The reason you have a bad feeling is it gives the FBI/FEDS a single point to collect your data, with a man-in-the-middle attack that you will have no idea is there.
This is absolute BS they're implementing this.
This is absolute BS they're implementing this.
Just use Firefox. It works just as well as Chrome (*), but it's based on a completely different engine which was built from the ground up.
(*) On desktop at least (on Android I still use a Chromium fork for now)
That's a really unfair(and untrue) statement. Brave also removes some code they find privacy violating, built in a best in class adblocker, built a full cross-device sync system that works perfectly, some UI tweaks and enhancements, built Tor connectivity in, etc. Probably a lot more that I'm leaving out.
I am def not a fan of crypto or BATs or whatever they were pushing, but you can use it fine ignoring all of that.
Normally this might just be a platitude of the sort, "Go check it for yourself." But in this case that's not what I'm saying. Brave is going to be used by large numbers of tech focused users with a privacy/security bent. And they are also competing against Google who will make sure even the slightest slip by Brave is promoted across the entirety of the web.
That code is scrutinized heavily. That the worst you can find about Brave is people making false statements about crypto stuff (it is entirely optional and opt-in with 0 coercion or dark patterns to push you there) speaks incredibly highly as to the current state of the Browser. Might that change in the future, as you seem to be suggesting? Yip! And when it does there will be a new Brave. But for now they continue to stay on an excellent path forward.
I think I overestimate the amount of broken sites due to the adblocker messing them up, not Firefox.
People like to shit on advertising, but much of the internet exists today because of advertising. Do you think Youtube could exist at that scale without ads? I don't think so, personally. At least, not without another way to monetize.
Brave is the only player providing an alternative monetization strategy. Crypto or not, to me, that is by far the most interesting thing a browser has done in a long, long time.
I want to but in Firefox developer tools there is no option for developer tools to follow new tabs.
Apparently this has been an open bug with Firefox for a while.
But it is what keeps me from using Firefox vs Chromium's full time
What chromium fork is on android and actually better than Firefox for android? I use Firefox for the best possible experience on android and would like to be aware of another option.
From my (anecdotal) experience, Bromite is faster than Firefox on my phone, but your mileage may vary.
I was originally using Firefox due to its uBlock Origin support, but Bromite has ad-blocking built-in (unfortunately it's not quite up to par with uBO but it works well enough).
I would suggest that you try both and see which one you prefer.
If they still don't work, they're doing some messed up stuff on those sites.
>It works just as well as Chrome () Not on anything* I use, it doesn't, so "No....thank you".
Tbf, I do keep trying ff, but...clunky, jeepers! 'Fraid I'll hang on until my Brave jumps it's particular shark and then maybe I'll hop over to something else, but for now, and as long as I can still use UblockO, Brave it is.
Even Opera is looking interesting again....
What browsers have you been daily-driving to come to that conclusion?
We don't know that. Maybe Microsoft could maintain their own browser engine if Google hadn't provided one on permissive open-source licensing terms that met their needs.
This is why Apple really came out of the blue with Steve Jobs' razor focus on quality above all. Microsoft's goal is never to be 'best in class'. Because they don't need to be. People will buy it anyway.
MS can afford it financially. The desire to put in the effort to is not there.
Users, trusting the ad company that provides them free email, search, video, photos etc. will action on the suggestion and install Chrome.
More users gives google the market power to dictate web standards
The solution (to me) is simple - fix native app distribution. Make platform targets operate the same as they used to, and give people control over their computer again. The only ones preventing us from a platform-agnostic utopia is Apple and Google, both of whom profit off the artificial difficulty of distributing applications.
So, here we are. Google is poisoning the web while Apple refuses to swallow their pride. Everyone is hurting, and nobody stands to gain anything but the shareholders. A hopeless situation, but let's not pretend like everything here is morally grey.
Are people now using Edge because of this change?
Except they can't be. Native apps don't offer the same freedoms that the web does. And so, we keep stacking technologies on top of web browsers to alleviate the problem. It's a bad situation, and both Google and Apple are gruesomely complicit in making this situation worse.
> Can you please give a concrete example of what Apple should do, in your opinion, to expand their API targets?
Stop browser lockdown. Allow sideloading. You know, the basics of computing that we had figured out since the mid-90s or when we sued Microsoft.
Is that a practical sustainable long-term business practice though? Firefox was only able to be free because Google was paying Mozilla. Browsers are some complex software and software developers wanna get paid. I know that the in's and outs of history of browser software has conditioned us to expecting browsers for free but that doesn't reflect the reality of developing the software.
Surely there's space in the browser market for a model akin more to how Wikipedia operates.
