Slashdot Mirror
Epic: A Privacy-Focused Web Browser
Rob @CmdrTaco Malda writes
"I've been advising Epic Browser, a startup building a privacy-focused, Chrome-based browser that starts where incognito mode ends. Epic employs a host of tactics designed to make what happens inside your browser stay there, to the tune of a thousand blocks in a typical hour of browsing. They also provide a built-in proxy service. If the corporations and governments are going to watch us, there's no reason to make it any easier for them. Epic has Mac and Windows builds for now. Their site goes into far greater detail about how they block tracking methods most browsers don't."
Been using Comodo (has nearly the same tagline), but I'll try this out as well.
But 1000 blocks an hour is way short of what Ad-block plus gets with the standard list.
You're basing this on a browser made by one of the companies known to have been cooperating with the NSA every step of the way, including the latest revelations about said companies inserting backdoors into their products?
Sounds like a good idea to me.
Liberty in your lifetime
...closed source browser
I can decript my data, use browsers to erase cookies, but without spoofing IP addresses, the websites know where I am accessing from and when I access the site. If I would then use a major email (instead of my own email server), then the NSA has their hands on my emails and any cloud stuff I save. Everything in the internet needs to be reworked for privacy, not just the browser...
Of course the The United Surveilla^H^H^H^H^H^H^H^H States Government is not going to let that happen.
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
"First things first -- but not necessarily in that order"
-- The Doctor, "Doctor
Oh how I despise the misuse of the word epic.
I have said for years that Private Browsing in Firefox is what Incognito Mode wants to be when it grows up. Looks like that is about to happen.
I am not your blowing wind, I am the lightning.
Things like this only serve to foster and spread an illusion of security and privacy. It may make life a little harder for the commercial maggots, but the government worms? You're as good as owned already.
If it has not already been compromised, by technology or force of law, it soon will be. Bet on it.
Scruting the inscrutable for over 50 years.
The trouble with proxies is the added latency.
Try this, go through a proxy and just try to post here on Slashdot - or even load the page.
I tried using proxies and I just got so many timeouts that it made the web unusable.
The summary is incorrect. This browser is based on the open source Chromium, not Chrome, a subtle but important difference since Chrome has Google's extra tracking goodness. However, I have to wonder why they didn't start with Firefox, which is truly open source and not connected at all with Google, which has pretty much become the poster child of privacy invasion these days.
Proxy is a nice option, except when you don't know where the Proxy is... Easy to implement a Proxy and have a look at users communications...
I'd try it..Linux pls..
So we're supposed to trust the company behind this browser, and the security of their web services? Can we at least build it ourselves from source?
that computing in the 21st century would become so exciting?
If Pandora's box is destined to be opened, *I* want to be the one to open it.
Sounds a lot like SRWare Iron* to me - that's a long existing Chromium-based fork altered for enhanced privacy.
At a first glance, I cannot make out any advantages of Epic over Iron. Aside from the removal of all user tracking which Chrome brings, they only provide a 1-click-proxy functionality. Which, if I used it, would leave me and my privacy at the mercy of an India based startup. Instead, I'd also rather suggest JAP** which is also long and well established.
So what am I missing that makes Epic Browser worth a Slashdot post?
[1] https://www.srware.net/en/software_srware_iron.php
[2] http://anon.inf.tu-dresden.de/
From their page::
... They get paid for searches they drive but those searches don't have any ads or tracking? Again, where does the money come from?
Epic like most browsers earns a commission on searches we drive. So the more you use Epic’s default search engine, the more you support Epic and our continued privacy efforts : - ) And best of all your searches always remain exceptionally private since they’re routed via a secure, encrypted connection over a proxy – so private by design when you use EpicSearch.me that we literally can’t know what you’re searching for nor anyone else. Ads and search results never include any personalized results or tracking of any sort and are only based on your search term and general geographical location.
So
+++ATH0 NO CARRIER
Really, a process?
Could I get fork bombed by visiting a website that opens two new tabs?
Closed source? Seems legit.
