Slashdot Mirror
Ask Slashdot: Most Secure Browser In an Age of Surveillance?
An anonymous reader writes "With the discovery that the NSA may be gathering extensive amounts of data, and the evidence suggesting makers of some of the most popular browsers may be in on the action, I am more than a little wary of which web browser to use. Thus, I pose a question to the community: is there a 'most secure' browser in terms of avoiding personal data collection? Assuming we all know by know how to 'safely' browse the internet (don't click on that ad offering to free your computer of infections) what can the lay person do have a modicum of protection, or at least peace of mind?"
IE10 and 11 are superb browses. They containing many very good tactics to secure the browser and computer, for example, true sandboxing and JIT hardening. Most other browsers don't come even close.
Secondly, the sandboxing means that IE is usually able to block an attack on plug-ins like the Flash Player and JAVA VM. This alone makes surfing with IE remarkably safe.
IE really is an different kind of beast in the sea of mediocre browsers. It has come long way and is aiming for the top.
- John Futura
Security Consultant
I'll be uncharacteristically calm here, and ask that someone provide this, "evidence suggesting makers of some of the most popular browsers may be in on the action."
And in any case, let's be realistic. The NSA doesn't really need help from your browser if they're watching all your traffic. :p
Security should begin at the hardware level, the kernel should be inaccessible from a hardware perspective. The next best thing is a complete secure OS, so your options are limited to something like TAILS.
https://tails.boum.org/
I wouldn't say its 100% secure, its certainly not, but it does raise the bar a little and for them to use anything against you, they would need to admit to having the ability to break encryption. That's not going to happen. That said, always be careful as it will be used in other ways should it be required.
Other than that, there is no such thing as "safe".
A LiveCD with TBB:
https://www.torproject.org/
for LiveDVD/USB preconfigured not to leak try TAILS:
https://tails.boum.org/
in both instances unplug your HDD(s) before use.
Face it, who's going to bother writing anything to exploit flaws in lynx? It just isn't worth it.
The EFF has provided an up to date list of privacy-enabling tools in the age of Prism. http://prism-break.org/
sacrifices may be required
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
... the snooping is done on your ISP's backbone, and the browser you use makes little difference. Government level snooping is a whole different kettle of fish to bad companies stealing info from you via tracking cookies.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Considering that the internet transmits your public IP address in every header you send across the internet and also contains the IP address of the destination, there is no way for you to hide what sites you visit without going through a proxy server. As far as I know, Header information in every packet is plain text and there is no way to encrypt that because if it was encrypted then no router would be able to forward your packets onto the next step in its final destination. So your browser, e-mail program, or anything else that sends and receives data through the internet is going to leave a trail for the government to potentially record. It may not lead back to you specifically, but it will lead to someone in your household or in your neighborhood that is using your wi-fi for internet access, provided you haven't locked down your wi-fi. If you have locked down your wi-fi then the government can claim it was only you, someone in your household or someone you have given your wi-fi password to, which significantly lowers their potential suspects or targets.
If you send everything you do through a proxy server with a vpn connection to the proxy, then that has a very good chance of making you mostly anonymous. However, a warrant and the cooperation of the proxy service owner might make it possible for the government to still connect the dots back to you. Also, sending everything through a proxy server with all the non-routing information encrypted (via vpn) may actually lead to you being watched more closely then if you don't.
If what you are really after is encryption of the contents of what you see and do on the internet, your best bet is probably still a VPN through a proxy server. Especially since SSL and some of the other methods for encrypting data between two end points on the internet aren't as secure as they were once thought to be. I don't know of anyone that has come up with a replacement for SSL that has been adopted by very many content providers. And even if the web browsers may have adopted some new security encryption scheme, it won't be effective until most if not all content providers also adopt and implement it.
So you fix your browser .. are you also going to fix your ISP, whoever they buy their feed from etc etc until you get all the way to the actual web server? And how do you know to trust them?
Or are you going to build your own internet ,. with hookers and blackjack?
I am Slashdot. Are you Slashdot as well?
They do nothing!
“He’s not deformed, he’s just drunk!”
Identity theft assures your privacy, so to speak. However, that would be illegal. Good thing they're looking for authentic criminals.
.. that can only be solved politically. If you want peace of mind, prepare for decades of serious struggle, and learn to be okay with that.
If your ISP and the websites you use hand over everything, if things gets collected at packet level wholesale; what does it even matter what browser you use? It doesn't, not one bit.
None of the browsers will protect you from surveillance.
Work on the basis that your ISP is compromised and that the web services you use have shared their databases with Government agencies. When you consider this, changing your browser is going to have little to no impact.
I think the only way you can really be secure from surveillance is to use the tor browser and only use web services which can't trace you. So, no Google, Apple, social networking or any of the cool stuff we take for granted these days.
