that's not an argument against using Chrome.
  - om2 9y ago
    Google can indeed track you better when you use Chrome, since Chrome doesn't have Safari's default-on tracking protections.
om2 9y ago
This post has lots of info about Chrome and Edge RCE defenses. Super informative on this front. But is surprising light on detail about what makes their sandbox more robust than Edge's. (I don't know near enough about the Edge sandbox to assess this claim for myself.)