Because just as Security Theatre takes well intentioned measures which are ineffective, this product takes well intentioned measures which are ultimately ineffective. It is like building a garage and expecting this will hide your new Ferrari, while doing nothing whatsoever about the CCTV camera on public land across the street pointed right at the garage door... the moment you take it out on the street, the camera owner has a record of it.
Epic is useless on a proxied LAN. Under Settings, Advanced Settings, Network, "Change proxy settings..." is disabled and a message indicates "Your network proxy settings are being mangaed by an extension". However, going over to Extensions yields the message, "Epic does not allow extensions for security & privacy reasons".
While blocking cookies or ads are fine, once the data is sent out into the ether its going to be picked up an decrypted, no browser is going to stop that.
If you want privacy on the web, stop using the web.
I haven't thought of anything clever to put here, but then again most of you haven't either.
I just gave Epic a try...
In Proxy settings it says "Your network proxy settings are being managed by an extension."
In Extensions link it says "Epic does not allow extensions for security & privacy reasons e.g. read this (right click and open in a new tab)"
So what extension is managing network proxy settings? I don't trust this browser any more than Chrome.
a software product company founded by Alok Bhardwaj and based in Washington DC
In the "About Us" section of the web site. US-based, so it won't protect your privacy against the spooks (Patriot Act *wink* *wink*). Neverthless, it's nice to see more software made with privacy in mind.
Google is very upfront about what is collected and what they do with it and who they do and do not share what data with. As someone who actually follows this stuff closely and READS agreements and doesn't just rely on Slashdot hype, I am 100% comfortable with everything Google does and what they do with the data, and also with how hard they fight back against governments who want that data. Google doesn't sell your data to ANY third parties, they use it INTERNALLY for their own stuff. As such it is actually VERY private. The data you share with Google is a lot more private than the data you share with your telco or cable company or bank in this respect.
Compare this to Facebook or LinkedIn or even Twitter, who are NOT upfront about what is collected and shared, and who not only share data with governments, but ALSO 3rd party companies at will as part of their business models. As well as your bank, your telco, etc again - all of whom routinely sell client lists including names, addresses, and phone numbers.
Who is the poster child again?
No source code, no verifiable improvement over SRWare Iron, and the company gets paid from...
Epic like most browsers earns a commission on searches we drive. So the more you use Epicâ(TM)s default search engine, the more you support Epic and our continued privacy efforts : - ) And best of all your searches always remain exceptionally private since theyâ(TM)re routed via a secure, encrypted connection over a proxy â" so private by design when you use EpicSearch.me that we literally canâ(TM)t know what youâ(TM)re searching for nor anyone else. Ads and search results never include any personalized results or tracking of any sort and are only based on your search term and general geographical location.
by tying in to the industry that is even more hostile to the concept of user privacy than the USGov...
Thanks, but I'll pass.
Allow us to bring it inside the gates !! Make haste !!
What will keep a NSL from telling them to give the NSA the key's to their proxy?
Comment removed based on user account deletion
According to Wikipeida Epic ( http://en.wikipedia.org/wiki/Epic_(web_browser) ) is a gecko based browser and does not aim at privacy .. but now it's chromium based privacy browser (both are said to use epicbrowser.com) ? somethings weird.
Comment removed based on user account deletion
When, if ever, will the source for Epic be published? And under what license?
Chromium obviously is open source already, but they do plan to opensource their additions too.
So this could actually be the good stuff.
You either trust Google with your data, and use their services, or you don't. Same with Facebook, et. al. If you're using this browser, you're trusting this company that they're doing what they say. Maybe you'll peruse the OS code, maybe not. But it's still who and how much you trust. Ultimately, if you want better privacy than what's out there, you need to roll your own browser. Find an open-source project you like, put the features you want in it, take the features you don't want out of it, and go on your merry way.
A privacy-focused browser is fine as far as it goes, but the problem is more with the network transporting data insecurely, and on the server side, where you put your trust into faceless entities that have their own interests at heart, not yours. So I don't see this helping much, if at all.
