4 ms·

First off, I'm a big Firefox fan and it is the sole browser I use on desktop. With that said, I would never use Firefox on Android. According to GrapheneOS (ht

by nateb2022 3y ago

First off, I'm a big Firefox fan and it is the sole browser I use on desktop. With that said, I would never use Firefox on Android. According to GrapheneOS (https://grapheneos.org/usage#web-browsing https://grapheneos.org/usage#web-browsing), which is the baseline standard for a hardened Android-based distribution, > Chromium-based browsers like Vanadium provide the strongest sandbox implementation, leagues ahead of the alternatives... Chromium has decent exploit mitigations, unlike the available alternatives... Avoid Gecko-based browsers like Firefox as they're currently much more vulnerable to exploitation and inherently add a huge amount of attack surface. Gecko doesn't have a WebView implementation (GeckoView is not a WebView implementation), so it has to be used alongside the Chromium-based WebView rather than instead of Chromium, which means having the remote attack surface of two separate browser engines instead of only one. Firefox / Gecko also bypass or cripple a fair bit of the upstream and GrapheneOS hardening work for apps. Worst of all, Firefox does not have internal sandboxing on Android. This is despite the fact that Chromium semantic sandbox layer on Android is implemented via the OS isolatedProcess feature, which is a very easy to use boolean property for app service processes to provide strong isolation with only the ability to communicate with the app running them via the standard service API. Even in the desktop version, Firefox's sandbox is still substantially weaker (especially on Linux) and lacks full support for isolating sites from each other rather than only containing content as a whole. The sandbox has been gradually improving on the desktop but it isn't happening for their Android browser yet. If you don't mind switching, I would heartily recommend switching to GrapheneOS. If you're attached to stock Android though, I would definitely say go with a Chrome or Chromium-based browser.

deleted 3y ago
[deleted]
Dinner8334 3y ago
I'm sorry, but that still doesn't answer my question of "is it secure (enough) or not". It's actually the reason why I decided to post this question here, as I was hoping to get some counter-arguments to that.
- nateb2022 3y ago
  "Enough" is subjective and vague. It depends on whether you're especially likely to be targeted, whether you're running on a phone with a lot of private information or whether you're using a burner phone where you don't lose a lot if it gets compromised, whether you expose yourself to malicious content, etc. etc. As you said you regularly visit "shady" and "weird" sites on what would presumably be your personal phone, and as I presume there is definitely some information on your phone you wouldn't want others to have, and especially since someone with control of your phone could take over any accounts that use your phone as a 2FA source, I would say that no, Firefox is not secure enough.

deleted 3y ago

[deleted]

Dinner8334 3y ago

I'm sorry, but that still doesn't answer my question of "is it secure (enough) or not". It's actually the reason why I decided to post this question here, as I was hoping to get some counter-arguments to that.

nateb2022 3y ago
"Enough" is subjective and vague. It depends on whether you're especially likely to be targeted, whether you're running on a phone with a lot of private information or whether you're using a burner phone where you don't lose a lot if it gets compromised, whether you expose yourself to malicious content, etc. etc. As you said you regularly visit "shady" and "weird" sites on what would presumably be your personal phone, and as I presume there is definitely some information on your phone you wouldn't want others to have, and especially since someone with control of your phone could take over any accounts that use your phone as a 2FA source, I would say that no, Firefox is not secure enough.