Slashdot Mirror
Ask Slashdot: Most Secure Browser In an Age of Surveillance?
An anonymous reader writes "With the discovery that the NSA may be gathering extensive amounts of data, and the evidence suggesting makers of some of the most popular browsers may be in on the action, I am more than a little wary of which web browser to use. Thus, I pose a question to the community: is there a 'most secure' browser in terms of avoiding personal data collection? Assuming we all know by know how to 'safely' browse the internet (don't click on that ad offering to free your computer of infections) what can the lay person do have a modicum of protection, or at least peace of mind?"
IE10 and 11 are superb browses. They containing many very good tactics to secure the browser and computer, for example, true sandboxing and JIT hardening. Most other browsers don't come even close.
Secondly, the sandboxing means that IE is usually able to block an attack on plug-ins like the Flash Player and JAVA VM. This alone makes surfing with IE remarkably safe.
IE really is an different kind of beast in the sea of mediocre browsers. It has come long way and is aiming for the top.
- John Futura
Security Consultant
I'll be uncharacteristically calm here, and ask that someone provide this, "evidence suggesting makers of some of the most popular browsers may be in on the action."
And in any case, let's be realistic. The NSA doesn't really need help from your browser if they're watching all your traffic. :p
Security should begin at the hardware level, the kernel should be inaccessible from a hardware perspective. The next best thing is a complete secure OS, so your options are limited to something like TAILS.
https://tails.boum.org/
I wouldn't say its 100% secure, its certainly not, but it does raise the bar a little and for them to use anything against you, they would need to admit to having the ability to break encryption. That's not going to happen. That said, always be careful as it will be used in other ways should it be required.
Other than that, there is no such thing as "safe".
A LiveCD with TBB:
https://www.torproject.org/
for LiveDVD/USB preconfigured not to leak try TAILS:
https://tails.boum.org/
in both instances unplug your HDD(s) before use.
Face it, who's going to bother writing anything to exploit flaws in lynx? It just isn't worth it.
The EFF has provided an up to date list of privacy-enabling tools in the age of Prism. http://prism-break.org/
They record where your traffic goes, not what's in it, they don't need to know the specifics, who you're talking to will tell them that. You can use encryption, and they'll still know who you're talking to. You can use Tor and they'll just record everything you send/receive before it enters the Tor network and if they're interested they'll put effort into decrypting it. You can use a vpn, but they'll just look at the traffic from both sides of the vpn making it pointless.
So really your best bet is to not communicate with any site that isn't 100% american, to never say anything bad about the powers that be regardless of truth and just totally forget your basic fundamental and 1st amendment right to free speech.
sacrifices may be required
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
... the snooping is done on your ISP's backbone, and the browser you use makes little difference. Government level snooping is a whole different kettle of fish to bad companies stealing info from you via tracking cookies.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I won't enable Google's safebrowsing in Firefox or Chrome even if this faq is for the Google Toolbar. With stock Firefox safebrowsing enabled, looking at the network traffic can see that every new site visited triggers a google api call with a long encoded data url.
12. What information is sent to Google when I enable the Enhanced Protection Feature?
When enabled, the entire URL of the site that you're visiting will be securely transmitted to Google for evaluation. In addition, a very condensed version of the page's content may be sent to compare similarities between authentic and forged pages. For example, if the condensed 'fingerprint' of the page you are visiting matches the 'fingerprint' of a popular bank's site but the page's URL is different, that's a good sign that the page you are on is designed to mislead users.
curl is pretty secure. Even in the hands of a novice, it can resist phishing attacks: you won't even figure out how to leak your data!
If you want true security, you really have to not transmit any information. This can be done by reading the web over someone's shoulder. This allows download only internet access, which has high security, but you must avoid transmitting information to your operator, and need to be wary of cameras.
An improved version of this is wiretapping: as long as you only copy someone's traffic, you can get lots of web content without disclosing anything about yourself. This is vulnerable to treasonous contractors though, so try and keep the work in-house.
Considering that the internet transmits your public IP address in every header you send across the internet and also contains the IP address of the destination, there is no way for you to hide what sites you visit without going through a proxy server. As far as I know, Header information in every packet is plain text and there is no way to encrypt that because if it was encrypted then no router would be able to forward your packets onto the next step in its final destination. So your browser, e-mail program, or anything else that sends and receives data through the internet is going to leave a trail for the government to potentially record. It may not lead back to you specifically, but it will lead to someone in your household or in your neighborhood that is using your wi-fi for internet access, provided you haven't locked down your wi-fi. If you have locked down your wi-fi then the government can claim it was only you, someone in your household or someone you have given your wi-fi password to, which significantly lowers their potential suspects or targets.
