Brave Browser Hardening | Hacker News Reader

Brave Browser Hardening

gitlab.com

89 pointsCHEF-KOCH103 comments

Nice tutorial. It takes some work, but all that crypto stuff can be disabled in Brave and then it works really well blocking ads and trackers...

Rather than disabling all the crypto, why not use a browser that isn't infected with it in the first place?

Read the second half of the comment you're replying to

Actually it's addressed in the linked posting.

Hardening does not start at choosing the right tools or networks, hardening begins with gathering information to inform yourself and others in order to stay up-to-date so that you can deal with current and upcoming threats. Tools, extensions and Co. are just a workaround until someone build the right system, that starts by voting and supporting the right politicians and organizations.

Firefox also requires setup (installing uBlock for starters). I find that setting up Brave is not any more work, and then it is indeed a pretty good browser.

But that's the whole point of Brave. If you're not interested in crypto, pick a browser that's just a browser. There are better choices: Safari, GNOME Web, Falkon, Firefox.

What if one just wants a more usable ungoogled-chromium?

Edge

So MS spyware?

Pretty much all of my suggestions are that, except maybe Firefox.

The point of using a Chromium fork is full extension compatibility, same rendering engine and similar-enough featureset (what matters varies by user, which is why just forking Chromium works best). None of your suggestions match these requirements.

Safari: not an option outside of Macs. Gnome Web: barely usable. Falkon: insecure due to no/low maintenance (think the last release is years ago). Firefox: requires setup too.

Falkon only appears out of date because the rendering engine component is updated separately, as part of Plasma.

As for Gnome Web being "unusable", that's quite an extraordinary claim.

Falkon relies on Qt for QtWebEngine, not Plasma. Which has its maintenance issues of its own (look it up, it's a chore nobody really likes doing and is therefore infrequent, something you don't want for a web engine).

Falkon, on many platforms, links Qt statically, so you stil rely on them making timely releases.

It is absolutely not a browser anybody should use.

GNOME Web has next to no UI over WebKit, so the claim is easily verified.

GNOME web is truly bad. Not only is it WebKit based (which puts it at a stark disadvantage out of the gate), but it also lacks tons of features like extention support, settings sync, custom themes, robust developer tooling, PWA support, the list goes on...

Hell, GNOME web hasn't even fixed it's text rendering issues yet. Text is still jagged and aliased out-of-the box. It's definitely on the cusp of "unusably bad"

That's your take. I use Brave for it's protocol support and native ad blocking. Where are you getting this "point of Brave" from?

this type of stuff makes me wonder if there really ever was any browser that truly cared about privacy.

firefox has gone down the hill and last week I switched to Brave. but hardening Brave isn’t the ultimate solution as lots of things will break in future updates.

I've been happy with Orion. Mac only, but solid and improving: https://browser.kagi.com/

There’s still safari!!

Arguably doing the most to protect user privacy.

What is Safari doing that Firefox isn't? I find multi-account containers in Firefox to be indispensable. Does Safari do something similar?

Nope! https://privacytests.org/

Not even close, brave is second to only librewolf which breaks a lot of sites.

Safari/WebKit is modern IE at this point

https://www.theregister.com/2022/05/23/opinion_column/

Only on a mac, unfortunately

What's wrong with Firefox?

Last I checked (6 mos ago), it had memory leaks and it was slow. I could leave my chrome/brave tabs open for a week while I worked on a project, but firefox had to be killed and restarted daily or it would eat all my RAM and swap.

That being said, I made do with it for years because I love the tree tabs plugin and the containers. But 6 months ago I finally gave up on it.

The parent made it sound like the privacy side of Firefox was slipping, so I was hoping he could talk about any specifics.

I had to add a lot to my user.js (or about:config) just to avoid Mozilla's shady telemetry and diagnostics. If you google it, there's even Hardended Firefox...

Can't you just uncheck the telemetry box in the settings? I don't get what is shady about it though, you can see what is being sent (about:telemetry) and they tell you it's on by default.

That's not the only place where telemetry takes place. Even with that option turned off, FF has other telemetries working in the background.

I run Firefox for two months at a time with no memory leak issues. I have 6 Firefox windows open at all times with over 200 tabs open and over 300 tabs open at once at points during the day. Right now it's using 3.5GB of RAM. The only reason I don't run it longer than two months that is I need to reboot for OS updates. This is on Debian.

On my Ubuntu firefox can do the same. On windows 7 it falls apart.

Lol why are you still using win7? Uses an outdated os that is no longer supported. But doesn't attribute programs playing up to that? Mate. Win7 is your problem get off that.

Windows 7 is still supported by Mozilla:

https://www.mozilla.org/en-US/firefox/100.0.2/system-require...

Firefox works better on some platforms and hardware, Chromium works better on others. It is what it is and blaming users won't fix their problems.

Windows 7 is a better experience compared to windows 10. Windows 7 doesn't ask me to upgrade or throw ads in my start menu or sends installed program data to Microsoft or have any of the other enhancements

I do have win10 on a different machine and a smaller performance happens but still happens.

I have Ubuntu and an even smaller performance happens but it always happens.

But on Windows 7 the memory leaks are very noticable.

Windows 7 is no longer security-patched. Regardless of how you feel about the good old days of 7, you are a risk to yourself running it.

It bears stating that if you are also using a machine running 7 in a company setting, you are also a risk to that company.