Donations by corporations, and edited by powerhungry users (ryulong) and bots?
The Internet being global makes this challenging, and almost all countries (including so-called democracies) wanting to drink as much authoritarian juice as they can get away with does mean that there is plenty of risk here as well. But letting one or a few giant megacorporations entirely dicate the primary intrastructure for information interchange is so much worse.
The problem with this approach is that it’s impossible to get a safe binary that isn’t downloaded from “libfree.cxcc.gg” or whatever. The other option being to build from source, which is an absolute nightmare for Chromium.
Signatures available from whom?
The point being that a web browser is a very special case of software that has to absolutely 100% trustworthy from a reputable commercial entity (that is, someone that can be sued). The only other thing with that level of trust is your operating system.
Do you not trust kernel.org? Or the GPG signatures of the commits?
What about Mozilla?
As for "someone that can be sued", have you read any of the EULAs of the commercial entities that you think are "reputable" and "100% trustworthy"? You can't sue them.
Similarly, do you trust all of the CAs that have certificates in your OS or browser trust store?
Those were the days.
Any Browser can be a reality.
Dillo
Links
NetSurf
Others like me would. And resource-constrained devices. An eco-system of low-tech sites could emerge with a label signaling them as simple and virtuous.
I'm sure people said the same thing when Edge was in beta. "How is Microsoft Chrome(2)?"
(And I think Edge is worse than being Chrome(2).)
I know it makes a lot of money for Microsoft but the fact they chose to keep the quality so low really looks bad.
Only thing I have to pull out Chrome for is corporate intranet.
Though, I do believe that for connections from public WiFi it's somewhat of an improvement. It establishes a minimal security baseline of: "ok, we'll sell your data and let FBI snoop on you, but we won't inject trojans in your downloads and then hijack your webcam to create ransom-porn (though the FBI/??? might)".
Story time. Someone I know once got laid thanks to Facebook not encrypting their sessions
My university was still using basic ass unencrypted WiFi with some kind of terrible dns-hijack sign in to “auth”. This of course meant that everyone put their shiny MacBooks on essentially public wifi and logged in to social media in the clear in class.
Some enterprising chaps made a browser extension that made it trivial to snoop any open sessions and impersonate that session in a new tab.
Someone I know would do this during lecture and post to people’s social media as them saying they should pay attention in lecture. Possibly some other scandalous things were said. The hilarity that led from that stranger doing so led to the beautiful nerdy girl sitting behind this person noticing and daring them to post more. That became hanging out, parties, and as far as I know they got married and have kids now.
Literal people exist that wouldn’t otherwise because Facebook didn’t have HTTPS
Firesheep was super big for a while, yeah. I used it to show a few coffee shops that yes, really, WiFi with a password of "password" was measurably better for their customers than no password: https://en.wikipedia.org/wiki/Firesheep
It works. It's fine. No, it does not need ssl. What, someone is going to hack a floppy driver for a computer, which doesn't even have a built in network stack?!
No, I am not going to do work on it, any work, at all.
Millions of such sites exist, are fine, are safe.
Depending on what the drivers are for, you may be a prime candidate for MitM. People already go to your site to download software they're going to run in the most privileged mode. This is a perfect candidate for a type of watering hole attack.
Considering you're providing those for 90s machines, you could be the last resort website for a few interesting industry computers with no security restrictions around them.
Doing that MitM is technically very easy, but in practice pretty hard. You'd have to have an adversary on your network path watching for connections to this particular esoteric low-volume site hosting drivers for machines from the 80s and 90s.
That is extremely unlikely.
I have a much easier way to target that content: Just put up a new site hosting the same content with malware attached. No need for MitM shenanigans.
Security isn't about absolutes, it is about risk managment and being aware of the likelihood and consequence of the risks is important.
Without HTTPS, the content can be replaced entirely. Last time it was JavaScript that DDOS'd github. If you don't want to serve content over HTTPS, then you don't care what your users receive. Just delete the site and they all get 404's instead, since you already admit that you don't care either way.
If it makes you feel any better, HTTP without HTTPS was a mistake we all made together. It should never have happened.
Given that http predates SSL 1.0 by a few years, somewhat inevitable.
You're at a coffee shop or library using their WiFi. Your computer sends a plaintext HTTP message. The attacker just needs to be able to see that message and get a response back to you before the real site does, and the real site is a lot further away than the guy sitting at the table next to you (or the hacked router, if he doesn't want to be there in person). Then they can feed your browser whatever they want.
A login form to phish you, perhaps?
They can even start replying, then go off and fetch from the actual site before finishing the response, if it helps to incorporate the real data.