If you send everything you do through a proxy server with a vpn connection to the proxy, then that has a very good chance of making you mostly anonymous. However, a warrant and the cooperation of the proxy service owner might make it possible for the government to still connect the dots back to you. Also, sending everything through a proxy server with all the non-routing information encrypted (via vpn) may actually lead to you being watched more closely then if you don't.
If what you are really after is encryption of the contents of what you see and do on the internet, your best bet is probably still a VPN through a proxy server. Especially since SSL and some of the other methods for encrypting data between two end points on the internet aren't as secure as they were once thought to be. I don't know of anyone that has come up with a replacement for SSL that has been adopted by very many content providers. And even if the web browsers may have adopted some new security encryption scheme, it won't be effective until most if not all content providers also adopt and implement it.
IE, Firefox, Chrome, and Safari are all decent browsers. However, all of them send to the server what fonts you have, which almost always is unique to a machine (EFF's panopticlick will show that to be the case pretty often.)
However, there are things to do to help with "supercookies". On Windows, I highly recommend running Sandboxie, and put the sandbox on a different volume than everything else. This way, any changes are redirected away from files, and when the browser is closed, anything it writes is gone. Of course, nothing is 100%.
If you want a better browser solution that takes some doing, there is always having a virtual machine on another box (so your machine doesn't have the CPU and I/O impact.) That way, malware could nail the VM client and possibly the server, but jumping through a terminal will be difficult. When done browsing, revert to a previous snapshot.
Of course, none of this is NSA-proof, but I look at what is more of a threat or privacy issue. Companies and behavioral targeting firms are far more of an issue to me than the NSA [1], as well as trying to isolate and block malware.
The most important thing, regardless of browser: Get an ad blocker. This is more important than even an antivirus utility because a lot of infections squirm their way through ad servers.
[1]: With SELinux and security guidelines, the NSA has actually helped things, so I really don't consider them something I need to worry about, as their data stays theirs, and doesn't wind up sold to all comers.
So you fix your browser .. are you also going to fix your ISP, whoever they buy their feed from etc etc until you get all the way to the actual web server? And how do you know to trust them?
Or are you going to build your own internet ,. with hookers and blackjack?
I am Slashdot. Are you Slashdot as well?
They do nothing!
“He’s not deformed, he’s just drunk!”
Identity theft assures your privacy, so to speak. However, that would be illegal. Good thing they're looking for authentic criminals.
.. that can only be solved politically. If you want peace of mind, prepare for decades of serious struggle, and learn to be okay with that.
If your ISP and the websites you use hand over everything, if things gets collected at packet level wholesale; what does it even matter what browser you use? It doesn't, not one bit.
I use Firefox with the FoxyProxy plugin to proxy certain sites through Tor.
In all honesty I don't know whom to believe anymore when it comes to security one day you are secure and the next day you're not. Either way you be-damned. Your not secure even when you are secure so just pick a browser and enjoy the ride. Your mileage will vary.
None of the browsers will protect you from surveillance.
Work on the basis that your ISP is compromised and that the web services you use have shared their databases with Government agencies. When you consider this, changing your browser is going to have little to no impact.
I think the only way you can really be secure from surveillance is to use the tor browser and only use web services which can't trace you. So, no Google, Apple, social networking or any of the cool stuff we take for granted these days.
Backup not found: (A)bort (R)etry (P)anic
Have you noticed that most sites have gone https:/// only since a workable man-in-the-middle was devised ...
AccountKiller
OP says "what browser should I use" I automatically add "for the Facebooks".
Here's the low-down:
That's just off the top of my head. The software you use to disclose the information isn't the problem - you are.
I don't like being surveilled by the NSA, but at least they theoretically work for me (as a US citizen). Far worse is corporate tracking through ad and analytics beacons, and other behind the scenes data sharing. Lynx is the only browser with any hope of avoiding that, since it doesn't pull any 3rd party content when you browse a page.
wget -m -k -K -E -l 1000 -t 3 -w 1 http://www.website.com/
Then after waiting a while (ok, maybe a long while), open the page/articles you *really* wanted to read in a text editor. Sure, the NSA might know which *site* you visited through normal spying means, but they'll never figure out which *page* you were really after.