You see? You see? Your stupid minds! Stupid! Stupid!
The problem so far with privacy and no-tracking solutions is that they are usually individual plugins that may require configuration. For the average person, even one with technical know-how, it seems onerous to install these add-ons on all devices and make sure that they are up-to-date or whatever. It will be nice when someone bundles them with sensible defaults alongside a browser as a distro. This is an exaggeration but it's like we are still in the slackware/SLS Linux days and no one has come around with Ubuntu yet
Instead of blocking, we should just write a browser that is constantly browsing random shit in the background - your session is just sandwiched into a flood of other data. Bonus for filling up the buffers / taps / storage arrays of the listeners with junk. If they want to read what we do, let them choke on it.
just asking...
It is being made by an American company. Rest of the world does not and should not trust you anymore.
NSA: Hey Epic Exec, insert this complied module into your app
Epic Exec: Go fuck yourself NSA. We are all about protecting users here
NSA: I see. I also see that you visited a gay bar in SF last week and Boston the week before. Are you going to tell your wife and children or should we?
Epic Exec: Oh I see you are talking about National Security. Why didn't you say that before? Here at Epic we are loyal Murcans and we will be happy to help anyway we can.
NSA: That's a good bitch. Next time roll over and show your belly faster or else.....
Post the source.
The problem here is NSA/CIA has loads of cash ($52 billion for covert ops FFS), Adblock is probably a tiny operation that could be bought for $50k/year. No court order required to do that and since NSA keeps everything secret claiming 'National Security' no court would ever know if they'd bought off Adblock to help them track people. Even if they used it for domestic spying, they're trying to shut down whistleblowers and have their own staff under close surveillance now to try to prevent it.
I also wonder about Firefox. It has certificates that I do not trust as standard with no way of deleting them. Why would I trust Verisign at this point? I'd have to be a bleeding idiot to think they aren't in the NSA payroll, they're owned by Symantec FFS. Likewise Visa we already know hands over their transaction data. Yet Firefox has Visa as a valid root certificate! They have likely NSA conspirators on the root certificate list FFS!!
I have my doubts even about Open source browsers, that said, Epic is welcome, but I'll still be treating it as suspect.
You can delete them from within your profile. HOWEVER as soon as you update again it reinstalls them.
Rather annoying behavior, but it IS circumventable.
Hadn't noticed that they're now considered 'internal objects' however.
Tried Epic out for myself. Looks nifty, but clearly not polished yet. Biggest issue is that it still leaks all the data from the user-agent and plugins. Disabling the plugins helped, but I had an even more unique user-agent string than normal. Seems like this should be near the top of the list for a privacy browser, but they don't even mention it on their site, at least from a cursory browse. Tested at https://panopticlick.eff.org
-- If it aint broke, fix it till it is. --
HAHA! Yeah, Good luck there. With the NSA having cracked every conceiveable protected system on the internet, you really think someone will come up with something uncrackable or secure? HA!
Is it based on Chrome or Chromium? Is that not an important distinction to make?
Signature intentionally left blank.
Chromium is at least open source.
Can I opt out of slashvertisements?
This Epic Browser only has the appearance of privacy, without it being actually safe. In that sense, it is s more harmful than using a regular browser. With a FF or Chrome or Chromium or Opera or ...., people will at least consciously take steps to ensure some privacy even if they don't succeed.
Is this some NSA trojan or what ?
"or if you want to go to the trouble you can do like old APK and mess with HOSTS" - by hairyfeet (841228) on Friday September 06, 2013 @12:30PM (#44775941)
Per my subject-line above: Well - you know -> http://yro.slashdot.org/comments.pl?sid=4176879&cid=44775791
* :)
(It's no hassle, since I've FULLY "AutoMagically" automated it, courtesy of "yours truly" via code in the link above + data, & a dozen++ sources in the security community for more blocking data!)
