6 ms·

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead. ht

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead. https://grapheneos.org/usage#web-browsing https://grapheneos.org/usage#web-browsing It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be able to catch up, with their current funding, compensation packages, the size of their workforce (750 employees?), their hiring attractiveness to top security researchers, and their management priorities.

upofadown 5y ago
That seems to be quite focused on the situation with Firefox on the Android/Graphene environment. >It's basically universally agreed among security people that Firefox is less secure than Chrome. A reference would be nice here...
- _rdvw 5y ago
  The biggest issue is that Firefox on Android runs all websites in the same process. https://bugzilla.mozilla.org/show_bug.cgi?id=1565196 https://bugzilla.mozilla.org/show_bug.cgi?id=1565196 Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).
  - xorcist 5y ago
    Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL. That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers. The plugins for Firefox to expose this functionality have at least traditionally been a little bit more user friendly. Opt-in javascript functionality would be the next step.
    - _rdvw 5y ago
      I maintain configs for both to do just that! https://gitlab.com/divested/brace/-/blob/master/brace/etc/chromium/policies/managed/brace.json https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch... https://gitlab.com/divested/brace/-/tree/master/brace/usr/lib/firefox https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...
tgsovlerkhgsel 5y ago
Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865 https://news.ycombinator.com/item?id=24128865 Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."
- consumer451 5y ago
  I have been dragging my feet on leaving Firefox for security reasons for so long, and just now I have come to terms with how ridiculous that is. I’ve known about the security team, and I remember hearing that even prior to that, a CTF event had banned Firefox exploits as too easy. I am doing it next time I open my work laptop. I mean what is the single most important class of features in a browser? Security. I feel dumb for waiting so long. This makes me sad. I was emotionally invested invested in Mozilla and that caused an error in judgment.
  - consumer451 5y ago
    Turns out I was thinking of pwn2own in 2016 [0]. Can anyone update me on how Firefox does these days at CTFs? [0] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...
  - consumer451 5y ago
    I would also like to point out that I would absolutely pay $5/month via something like a Patreon which funded an organized group of security minded devs to work on Firefox security issues.
    - RupertHandjob 5y ago
      It's not a money issue. It's money allocation problem. Mozilla has plenty of money they just don't care about security that much. They care more about Pocket and other useless junk that probably nobody, but they care about. I use Firefox, but only because of "browser diversification" and privacy. Other options are worse not because Firefox is a superior product. It's sad really.
fulafel 5y ago
There are more factors affecting your safety as a user: how popular a target is the app? Eg a Linux desktop is thought to be less likely to get a malware infection than a Windows desktop, even though Windows has more security investment and attention and mechanisms (antivirus, quarantined files, etc) to defend against this. The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware. We're reduced to reasoning like this because we've in browser security apathy. If only there was a browser that wasn't implemented by juggling chainsaws like this... It's ridiculous that we have been unable to just fire all the these apps for sane reimplementation. Feeding hostile internet content to millions of lines of unsafe code day in, day out on billions of user devices would sound like a ridiculous idea if it were invented today.
- kaba0 5y ago
  > It's ridiculous that we have been unable to just fire all the these apps for sane reimplementation It is unfortunately nigh impossible to reimplement the web with its gigantic scope.
  - fulafel 5y ago
    It's easy to get daunted at least. A realistic scenario could be something along the lines of: get content onboard by securing some buy-in from some heavyweights, for a reduced feature set. Maybe convince a incumbent browser vendor or two to also provide a safer kernel for that content profile. Then targeting that feature set with the new implementation, and supporting a compatibility mode fallback to a legacy rendering engine for other web content. (VM-based or remote cloud based sandboxed rendering for the fallback?) But the above would of course have a much better chance of taking off if there was a promising start of an implementation first, so it's not necessarily a reason to wait for the big boys before working on it. (I wonder if Servo could be a starting point?)
- concinds 5y ago
  > The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware. Firefox is Tor Browser which is the most attractive target by far for 0 days. 0 days are often not targeted to a single individual anymore but are commonly used "in the wild" against mass targets, e.g. everyone who browses a political dissident website.

upofadown 5y ago

That seems to be quite focused on the situation with Firefox on the Android/Graphene environment. >It's basically universally agreed among security people that Firefox is less secure than Chrome. A reference would be nice here...