Of course, they might think you read all the pages, and spend a few million dollars of taxpayer money trying to determine whether it's possible for someone to read 1 page per second and whether that implies terrorist connections, but they're clearly already misusing your tax dollars so you shouldn't really care if they misuse some more.
You can bet that any browser worth its salt has had agents involved in its creation whether or not the people who built the product were aware of it at all. You can also bet that encryption products whether free or commercial often have back doors or keys built in. That is the very essence of intelligence gathering. Do not assume that physical or software products are free of snooping abilities.
I suppose your best chance might be a browser that was never popular or used by many people at all.
Think back a few years and recall the tunnel that we put under the Berlin Wall in order to tie into a major Soviet phone trunk line. We intercepted phone calls for years from that tunnel. If we could do that about 1968 or 1970 just imagine what could be done today. DARPA was the motive force behind the creation of the net. DARPA more than any other entity would have great reason to spy on communications. This is not a new issue.
Except that Chrome phones home the first time you start it up to check for upgrades. This has the unfortunate 'effect' of informing Google of the browser ID at this IP address, and as a consequence it informs the NSA of the linkage of browser ID and IP address.
Post NSA, I try to avoid Google services. They try to grab data for themselves, but in the process grab it for the NSA, and if the choice is NSA+Google or no Google, then I go without Google.
I opt for Firefox with the 'check for updates' turned to manual checks.
It's a minor thing, but it helps in as much that the choice of browser can help (not much if you're in the USA, quite a bit if you're not and behind an ISP NAT).
gee, must be getting old, but I remember rumors of the NSA monitoring your phone calls via computer since I was a little kid in the 80's
now its a discovery that sending the equivalent of a post card though the mail might be read!
OMFG! worlds shattered for the ignorant blissful youth, least you weren't murdered on your college campus by the national guard like your grandparents, you arrogant little turds
I mean for fucks sake, no god damned shit, you send plain text whizzing around the world and blindly accept that no one would ever read it based on unicorn farts and wishes tossed into a fountain, and NOW that you have acted like little asshat turds are you worried that people you never intended to see it, actually see it cause its the story of the month on babble TV
time to wake up and live in the real world childern, the padded corners and poofy bumpers are long gone
Install these disruptive crypto-fonts immediately!
http://yro.slashdot.org/story/13/06/22/1840234/introducing-the-nsa-proof-crypto-font
When data collection occurs on the server side, and the network protocol is mostly happening in cleartext, what good is having a "secure" browser?
You see? You see? Your stupid minds! Stupid! Stupid!
I'm sure as long as you use one of the OS's secured by the NSA you'll be fine...
http://www.computerworld.com/s/article/9141105/NSA_helped_with_Windows_7_development
http://news.softpedia.com/news/NSA-Has-Legitimate-Code-Running-in-Linux-Kernel-and-Android-361289.shtml
What does that mean please? My dictionary doesn't have it.
When the backbone is compromised, you're pretty much fucked unless you run strong encryption everywhere and obfuscate who you are talking to
1. How strong must those strong encryption be ?
NSA has their hands on the latest and greatest gadgets, including quantum computers, which can, theoretically, decrypt anything
2. Unless we have our own secured backbone trunks, there is no way we can successfully "obfuscate" our presence online, even TOR can be broken
Muchas Gracias, Señor Edward Snowden !
What else are you hiding that isn't already SSL encrypted? You should be asking for more secure plugins for your "ultra secure" browser.
I see, we're supposed to trust this bunch who offer no http services but only https via a certificate which is not valid for their domain, are we? They take security really, really seriously, do they? How, exactly? Doesn't that seem a tiny bit feeble? Some of the commenters here are praising this site but what I can see of it is not at all reassuring...
Doing what you prescribe will do the very thing that you are trying to avoid - get you on the NSA's list of people who are probably not American and must be up to something really interesting.
http://yro.slashdot.org/story/13/06/21/1443204/use-tor-get-targeted-by-the-nsa
What about passing a law that makes backdoors illegal and give congress power to enforce the law ?
Make software companies liable for backdoors ?
Make backdoors just as illegal as home-made nukes ?