Backup not found: (A)bort (R)etry (P)anic
OP says "what browser should I use" I automatically add "for the Facebooks".
Here's the low-down:
That's just off the top of my head. The software you use to disclose the information isn't the problem - you are.
wget -m -k -K -E -l 1000 -t 3 -w 1 http://www.website.com/
Then after waiting a while (ok, maybe a long while), open the page/articles you *really* wanted to read in a text editor. Sure, the NSA might know which *site* you visited through normal spying means, but they'll never figure out which *page* you were really after.
Of course, they might think you read all the pages, and spend a few million dollars of taxpayer money trying to determine whether it's possible for someone to read 1 page per second and whether that implies terrorist connections, but they're clearly already misusing your tax dollars so you shouldn't really care if they misuse some more.
You can bet that any browser worth its salt has had agents involved in its creation whether or not the people who built the product were aware of it at all. You can also bet that encryption products whether free or commercial often have back doors or keys built in. That is the very essence of intelligence gathering. Do not assume that physical or software products are free of snooping abilities.
I suppose your best chance might be a browser that was never popular or used by many people at all.
Think back a few years and recall the tunnel that we put under the Berlin Wall in order to tie into a major Soviet phone trunk line. We intercepted phone calls for years from that tunnel. If we could do that about 1968 or 1970 just imagine what could be done today. DARPA was the motive force behind the creation of the net. DARPA more than any other entity would have great reason to spy on communications. This is not a new issue.
Except that Chrome phones home the first time you start it up to check for upgrades. This has the unfortunate 'effect' of informing Google of the browser ID at this IP address, and as a consequence it informs the NSA of the linkage of browser ID and IP address.
Post NSA, I try to avoid Google services. They try to grab data for themselves, but in the process grab it for the NSA, and if the choice is NSA+Google or no Google, then I go without Google.
I opt for Firefox with the 'check for updates' turned to manual checks.
It's a minor thing, but it helps in as much that the choice of browser can help (not much if you're in the USA, quite a bit if you're not and behind an ISP NAT).
Doing what you prescribe will do the very thing that you are trying to avoid - get you on the NSA's list of people who are probably not American and must be up to something really interesting.
http://yro.slashdot.org/story/13/06/21/1443204/use-tor-get-targeted-by-the-nsa
Since there is no encryption they don't need a backdoor. If the packets go through a bridge owned by the NSA at a telco they can just collect them and listen when they want to.
I think the thing people really need to worried about is all those "web accelerator" boxes that proxy encrypted data (very stupid idea IMHO) - if the NSA has a back door into any of those you have to hope that nobody associated with them has a gambling problem and decides to use your collected banking username and password - or of course dozens of other less mundane things that could go wrong.
Given what's already happened, if you are in competition with a large US military contractor (Boeing was the one caught last time), you'd better beware of a bit of industrial espionage on their behalf paid for by the taxpayer and be very careful of what gets out onto the net.
Thats the million dollar question (what is considered "Strong encryption"), and yes, I'm not suggesting it is easy. Merely that securing your endpoint software is not enough by a long shot.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
You could do what Richard Stallman does:
It's not the most practical way to browse the Web I would think, but it's an interesting datapoint on the security-convenience scale.
Please be a bit precise here. What exactly is claimed have Microsoft and Google given to the NSA? And how exactly do we "know"?
Come on now. There's a powerpoint that proves it all.
It just needs a little imagination/fantasy and some extrapolation, then it is conclusive, irrefutable proof that the big companies have *all* of them given NSA direct electronic access to the companies' servers to perform any kind of snooping they desire with no judicial oversight.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
you arrogant little turds ... fucks sake, no god damned shit ... based on unicorn farts ... little asshat turds
You'll get your point better across if you cut that childish angry cursing.
Your "secure browser" can be compromised by the Operating System. The Operating System can be compromised by the hardware.
The safest way to do your computing is to make all your own chips, assemble it yourself, and write your own OS. Even then you're subject to Man-in-the-Middle attacks, so you're going to have to go lay all your own fiber and do it all over again for those on the other side.
Surveillance happens today at the server level: the Feds claim that, under the PATRIOT act, they can get the records of all visits and all 'cloud' data straight from the server - this is the "PRISM" project, but shades of it have been going for the past decade.
They don't need your client end. They get the server logs, they get the server history of visits, and reverse-lookup you and then collate all visits to as many web services as they can from the particular IP and MAC address, and that's how they put together your history.
Cookies, SSL, HTTPS, none of that matters. The only thing that would escape it is to route through anonymous proxies.
"But remember, most lynch mobs aren't this nice." (H.Simpson)
-- Joe
Write for web standards and IE10 supports it pretty well.
What's the closest thing to "web standards" for a 3D view in a web application? Both Chrome and Firefox support WebGL on capable video cards, but Microsoft has refused, complaining about "security problems".