There is nothing wrong with your website. However, you shouldn't be surprised when modern browsers stop working with it. Progress doesn't come free.
>are safe
No, they are not.
>No, I am not going to do work on it, any work, at all.
If you are too lazy to do it securely maybe you just shouldn't do it at all.
HTTPS everywhere by default can't come fast enough. There is no excuse at all to not have HTTPS support today and browsers should deny access to these lazy and careless sites by default. Anyone who can't spend the 5m to set it up for their website can go kick rocks as far as I'm concerned.
This genuinely happens a lot in the 2020s.
More likely sites get cloned, improve their SEO over the original, and distribute malware.
Sceptical of that claim, can you provide a few documented cases?
Particularly for low-volume sites like the parent post.
And update all links to not go back to the HTTP site...
And troubleshoot weird issues (TLS errors are generally not helpful)...
And maintain that setup for years...
Not an insurmountable effort for sure, but if you estimate 30 min for the total additional effort of adding HTTPS to a site then I have a bridge to sell you.
Frankly, even sadly, they are also entirely forgettable and don’t add enough value to hold back the modern web.
I always chuckle at this site does not need SSL post from n-gate.
PS: Use the URL directly in browser because the site doesn't like traffic from HN.
Or just fix your browser settings to not send cross-domain Referer headers.
HTTPS can introduce all scenarios for not being able to connect.
I'm not hosting any secret data, but I do want to be able to post from anywhere.
Literally to this day one can read things like the NSA manual for using their software that enables real-time absolute surveillance of Skype: "User's Guide For PRISM Skype Collection." [2] The idea of any degree of privacy from any tech company hosted in America is a lie. The main difference with China is that we lie about our surveillance state, and force companies to lie about it, while China openly advertises theirs.
[1] - https://en.wikipedia.org/wiki/PRISM
[2] - https://www.aclu.org/sites/default/files/field_document/Guid...
In many cases you can even determine which protocols and general content they are consuming from that IP based on traffic shaping/fingerprinting. The burst of traffic your browser sends when loading a particular site is quite exploitable. There's plenty of software already available that makes use of this.
but this just reminded me of the failed FB phone and the failed microsoft phone...
Looking at the ones I use daily... headphones, TV soundbar, Xbox controllers, TV remote. None of those provide an interesting attack vector.
My iPhone isn't really going to be connecting to random stuff and leaking data, so I don't really see the risk here. Maybe I'm missing something?
Incorrect -- BT scanners and loggers have been LONG tracking your things avail...
and the fact that Apple doesnt allow you to "turn off" it merely pauses..
both wifi and BT...
they use prox sensors for BT for airtags, wifi etc and ALL OF THAT data in mined like mad.
Any Apple person that says otherwise is lying to you.
How would they do the same for bluetooth? Broadcasting "Dans iPhone" doesn't tell you much.
they have so many correlation engines for device location, that it will soon be impossible to be "off grid", if its not already.
how the heck do you think there are fn leaks from over a decade ago of "text messages received by the government reveal that person X who is on the shit-list was quoted as saying [BULLSHIT] sources close to CNN have stated.."]
ASIDE: Famous story from ~20 years ago was talking about the CIA handlers at CNN... and the revolving door of in-q-tel emps from fb moving back and forth within the security team (one of which had to be walked out of the building for [things])
you dont need "dan's phone" they have had eschelon for DECADES and were able to literally do 6-degrees ppl tracking since the 1990s...
WTH do you think they named it "starlink" instead of sky-net...
And when they built the first part, they were advertising the wonderful things the rural folks in africa's greater continent will benefit, then after a few years they showed that the system will primarily service the dense populations of the coasts of places like the USA and AUS -- which is where a big portion of the five-eyes service.
IMEI and such is a bitch..
iOS is the biggest location tracking platform ever...
Remember when the founder of Android (from Danger) was let go from google with a ~200MM$ golden parachute at $90MM to gtfo?
Aside from that, this isn’t possible for HSTS sites.
Even more, for self-signed certificate on chrome, there is no button to continue for example. Check https://self-signed.badssl.com/
Tech support comes in many forms. The owner of the website, a friend who knows about computers, someone else in the workplace, the vendor they purchased their laptop from.
handelsbanken.se danskebank.se unicredit.it fideuram.it sella.it
I once wrote them a long email about what two-factor is actually supposed to be and why it exists, and got a reply basically saying "lol ok, our security is great ok?"