Living in a democracy with power given to the lawmakers to ensure we have a respected private life ?
Is it already too late ?
If you are concerned about the NSA then their is no secure browser as the browser is only as secure as the ISP's and content providers you are accessing and given what the US Government is demanding they share that means no browser is secure.
Since there is no encryption they don't need a backdoor. If the packets go through a bridge owned by the NSA at a telco they can just collect them and listen when they want to.
I think the thing people really need to worried about is all those "web accelerator" boxes that proxy encrypted data (very stupid idea IMHO) - if the NSA has a back door into any of those you have to hope that nobody associated with them has a gambling problem and decides to use your collected banking username and password - or of course dozens of other less mundane things that could go wrong.
Given what's already happened, if you are in competition with a large US military contractor (Boeing was the one caught last time), you'd better beware of a bit of industrial espionage on their behalf paid for by the taxpayer and be very careful of what gets out onto the net.
Government surveillance is worse because it tends to be more focused than the analytics type of corporate surveillance that seeks raw data about users buying habits, which can be easily faked. In other words, it's far far easier to fool Google or FB than NSA or FBI.
I have a setup with 3 different sandboxes for browsing. 1) Sensitive (banking, confidential, financial or highly personal info) 2) General (regular random surfing such as slashdot) 3) Scary (file shares, flash games, java, anything that looks dubious or untrustworthy) The 3 sandboxes are simply different users setup on linux, all with restricted rights, and independent caches and profiles, and none of which is my normal 'login'. The 'launch' commands just run the browser under appropriate user. As for browser, Who do you trust? Microsoft? Google? Apple? I'd go with mozilla/firefox
http://www.gnu.org/software/wget/manual/wget.html
Firefox+noscript+flashblock+RequestPolicy = secure (at least "works for me") /etc/hosts:
also, ban google-analytics who seems to be virtually everywhere by adding this to your
127.0.0.1 www.google-analytics.com
127.0.0.1 google-analytics.com
127.0.0.1 ssl.google-analytics.com
the stated situation is that the people, (phone companies collect data for traffic shaping too), are collecting metadata which is just phone numbers and IP addresses, it's not content, no-one cares about your porn or gambling habits, so don't flatter yourself by thinking that anyone gives a shit about you political views, until you visit the wrong sites.
You could do what Richard Stallman does:
It's not the most practical way to browse the Web I would think, but it's an interesting datapoint on the security-convenience scale.
See http://prism-break.org/
Please be a bit precise here. What exactly is claimed have Microsoft and Google given to the NSA? And how exactly do we "know"?
Come on now. There's a powerpoint that proves it all.
It just needs a little imagination/fantasy and some extrapolation, then it is conclusive, irrefutable proof that the big companies have *all* of them given NSA direct electronic access to the companies' servers to perform any kind of snooping they desire with no judicial oversight.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
The short answer is: if you want some measure of anonymity, boot your laptop from a DVD (or other read-only medium) with a pure Linux distribution on it, then use public WiFi to access the Internet. You may want to verify the DVD checksum multiple ways.
It's not perfect, but it has better chances than anything more complicated you are likely to be able to come up with.
Last time this came up (half a dozen years ago? a dozen years ago?) someone made exactly such a plugin for Firefox. You'd give it a bunch of keywords and it would go out perform searches and random page downloads. It doesn't seem to exist anymore, though.
Actually, you're doing GOV/MIL a favor by using Tor for normal everyday browsing - you're providing cover traffic for them.
I see, we're supposed to trust this bunch who offer no http services but only https via a certificate which is not valid for their domain, are we? They take security really, really seriously, do they? How, exactly? Doesn't that seem a tiny bit feeble? Some of the commenters here are praising this site but what I can see of it is not at all reassuring...
What the hell are you talking about? That's a valid cert issued by a reputable CA for *.boum.org, and is therefore valid for tails.boum.org:
Certification path for "*.boum.org"
Subject: OU=Domain Control Validated,OU=Gandi Standard Wildcard SSL,CN=*.boum.org
Issuer: C=FR,O=GANDI SAS,CN=Gandi Standard SSL CA
Validity: from 2013.01.03 00:00:00 UTC to 2015.01.03 23:59:59 UTC
Further, why the hell would you prefer HTTP for any reason? What security advantages does HTTP have over HTTPS via wrong and/or expired cert? No matter how illegitimate certificate may appear, I'll take it over transferring plaintext.