_rdvw 5y ago
The biggest issue is that Firefox on Android runs all websites in the same process. https://bugzilla.mozilla.org/show_bug.cgi?id=1565196 https://bugzilla.mozilla.org/show_bug.cgi?id=1565196 Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).
- xorcist 5y ago
  Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL. That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers. The plugins for Firefox to expose this functionality have at least traditionally been a little bit more user friendly. Opt-in javascript functionality would be the next step.
  - _rdvw 5y ago
    I maintain configs for both to do just that! https://gitlab.com/divested/brace/-/blob/master/brace/etc/chromium/policies/managed/brace.json https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch... https://gitlab.com/divested/brace/-/tree/master/brace/usr/lib/firefox https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...

tgsovlerkhgsel 5y ago

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865 https://news.ycombinator.com/item?id=24128865 Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

consumer451 5y ago
I have been dragging my feet on leaving Firefox for security reasons for so long, and just now I have come to terms with how ridiculous that is. I’ve known about the security team, and I remember hearing that even prior to that, a CTF event had banned Firefox exploits as too easy. I am doing it next time I open my work laptop. I mean what is the single most important class of features in a browser? Security. I feel dumb for waiting so long. This makes me sad. I was emotionally invested invested in Mozilla and that caused an error in judgment.
- consumer451 5y ago
  Turns out I was thinking of pwn2own in 2016 [0]. Can anyone update me on how Firefox does these days at CTFs? [0] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...
- consumer451 5y ago
  I would also like to point out that I would absolutely pay $5/month via something like a Patreon which funded an organized group of security minded devs to work on Firefox security issues.
  - RupertHandjob 5y ago
    It's not a money issue. It's money allocation problem. Mozilla has plenty of money they just don't care about security that much. They care more about Pocket and other useless junk that probably nobody, but they care about. I use Firefox, but only because of "browser diversification" and privacy. Other options are worse not because Firefox is a superior product. It's sad really.

fulafel 5y ago

There are more factors affecting your safety as a user: how popular a target is the app? Eg a Linux desktop is thought to be less likely to get a malware infection than a Windows desktop, even though Windows has more security investment and attention and mechanisms (antivirus, quarantined files, etc) to defend against this. The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware. We're reduced to reasoning like this because we've in browser security apathy. If only there was a browser that wasn't implemented by juggling chainsaws like this... It's ridiculous that we have been unable to just fire all the these apps for sane reimplementation. Feeding hostile internet content to millions of lines of unsafe code day in, day out on billions of user devices would sound like a ridiculous idea if it were invented today.

kaba0 5y ago
> It's ridiculous that we have been unable to just fire all the these apps for sane reimplementation It is unfortunately nigh impossible to reimplement the web with its gigantic scope.
- fulafel 5y ago
  It's easy to get daunted at least. A realistic scenario could be something along the lines of: get content onboard by securing some buy-in from some heavyweights, for a reduced feature set. Maybe convince a incumbent browser vendor or two to also provide a safer kernel for that content profile. Then targeting that feature set with the new implementation, and supporting a compatibility mode fallback to a legacy rendering engine for other web content. (VM-based or remote cloud based sandboxed rendering for the fallback?) But the above would of course have a much better chance of taking off if there was a promising start of an implementation first, so it's not necessarily a reason to wait for the big boys before working on it. (I wonder if Servo could be a starting point?)
concinds 5y ago
> The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware. Firefox is Tor Browser which is the most attractive target by far for 0 days. 0 days are often not targeted to a single individual anymore but are commonly used "in the wild" against mass targets, e.g. everyone who browses a political dissident website.