I've since switched away from them for a bank which does 'two-factor' by sending codes via SMS, but only when its algorithm decides that it needs to. That's not very often.
unicredit.it is not on the list, but unicredit.ba and unicredit.ro are. (Lines 7331 and 7332) It does send HSTS headers.
danskebank.se and sella.it are not in the file, nor are the base strings, but both sites do send HSTS headers.
fideuram.it is not on the list, and does not send HSTS headers, so they don't seem particularly interested in security. They also haven't set an A record for the root domain, so visiting `fideuram.it` returns NXDOMAIN. Only `www.fideuram.it` exists.
Isn't it possible for the user to disable HSTS. A simple web search produces detailed instructions, from a CA.
https://sectigostore.com/blog/how-to-disable-hsts-in-chrome-...
Also, what does "HSTS sites" mean. Does it mean (a) "official" HSTS via HTTP header alone, (b) "unofficial" HSTS via preload list (see RFC 6797 section 12.3), i.e., the list maintained by Google, hardcoded into a browser, or (c) both. The "unofficial" approach only seems feasible for a limited number of domainnames and unworkable for every domainname in existence.
In tests I have done on Chrome (YMMV), executing "Clear site data" via Developer Tools, or including
Clear-Site-Data: *
Besides being generally annoying, HSTS allows for setting "supercookies" that persist even in "Incognito" mode
https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro...
The RFC for HSTS even admits how it can be used for web tracking. Not too concerning for the advertising company sponsoring the RFC.
14.9. Creative Manipulation of HSTS Policy Store
Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains).
I use a loopback-bound forward proxy to enforce zero tolerance for HTTP across all programs, not just the web browser. Everything is sent via HTTPS. The proxy is configured to to check certificates, and deny connections, according to rules I set. I use a text-only browser for noncommercial, recreational web use so I need a forward proxy, if for nothing other than to deal with the spread of TLS. But I also use it for a whole laundry list of tasks.
Maybe it is just me, but HSTS, like much of Google's rhetoric, comes across as unfriendly if not hostile to proxies, regardless of who is running them. Consider this line from the RFC
"The rationale behind this is that if there is a "man in the middle" (MITM) -- whether a legitimately deployed proxy or an illegitimate entity -- it could cause various mischief (see also Appendix A ("Design Decision Notes") item 3, as well as Section 14.6 ("Bootstrap MITM Vulnerability"));"
"Mischief." Does that include inspecting one's own HTTP traffic on one's own network. How about blocking certain methods of tracking, data collection and advertising. Apparently it includes disabling HSTS.
Let's be honest. Google is an undisputed king of "mischief". The stakes for Google mischief are much higher and there have been too many fines to count. Consider the latest. How many people deploying their own proxies get fined $4B. (Arguably, an issue of "control" was at the heart of that decision.)
https://www.theregister.com/2022/09/14/european_court_fines_...
If the proxy is "legitimately deployed" then why not stay out of the network operator's way. Let them have control. Give the option to cede control to Google instead of making it a default.
I use HSTS for commercial, nonrecreational web use, when I have to use a "modern" browser. That is a small fraction of total web use for me.
Here, try this link in Chrome: https://untrusted-root.badssl.com/. When you click Advanced, it tells you "the website sent scrambled credentials that Chrome cannot process". And beyond that there's just no button to bypass it. You can't visit the site. (Sure, there's probably a chrome://flags or --disable-web-security way to bypass this, but that's well beyond the average user's comfort zone, as well it should be.)
I tried on a blank profile to make sure there were no strange settings.
EDIT: It turns out there is a "visit this website anyway" option in Safari, but it is not a button, it's a link which you only notice when you click "Show details" button and read the warning.
[1]: https://twitter.com/cyb3rops/status/1561995926666985472?s=20...
Not sure how that matches.
The user mistake is just clicking "advanced" then "proceed". I know all my family members would do that without questioning.
In theory anyway, I pick my ISP. If this was "support for using a VPN" instead of "we're injecting OUR VPN" I would feel a lot better.
I'm aware Im using my ISP. Even someone who doesn't know much about computers knows their traffic is going somewhere. They might not know the repercussions of that, but if this is just transparently on in the background, effectively a keylogger, a user might never know this is happening.
I give my ISP money. Back to the choice option. Some ISPs are bad and are trying to nickel and dime you to maximize profits. Some ISPs are actually good (I'm not swiss so I don't know for sure, but Init7 looks amazing https://www.init7.net/en/support/faq/privatsphaere/). I don't have to question with my ISP "how are they profiting off of me" because I give them money every month. They might be, but they don't intrinsically NEED to be scraping my data. I am not sure how Microsoft benefits from giving me a free VPN unless they are scraping my data.