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
denegation : n An undoing of a previous denial; double entendre; confused blathering de + negate + tion.
I'd paste in the dictionary's sample sentence, but the GP post did already.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Most of attacks simply don't work on links2 because it doesn't run javascript, has no plugins and so on. It has many times refused to take me to a page because of incorrect ssl certificate while firefox and chromium just take me there and after a bit of investigations I have yet to find links2 giving any false positives. Also, by default it doesn't send the referer so I think you could call that pretty secure.
People with a need for genuinely secure communication didn't use the Internet. Communication still happened.
Internet surveillance is so effective because people cannot resist the convenience of using the internet.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Your "secure browser" can be compromised by the Operating System. The Operating System can be compromised by the hardware.
The safest way to do your computing is to make all your own chips, assemble it yourself, and write your own OS. Even then you're subject to Man-in-the-Middle attacks, so you're going to have to go lay all your own fiber and do it all over again for those on the other side.
On mobile, I use the Firefox for Android browser. A big reason I use this, and never, ever, access Google Services with it is to make at least a little effort to remain outside the bounds of the Googleplex on Android.
You're pretty much 'signed all the way in' the Googleplex when you run Android, though I suppose you could use an alternate made-up Gmail account to establish your account with the Play Store.
Please, does anybody else have comments or knowledge to add on the matter of Firefox on Android? Are there layers of Android the Firefox browser has to connect through to get to the Net that Google and/or other agencies could be tapping into? I suspect there are, but my question is: does using Firefox make any difference at all? I don't run Chrome or the 'native' Browser on Android except to connect to Google Services. I never log into Youtube from Firefox (yes, I have the Flash plugin installed.)
They have hardware level access to the backbone of the internet. The UK just had a political scandal because their government is getting data on the citizens of the UK, which will now be looked into by some new (UK) government committee. The data were provided by our government. This data collection started in response to 9/11 initially only for international traffic, but was later expanded to include access through ISPs and backbone providers (AT&T and similar scale).
Separately, Google has business relationships with virtually every single significant web site most people go to. While this data is acknowledged to allow targeted online advertising, clearly once data about you is available it will be available to those with the interest, money and or power/leverage. The data available to adequately 'predict' when a woman becomes pregnant, which is supposed to be 'personal and private medical information', theoretically protected by HIPPA. This also raised a small stink because it was sufficiently accurate in it's guess work approach of analysis that advertiser’s use itt to send UCE for that specific audience.
The only way to have personal privacy is to use cash for all you purchases and paying bills, and don't use the internet or phones.
"right.... like that's going to happen'.
The ship has sailed. Privacy was traded for pennies of advertising and to give 'our' government the 'tools' to 'protect' our safety. The public and the liberal and conservative political parties have rubber stamped this.
Choosing a better browser is not effective unless all you want to do is slightly improve you ability to resist malware.
The other equally viable options the you could use... :D
"The Force"
'move along.... move along'.
Ask Slashdot: Most Secure Browser In an Age of Surveillance?
The one that's browsing a network server NOT on the Internet. How do you think the NSA and CIA do it? Completely separate networks and computers attached to them. Only way...
If you concentrate on things such as a "secure browser." you are asking to get targeted. Other than a pay-per-month smart phone whose number you give to no one, I can't see any way to do such a thing.
Just be as normal as possible in your browsing/communications, and limit "subversive" communications to IRC or face-to-face. In huge public places or areas of high population density, people easily lose themselves in the anonymity of a big society. Remember: all these government monitoring systems 1: look for multiple mentions or patterns of certain topics or browsing habits, not just one mention; 2: they are run by humans, with all their flaws. These people don't care about your buying habits on Amazon, as long as you aren't buying Ammonium Nitrate and egg timers. As long as you have basic ad-block and anti-malware, and your habits are similar to the other sheep on the cloud, you will be invisible.
Remember, the ninjas of old didn't dress all in black with hoods; they dressed like everyone else.
