5 ms·

That seems to be quite focused on the situation with Firefox on the Android/Graphene environment. >It's basically universally agreed among security people that

• _rdvw 5y ago
  The biggest issue is that Firefox on Android runs all websites in the same process. https://bugzilla.mozilla.org/show_bug.cgi?id=1565196 https://bugzilla.mozilla.org/show_bug.cgi?id=1565196 Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).
  • xorcist 5y ago
    Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL. That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers. The plugins for Firefox to expose this functionality have at least traditionally been a little bit more user friendly. Opt-in javascript functionality would be the next step.
    • _rdvw 5y ago
      I maintain configs for both to do just that! https://gitlab.com/divested/brace/-/blob/master/brace/etc/chromium/policies/managed/brace.json https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch... https://gitlab.com/divested/brace/-/tree/master/brace/usr/lib/firefox https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...