I can use a VPN to bypass my ISP monitoring if they do monitor. I have no idea how Microsoft's stuff is set up here. If the end result is that it gets routed through their VPN after my VPN, or instead of my VPN, or even through their stuff at all, but with stamped metadata, then there's not necessarily a great way to get around it other than "don't use Edge"
In general, yes, your ISP isn't your friend. But an ISP is something I asked for, have a use for, and need. A Microsoft stealth VPN is none of those things.
The thing is that it would need to be smart enough to prevent pattern recognition, e.g., it cannot just be random data because your specific searches and string of searches or actions will stand out quite obviously.
Yes, it would place a severe tax on the internet and a few things could be done to minimize that, but I currently do not see any other better option.
I could see it implemented where your activities online are merged with and threaded into those of related or similar communities, e.g., be it family and friends, the YC community, or a combination of different groups. The effect would come from the proximity to similar but not exact activities. To use a common example, if your legal free speech activities could make you a target, those online activities are muddled and polluted by being merged with other people's legal free speech activities, and your activities would be merged with those of others.
Consider it a kind of mutual compromise of society in order to provide protection/obfuscation in numbers ... the zebra in a herd, if you will. They can't arrest/target everyone if everyone has activity data that looks like they defy the ruling powers.
this is a terrible and dangerous idea. Nobody cares about the accuracy of the data they collect on you. Stuffing your dossier with random things won't cause anyone to throw it away just because there might be errors in it. Instead all of that data, random/accurate or not, will be used against you all the same.
Your clever browser extension might have been responsible for browsing to a bunch of fast food websites, but your health insurance provider won't care. They'll just see that in your internet history and quietly raise your health insurance premiums anyway.
If your legal free speech activities make you a target, adding more free speech activities to your permanent record just means you'll also now be targeted for those activities on top of your own.
You can't know what will prejudice someone else against you. You might not be gay, or Muslim, or a heavy drinker, or an Andrew Yang supporter, but your browser extension pulls in the wrong data that gets you flagged as being one and it could cost you your job, get you denied housing, etc.
You might not be looking into getting an abortion, but anti-abortion activists who buy up the data of anyone who appears to be trying to get one, or looking for support after getting one, will still see you listed and you will still get harassed by them or dragged into a texas court room.
You might not be rich, but data brokers and consumer reputation services will see that you've been interested in expensive vacation spots and online stores will start charging you more than your neighbors for the same items on the assumption that you are.
If you want to try to hide in the crowd look into a VPN or TOR (although be aware device/browser fingerprinting can still get your traffic associated with you). Just please understand that giving others more ammo to use against you isn't helping yourself or anyone else. Adding more and more data to your internet history just increases your risks substantially because no matter if you deserve it or not your life will be impacted in countless ways by the data you surrender and none of that data, "pollution" or genuine, ever goes away.
You would confuse models currently shooting fish in a barrel.
You would still pick the cheapest insurer (probably one that does not look at your data).
You can live without anyone abusing your privacy in this way.
having a wife and kids helps with this. or any shared wifi with a guaranteed shitstream for your tunnel to wade through
Like sending usage information to the browser developer.
Like downloading code (experiments) for specific users which can essentially do anything.
Are you debugging your browser 100% of the time and fully analyzing all communications that there is nothing leaked. Is anyone?
Good:
* Better privacy from the intrusive ad motivated JS shit hole the internet has become.
* Faster internet for those on slow connections
* Protection from ISP MITM. Many countries now have mandatory data collection laws that ISPs have to follow.
* Better than a lot of shady 3rd party commercial VPN providers.
* Is opt-in (for now)
* Potential to reduce Google's dominance
Bad:
* Obvious MITM choke point, as you mentioned
* Potential control / monitoring by two large corporations
* Business goals usually override users.
Are you sure?
>a VPN baked into Edge appears to be turned on by default, but only for certain use cases.
I think the other side of this is if you have FBI attention, do you really want to look more suspicious? Whatever fight you try with them you will not win.
I suspect this is the corporate motivation. The increased state surveillance and control is a side effect.
Does this mean they will also have the ability to collect corporate data from the browser in companies like mine?
However, there analogy is not 100% on point.
the reason microsoft is doing that is because google is forcing their hand with Floc implemented in the browser.
you wont be in ads next year unless you can slurp more traffic than the NSA. and only google can do that today, thanks to chrome + android. apple is a close second.
Out of the perspective of a PRISM Premium Partner this makes perfect sense.
EDIT: clarified "US" government, though I don't necessarily intend to suggest other governments are the worry.
Clueless shareholders on the 59th floor of JP Morgan who don't even use Edge see "oooh VPN, me like buzzwords" and upvote the stock.