If I wanted to hide my browser activity, I'd run Damn Small Linux (or some other lightweight linux distribution) in a virtual machine (that reverts itself back to its starting state each time I boot it), with the lynx or links browser, and TOR over a VPN to a foreign server using Wifi via a Cantenna that lets me pick up internet from one of the 6 coffee shops, restaurants and other nearby small businesses with free internet. Maybe instead of a VM, run Linux on a Raspberry Pi (or other small computer) over a serial port... than it's easy to dispose of or destroy the entire computer if I needed to.
works for me only. General browsing, work form home. Sensitive( possibly illegal, or will be soon) stuff.....
1) Build a sterile notebook. (got mine from various friends scrap heaps. New HDD, reset BIOS, FreeBSD OS)
2) Live CD of AnonymOS or similar. Depends on the day.
3) TOR. Enough said.
4) Hardest encryption available. PGP variant minimum.
5) Darkweb.
6) Text only
7) Work from a public WiFi account. Choose carefully. A Starbucks around the corner will not do. Lobby of a hotel, cheap chinese takeout spot, anyplace with WiFi and out of the range of cameras. You may not be able to keep the fed from reading the data, but you can keep him from determining who sent it.
Again, works for me. Best way to hide a tree is in the forest. Second best, find any way that makes sure the sonzabeetches that voted for this don't serve another term.
"By any means necessary."
Before the web, we heard about The Anarchist's Cookbook, circa 1968 I believe. Lots of extreme stuff for sure, but the best thing I took away from it was to never say anything over the telephone that you wouldn't say directly to a cop. ... that advice has stayed with me for decades. For the truly paranoid, watch Coppola's The Conversation (1974, Gene Hackman et al) and you'll realize that even a quiet conversation while walking is not safe.
Pretty sure they didn't have voice-to-text back then, but even so
But then again, that's only if you have something to hide, yes? I gotta go. They're very close.
The commentary seems to assume a person only uses 1 computer.
Securing a browser and email may be fine, but that is only two of the access points between you and your critical proprietary data. There are lots more.
To keep proprietary data as secure as possible in an era where we work on multiple CPUs, why is not more conversation held about keeping proprietary business-income producing data on a CPU that simply doesn't ever (or hardly ever except for OS/App updates) go online? Turn the WiFi & Bluetooth off and leave nothing but the power cable plugged in.
Someone getting an encrypted email may or may not be able to decrypt and see some piece of your work as someone may or may not be able to get some browsing history. But those aren't likely to kill your project. If it is, I think I would access those from my public library, where I'm one of 50 CPUs online.
Narrow focus on one solution rarely leads to a robust answer to security as far as I "see" here on Slashdot.
Use someone else's.
Bark less. Wag more.
Surveillance happens today at the server level: the Feds claim that, under the PATRIOT act, they can get the records of all visits and all 'cloud' data straight from the server - this is the "PRISM" project, but shades of it have been going for the past decade.
They don't need your client end. They get the server logs, they get the server history of visits, and reverse-lookup you and then collate all visits to as many web services as they can from the particular IP and MAC address, and that's how they put together your history.
Cookies, SSL, HTTPS, none of that matters. The only thing that would escape it is to route through anonymous proxies.
"But remember, most lynch mobs aren't this nice." (H.Simpson)
-- Joe
something like a pure debian with tor and privoxy in it, which starts a browser, and load virtualbox/vmware modules. Then you just boot it and switch to "seamless mode" and get nothing but a free floating browser window. if you close it, you will be asked if you want to restart the browser or shutdown the vm.
Running Firefox in a linux container, like Docker that saves no history could stop some of the tracking stored in your computer. Some extra addons (tor, https everywhere, etc) could improve a bit things.
Netscape 4 required more hacks than IE. It was a supperior browser. Also every possible browser st the turn of the century couldnt pass the acid test. Opra and webkit had quirks too. IE 6 was the better one as browsers were buggy rushed experimental products. It was 7ntil Safari a mmd firefox 1.0 did IE 6 even have close competition. You are looking at this from a lems of today.
http://saveie6.com/
curl, wget, lynx,links
I've been reading how you should "air gap" a computer to make it really secure. So now I only connect to the Internet with Wireless. I uninstalled my anti-virus software today, it was just using up memory on the disk, now I'm secured.
It gripped her hand gently. 'Regret is for humans,' it said.
I mentioned this potential for random traffic dilution (when the 'plebs' discover that they are being non-proportionately data intercepted/stored) to a member of STC / ILETS and the look of pain on their face showed how true this path might be!