Personally I've seen the opposite: video sites on Chromium that would eat up 300MB+ and an additional 1~3MB of leaked mem per action. Whereas the same site on FF would happily sit at 20~30MB.

Not true in my experience on Windows.

I find Firefox handles many tabs better than Chrome.

That's your computer bud not Firefox.

Firefox doesn't have memory leaks.

Use it on Mac and Linux on a daily basis, and don't close tabs for weeks at a time when I forget about them. Are you sure it isn't your tree tabs plug ins?

I switched to brave, because Mozilla is no longer actually defending privacy, Firefox has full telemetry, allows google analytics,has unique Id for each installer, and much more.

Brave on the other hand, has an ad-blocker by default, blocks trackers, blocks Google amp, limited telemetry, and has a fully independent search engine.

Its a browser I can reccomend to anyone, and they will be more private by just using it, yes its not perfect but disabling the crypto is stuff is trivial, its just 2 options to disable and you are done.

I lost hope that Mozilla is going to actually fix stuff, its now just spending money on political advocacy and has fired engineers while raising the CEO's salary.

https://www.ghacks.net/2022/03/17/each-firefox-download-has-...

https://arstechnica.com/information-technology/2020/08/firef...

Brave is headed by the guy who invented Javascript, one might say you're taking your online privacy/security out of the frying pan just so you can toss it in the fire.

what does creating JS in 1996 have to do with brave and its proven privacy protections in 2022?

proven, https://privacytests.org

LibreWolf is a Firefox fork/mod which actually respects privacy in my usage (if you trust it to be non-malicious). It enables privacy features, and turns off Firefox-bundled ads and studies and telemetry.

I had to turn off fission.autostart on an old machine with 4 gigabytes of RAM (and maybe decrease content processes to 1), to make it use less RAM.

LibreWolf?

Breaks a lot of sites and disables a lot of things for no reason.

Its only for very advanced users.

LibreWolf?

Source: https://privacytests.org/

A fork of a browser that is already known from poor security history

Looks like they've tightened up the security quite a bit.

I find the default brave values to be very good. Its almost the best browser in terms of privacy protections by default, only battered by librewolf which breaks a ton of sites(1)

And with brave search, you have good search and a good browser too.

1. https://privacytests.org

I've been using Brave as my primary browser now for at least four years, and it breaks very few web sites these days. I still have to revert to another browser every once in a while (less than once a month). The Brave experience has made using any other browser painful... Whenever I open a familiar site in a different browser where Brave isn't available (work) it's a jarring and dissonant shock. So many annoying ads everywhere all of a sudden! The crypto stuff I just ignore.

I never really understood the crypto stuff. BAT isn't mined on the computers of people who use brave, right? so why is it even a cryptocurrency at all, couldn't they just essentially use a non-coin solution? aka a bunch of integers in a sql database

I never cared about BAT, I just realized its was centralized on top of ETH and then just stopped caring.

I immediately disable it and anything related to crypto and I just forget about it.

The official story is that Brave runs a revenue share program, so if they wanted to use "real money" they would have to be a licensed money transmitter. To sidestep the regulatory issue, it is much easier to use a cryptocurrency for the payout and punt all the KYC/AML requirements to a crypto exchange.

"Why BAT and not just use another existing crypto?" Well, they tried! They started with Bitcoin, but no one wanted to use BTC to tip or contribute, which is kind of a problem if you want to build an alternative monetization strategy for content creators.

Safari, GNOME Web, Falkon.

Both are open source, aren't they?

Would be nice if there was a tool which automates all this and hardens the Brave in one simple click

Anyone ever consider the possibility that crypto isn't needed in a society that is based on trust, and if we all trusted each other, then none of this is necessary? It is almost as if the powers that be want crypto because they don't trust anyone, and therefore perpetuates the problem of needless abstraction?

Western countries are rapidly moving from being high-trust to low-trust societies. The reasons for this are multifaceted, complex, and self-reinforcing, and it isn't likely that the trend will be reversed any time soon. Certainly not within our lifetimes. So we can either stick our heads in the sand about it, or develop technologies to deal with it as best we can. I'm not a crypto fan myself, but I understand why it exists and why it will probably be increasingly important as time goes on.

No one will ever trust a completely trustless coin, because if you can't trust each other, putting trust in an abstract concept isn't exactly a winning solution.

Human trust matters, not mathematical trust.

Unfortunately you don’t understand what trustless means in this context. “No one trusts a trustless coin” makes no sense, there is no trust required for it to function (theoretically). It works as expected whether your counterparty is a saint or entirely corrupt.

I do, I think. No one wants to use a coin that also let's criminals do dark things with even less scrutiny than fiat currencies.

And we can see this across all levels of society, from cryptocurrency to grade inflation to George Floyd to political corruption to school shootings. The loss of trust in institutions is particularly accelerated today, whereas people of the "Greatest Generation" who are dying now grew up in a world where teachers, police, and politicians were generally trusted.

> and if we all trusted each other, then none of this is necessary?

I mean, maybe, but that's never going to happen so it really doesn't matter

Why do you say that?

Your periodic reminder that talking about "trustlessness" in distributed systems only means that the consensus can be verified independently and that there is no central authority.

Just use Vivaldi :-) Simplicity is a virtue. Complexity is a sin.

Isn't vivaldi closed source?

Nearly all of it except the web renderer. You may like its GUI, but a secure or privacy respecting option it is not.

Network analyses also show it's a very chatty browser.

Reply on news.ycombinator.com