Hacker News Reader

Comment by tptacek | Hacker News Reader

One of the first things you can do with any of these kinds of lists is to see if they recommend Firefox over Chrome. It's an excellent shibboleth, because Firefox codes (rhetorically) profoundly more activist- and privacy- friendly than Chrome does, but Chrome has much more sophisticated and better tested runtime protections. Firefox seems like it would be the better recommendation, but if what you care about is not being easily (==cheaply) targeted by exploits, it's not.

View on HN

The majority of activists aren't going to be targeted by a 0-day. Most probably won't even be purposefully, directly targeted. They're more likely to have their data given/sold to the government as part of a larger batch (geo-fence, etc.). I would not recommend a Google product with that considered.

The activists that are legitimately, specifically targeted should probably be past the "101" series of infosec and not be using either without significant other considerations and protections.

My new line when people rebut this is just to ask: did the guide we're talking about lay this out, so that people could make up their own mind about whether their organization was likely to be targeted by federal law enforcement agencies, which license zero-day vulnerabilities and delivery platforms from 4-5 different providers, or instead by commercial telemetry?

Of course, none of them do, because the premise of that question is alien to them. It requires understanding that Firefox and Chrome have different runtime security postures, and to talk about that you have to be willing to push through a fogbank of people ideologically opposed to the idea that Chrome could be, at a technical level, better.

Your original comment sounded like (how I read it, at least) you think Chrome should be the default recommend in this (and similar) guides. Full stop, end of story.

This comment sounds like you think guides should be more nuanced regarding the specific threat model that is trying to be mitigated.

I agree with the second one.

No, I think people should use Chrome. But my actual docket of security advice wasn't the point; my point was: if they got this wrong (and by suggesting that Firefox is a categorically better choice than Chrome, they have), what else did they get wrong?

As a security person, I have borne witness to many, many "which browser is really more secure?" or "has Firefox caught up to Chrome?" arguments. I have seen "you should use Chrome (or Chromium) no matter what" as responses; I have seen "it's complicated" as responses. I have never seen "you should use Firefox no matter what".

As a security person, I agree that this guide is not great. I agree with pretty much everything you've said. However, I disagree with your original comment that a recommendation in favor of Firefox means writing off a guide entirely.

But that's probably for some other time, I imagine we can leave it at agreeing "this guide is not great". I doubt it is good for my career to butt heads with the tptacek on a security topic.

Oof.

I just think it's an interesting way to think about these things. There are a couple recommendations these kinds of guides recurringly make that are "tells" that the people writing it aren't, let's say, super engaged with the communities of expertise the recommendations are meant to be drawn from.

I learned last cycle not to waste too much energy red-penciling security guides; there will be more of them following this one. But I am interested in general rules of thumb for how to read any of them.

For what it's worth, I comment here worrying that 'saurik and 'comex and 'pbsd are at any moment about to hand me my ass. Wherever I am in the heirarchy, it's not close to the top.

except about SOC2

This is not smart. It's entirely reasonable that Chrome may be better on top of its exploit game; but this absolutely pales in comparison to the threat of universal surveillance that Google hits us with frequently. Shouts to the heroes on the inside, but what did I just hear about an AI removal pledge?

>> One of the first things you can do with any of these kinds of lists is to see if they recommend Firefox over Chrome. It's an excellent shibboleth, because Firefox codes (rhetorically) profoundly more activist- and privacy- friendly than Chrome does, but Chrome has much more sophisticated and better tested runtime protections. Firefox seems like it would be the better recommendation, but if what you care about is not being easily (==cheaply) targeted by exploits, it's not.

> This is not smart. It's entirely reasonable that Chrome may be better on top of its exploit game; but this absolutely pales in comparison to the threat of universal surveillance that Google hits us with frequently.

So the smart thing is to use Chromium, then?

I still doubt it? It's a marathon, not a sprint; I still trust Firefox more.

See, this is what I'm talking about. If you're trying to protect activists from threats, protect them from threats. Making a political statement about commercial surveillance isn't doing that. A lot of these guides are LARPs.

How about this: if you feel strongly about commercial ad surveillance vs. susceptibility to drive-by RCE exploits loaded off web pages, look to see if the "infosec for activist" guides you're reading at least offer their readership the choice of risks. Does this one? (Rhetorical, obvs.)

Commercial surveillance enables government surveillance. If an app constantly sends my location to a corporation by default, a government-level adversary can just demand it from that corporation, no need to burn a 0-day on me.

This is a complex thing. Don't give your location to the app. Turn off GPS, use VPN and don't use any apps/sites that linked with your real identity on the same device. Most of the other parameters in the commercial surveillance are too common to ID someone with a good probability.

Exploits, on other hand, can leak your full environment, including a photo from the cam.

>commercial ad surveillance vs. susceptibility to drive-by RCE exploits loaded off web pages

Is Firefox more susceptible to RCE exploits?

I would like more input on this. Maybe I'll ask Claude.ai later.

All I have seen as a casual user is this from GrapheneOS: https://grapheneos.org/usage#web-browsing

It asserts that Chromium has much better sandboxing and site isolation than Firefox.

Does the same apply for Chromium or does Chrome specifically have better runtime protection than Chromium? Why not mention Chromium?

You lose auto-update, right? The only concern I have off the top of my head.

Given that Google has vast resources, someone with no background in security should still be able to infer that Chrome is likely to be more secure.

On this topic, I wonder if Chrome’s safe browsing notably improves the user’s security?

It sends user’s private data to Google for scanning. The trade off has to worth it.

This is another part of what I mean: people on message boards read these things as message board arguments, oblivious to the fact that the whole point of these guides, if they're for real, is to communicate with people who are making absolutely none of these inferences.

The point isn't that Firefox is less exploitable it's that it has less blatant tracking than alternatives like Chrome. If you're an activist I'd imagine that exploits are a scary thought but the more direct threat is the tracking we (un)knowingly succumb to every day.

If your threat model is tracking, then worry about carrying around the 24/7 tracking device more than the specific software you run on it.

Isn't it the software which is tracking you? You can switch off the cellular connection whenever you need to not be tracked by the towers (if you trust your software, or with a hardware switch on some phones).

See, again: this is how message board logic turns these kinds of guides into LARPs. "Turn off your cellular connection whenever you need to not be tracked. Also use ProtonVPN."

Reply on news.ycombinator.com