GCHQ was mentioned in reference to their Tempora 200+ NSA DPI boxes as having to dispose of vast amounts of our data, the high volume/low interest (P2P mostly) components. There are therefore types of data that are currently able to be 'ignored'.
Back on the subject of Browser, I don't trust many at the Browser/CA Industry alliance - I have chosen one browser with many extensions. I'm trying both 'TrackMeNot' browser extension from NYU - a bit risky as it comes from the Land of the Free, combined with Chrome - purely for it's unique SSLCertificate pinning - HTTPS everywhere and for fun, "Fake Terrorist" from kacper.walanus Quote: "Let's make PRISM useless by creating fake terroristic noise" from the Chrome Store. FT interacts beautifully with HTTPS Everywhere generating a a pop-up window that really starts to annoy 'encrypted.Google.com' who have queried whether I'm really a human a few times!
in the current age of almost Total Data Surveillance - trending soon to full spectrum Total Information Awareness in the software defined networking era - fake or obfuscated data (from many independent different sources & methods) is about the only conceivable way to have some plausible deniability about our online viewing. IANAT but I reserve the right to have freedom in my correspondence - such that I might view undistorted and unbiased news online , have a good shopping & business interactions online without everything being analysed forever.
Realistically not using the internet and living in a log cabin in the woods may be your only option.
More realistically what you do on the internet isn't that important.
This question is naive and nonsensical; no browser can really do much of anything to ensure your security against surveillance.
You could, perhaps, ask which browser developer has your interests in mind and encourages users to take steps to ensure their privacy. To that, I would answer: probably Firefox, not Chrome (Google is axiomatically not interested in your privacy) certainly not IE (do I even need to explain this one?)
No, obviously, you're not going to go digging around the Firefox source code to check for yourself, but I think there are enough developers interested in their privacy that you don't need to.
But, really, taking steps to protect your privacy is, unfortunately, up to you...
Use the HTTPS Everywhere extension for Firefox
Run JavaScript and accept cookies only on a strictly whitelist basis
Use TOR if you're surfing something that you think may come back to bite you in the ass, even if it's completely legal
Search with DuckDuckGo instead of Google
Lay off teh Facebook or be extremely wary with what you post, like and follow
Always use random aliases and never give out your name or acutely identifying information on discussion forums
Disassociate your Android phone from any Google accounts and find your APKs somewhere other than Google Play
Protecting your privacy requires your deliberate and continual effort; not just something you can package neatly into a box.
As founder of a new startup which solves this, I am pleased to say the answer is simple: www.spikes.com | the only secure browser. Secure by design. Private by design. For enterprises now, but consumer cloud coming soon!
</shameless plug>
But even we would cooperate with the government in criminal cases where warrants are provided, but our encrypted tunnels should keep the casual sniffers at bay.
Write for web standards and IE10 supports it pretty well.
What's the closest thing to "web standards" for a 3D view in a web application? Both Chrome and Firefox support WebGL on capable video cards, but Microsoft has refused, complaining about "security problems".
As founder of a new startup which solves this, I am pleased to say the answer is simple: www.spikes.com | the only secure browser. Secure by design. Private by design. For enterprises now, but consumer cloud coming soon! </shameless plug>
But even we would cooperate with the government in criminal cases where warrants are provided, but our encrypted tunnels should keep the casual sniffers at bay.
I wouldn't let this stop anyone. Ideally the groundswell will be so overwhelming that tracking everything will be a waste of time. Hell, people use VPNs all the time when logging into corporate networks.
obviously you can't create a capable operating system from scratch, thus "if you can't beat 'em, join 'em". EVERYBODY's using ... just "look the other way" for a bit, but with opensource we just imply ...
the obvious operating system. they even run it on military ships in england?
the easiest way is just to "take over the battle field". if you control the physical communication channels
you're all set.
as for the "safest" browser, it's the one you trust.
firefox is open source and i guess has a globally distributed developer pool. but it's free too, so money can be a problem?
microsoft is USA, but has lots of money. we don't know the mentality of the people manning the microsoft castle, but
they got lots of "grain" in the silos, so maybe a siege would take a longer time then a siege of castle firefox (before they cave in).
then again, the silos are full because they never get besieged?
also with closed source, the creator doesn't have to be actively evil
that "many eyes" are all benevolent
bottom line is that history tells us that it's NEVER gonna be safe. if it should ever be safe, "somebody" could request
a feature to be introduced that could possibly make it unsafe again?
