Does anyone have insight as to why they recommend only using Chrome, including using Tor with Chrome and not the Tor browser (fork of Firefox)? Is this just to keep things consistent or are there privacy/security concerns over using Firefox?
The Tor browser is almost certainly better at avoiding accidental disclosure of your IP address, but worse at general exploit-resistance. Making use of Tor in a way that fully protects their identity is probably beyond the capabilities of a Congressional candidate anyways, so it would at best create a sense of anonymity that was false.
People tend to look for a simple explanation for these kinds of differences, like, "iPhones are more secure because they have a Secure Enclave", or "Chrome is more secure because it has better sandboxing". But the real answers are rarely that simple. There's a lot more that goes into both iPhone and Chrome security than those simple things.
For what it's worth, I tend to think the biggest issues are the weaker sandbox (the GPU driver is exposed in Firefox, which WebRender is taking a big step toward fixing) and, in the future, Site Isolation (which I think is oversold, but it would help sites like Gmail).
As for why Tor Browser Bundle sucks: https://medium.com/@thegrugq/tor-and-its-discontents-ef51648...
Plenty of things combined, but not least of which is that Mozilla only patches High + Critical bugs in long term stable release builds, so you can just chain Low + Medium known vulnerabilities together until you get access.
The only safe way to use Tor is with a router acting providing a secure middle point for "upgrading" all traffic to Tor. That way if the end point is compromised, it cannot beacon information back w/o being forced through Tor. This is why I don't like software solutions that provide Tor access and are tenant on the same hardware. It simply means that one additional exploit breaks the system. A Tor router (a good one, none of the commercial ones are) will expose only the DHCP server [optional] and the Tor SOCKS5 proxy port. Leaving an attacker with only a very small attack surface: the Linux kernel network stack and the Tor daemon. A software solution with co-tenant router (such as Qubes, or Whonix) has the same attack surface plus a hypervisor and (potentially) a shared kernel interface (i.e. the entire kernel API). Tor Browser Bundle is even worse as there is no Tor router, simply an app that is configured to use Tor, and if it is compromised then the code executed by the attacker can elect not to use Tor as the system itself is networked.
Tor has very few use cases IMHO, and since one of them is "purchasing drugs from a reputable source," I don't really see why Congressional candidates should ever use it themselves. A VPN, on the other hand, is different.
I would actually extend the guide by @idlewords and say "install the Freedome VPN on all your iOS devices, enable it, buy the $30 a year service, and forget about it. You'll have a secure IKEv2 VPN to a reasonably[0] safe end point that is doing active filtering for malicious sites as well as some trackers and ad blocking (the source of most 'drive by malware.') This one app will make all public WiFi safe[1] to use, it will increase your privacy [by aggregating your traffic with other people's exiting that same IP], and help to reduce your exposure to known bad websites that serve malware."
[0] 'reasonably safe end point' in that it is operated by F-Secure, not anonymous and potentially malicious agents. F-Secure has a reputation to maintain and actively sniffing traffic for secrets (e.g. Wikileaks) or inserting malware into downloads (e.g. various threat actors) would be the end of their business. They are probably capable of securing an end point as well as anyone else, and if you aren't technical enough to setup Algo VPN yourself then Freedome is a reasonable compromise. Vastly better than fly-by-night "bittorrent safe, logless!" "we put OpenVPN on a VPS" VPN companies.
[1] yes, nothing is truly safe, the NSA is logging all encrypted traffic for years, chemtrails don't care about IPSec and jet fuel can't melt APs, thanks for your pedantic observation.
A secondary reason we recommend Chrome is that the FIDO security keys work with that browser, while I believe they don't work yet in Firefox.
A Guide to Not Getting Hacked | https://news.ycombinator.com/item?id=15733698 (15735789)(Nov2017:175points,78 comments)
A very similar conversation to this one, but with more criticism of the advice in the associated article.