"With the discovery that the NSA may be gathering extensive amounts of data, and the evidence suggesting makers of some of the most popular browsers may be in on the action" C'Mon people how neive do we have to be. This has been going on for years!! If I can encrypt my IP traffic, jump through VPN and proxy hoops to annonymise my browsing from my home PC what can the feds do with computing and storage power comin' out of their clacker? And with the fascist/corporate/crony capitalist state we find ourselves in, don't tell me it's not! Big business is in bed, big time, with the state right to the point of busines setting the ciriculum of education, uhum, sorry, training! it flows all the way from adulescence. To think it hasn't been happening before Snowden announced it? is neive in the extreme!
to eliminate the leaking the browser normally does, their is no equal to FLWEB and the SBE (secure browser edition) can be downloaded for free. VPN service with unmatched security is available now and the new premium edition of the OS and the new website (more/updated info, easy nav and product aquisition) are currently under development. A (currently free/seeking approved, "no strings" sponsors) dns service is also available at dns.fortresslinux.org
"protect your data, privacy and freedom" is not just a slogan. it's a call to action that we ignore at our peril.
Back in July 2010, Microsoft claimed that SmartScreen on Internet Explorer had already blocked over a billion attempts to access sites containing security risks.
One issue with SmartScreen is how it treats new releases as false positives. An executable file or installer package that SmartScreen hasn't already seen several dozen times, such as a new release of a Windows application developed by a hobbyist, will get marked as "This file is not commonly downloaded and could harm your computer", and IE makes the user click through two different shapes of alert boxes in order to get any option other than "Delete".
Before worrying about if your browser is secure (whatever that means), ask yourself if you use ssl everywhere you can, and what information you trust to the "cloud". For example, does dropbox have unencrypted copies of files you would rather keep secret? Does your Facebook profile contain stuff you might not want everyone to know? It doesn't matter what browser you use if the other side has all kinds of private info on you. If you write sensitive stuff in your emails and don't use something like pgp, then it goes in plain text across the internet for anyone to sniff. Even if you use ssh with gmail, and all your friends do the same, Google still has the unencrypted mails on their servers.
i thought using the privacy mode of google chrome or firefox will accomplish what anonymous reader wants? was going to suggest TOR but it is kinda slow for websites with lots of flash animations and videos.
We are Anonymous. We are legion. We do not forgive. We do not forget. Expect us
I believe it's been mentioned already, but Links and the like are free from most plugin/flash/java exploits, which is most of the exploits on the web.
A related matter: Bing. Beijing. hmm.
https://www.torproject.org/ - Why debate a browser when using a modified browser on the TOR network is the answer if you really care about such things?
Do it like RMS, download all the pages you might want to visit in a day, and browse them with an offline browser (and from a machine that never connects to the internet).
Slashdot is not a game, Slashdot is not a game. Crap, I just lost points.
This is really the wrong question. You shouldn't really be worried about people collecting data from your browser, but from the websites you visit and from your computer itself.
Use elinks or telnet
I think it is telling that the tor browser bundle uses firefox.
Also, firefox is the only browser I know of where the application takes responsibility for securely encrypting saved passwords.
Firefox is the only browser that securely lets you transfer all of your passwords, bookmarks, etc from one device to another without revealing it to a corporation or moving it in an insecure fashion.
My answer is that the best browser is: the tor bundle (using firefox)
I am also looking into iceweasle... which seems very secure so far.
Stop thinking about browsers and start thinking about operating systems and/or hardware
http://qubes-os.org/
This system lets you easily launch browsers (or other apps) within different security contexts. Security is enforced by a hardened Xen hypervisor, and even some system services like graphics and net stack that are considered high-risk are also run within their own VMs. You can selectively grant a VM access to particular hardware if your system supports VT-d or IOMMU. A special variation on copy-and-paste lets you perform those functions between VMs without the risk of a compromised program trying to sniff your clipboard.
There are App VMs which appear on the desktop as normal windows except for their context frame color, and HVMs which can run a whole different OS like Windows, and Disposable VMs that retain no state between launches.
There is also special VM support for Tor that can be installed.
And no one is claiming it is perfect, BTW. But a candidate "most secure browser" should ideally be running on a system such as Qubes.
Very much not in the advertising business, and they let you review the source code on request.