APK
P.S.=> "Onward & Upward"... apk
Then he said, google's customers don't care about privacy and would gladly sell google the rope used to hang them.
http://quotes.liberty-tree.ca/quote/vladimir_lenin_quote_068c
Some drink at the fountain of knowledge. Others just gargle.
The whole privacy paranoia only serves to employ people who feed the paranoia while deriving an income from the paranoia.
Can any Chromium-based browsers do real ad blocking? That's the main thing keeping me on Firefox these days. Adblock Plus on Firefox can keep embedded ad images and crap from even loading at all, but the last time I checked, Chrome could only hide them from view (you're still wasting your bandwidth and risking your privacy downloading the ad garbage from their domain). Has that changed?
Can you just please die in a fire already? Nobody in his right mind would install an app written by you.
Why don't you prove what he says is wrong then? You can't, obviously.
The Off By One Browser is an oldie but goodie that I use all the time as a supplemental browser, especially if I don't trust a particular site. It cannot execute scripts of any sort, it caches everything completely to RAM, and is even small enough to fit on a floppy. Relocate the ob1.ini it creates from the Windows folder to the OffByOne folder, write-protect the HPSW.CKI cookies file (or disable them altogether), and your footprint is pretty much non-existent. It is quite fast and useful on sites where I am mostly interested in reading articles or random surfing. You don't even have to install this; you can run it right off a USB stick if you prefer.
Obviously this isn't going to load YouTube videos or do anything remotely fancy, so it isn't going to complete with the mainstream browsers, but it is a nice browser to have on the side. *posts with it now*
#5 Claims of either privacy or security on either Windows or OS X are bogus. Both operating systems are irreparably compromised by the respective manufacturers, affiliates, and the law enforcement, and so all claims about an app being able to deliver privacy are lies.
The first thing they asked me for was my email address.
How does that help to have no address bar? Just make sure the web server cannot read it. People need to have a way to be sure they actually got to the site they intended to go to.
now we need to go OSS in diesel cars
https://epic.org/ is EPIC, the Electronic Privacy Information Center, a stalwart defender of online privacy. EPIC does not appear to have any connection to this browser. This so-called "epic browser" doesn't look like much more than Iron, which was merely a ploy to make money off of ads on the download page. I'm not saying Epic Browser is that same ploy, but the browser doesn't really do anything that Chromium doesn't already do in Incognito mode (most of those 11 potential privacy leaks that epic blocks are Google features not available in Chromium or else can be disabled trivially).
This introduces a potential lag time in security updates (and updates to trackers pulled in from e.g. adblock or noscript) and rides on EPIC's good name. Shame on the developers for naming it so similarly.
Use my userscript to add story images to Slashdot. There's no going back.
Shut up GNUtard.
1. They will be sued until they are broke.
2. The search engines will be told to blacklist their site.
Bingo! You nailed it!
There are some other good comments but I like yours.
Turns out "Sign into Epic" ... means NOTHING!!
Because wanna see what happens when you actually click it? (I sacrificed my click for the good of Slashdot!)
Wait for it ...
"Sign in to Epic with your Google Account to save your personalized browser features to the web and access them from Epic on any computer. You'll also be automatically signed in to your favorite Google services."
AND
"Sign in to ******Chrome******
Sign in to get your bookmarks, history, and settings on all your devices. Learn more" (Emphasis mine)
So they didn't even bother finishing their copy and paste of junk??!
Even Bruce Schneier struggled to begin the discussion of what we can do to unroll the big bad security machine. But now I'm really pretty sad that the founder of Slashdot, back when it had chops, presents such a bad browser that they didn't even bake it ... and label it as a "Security Browser"?!
There's the old joke about comp engineers being lazy and preferring pizza and boffo sword fights to actually working (xkcd joke!), but when you guys really get a bit riled and sit down to crunch stuff, there's a few heavy hitters out there. So to see such a ridiculously sloppy item, is just more upsetting because this is THE hot button topic of the age, so if we're gonna try to fix it, these bogus attempts are a mess.
Let's look a little more. ... wait for it ... "Blocked Google Analystics"!
Their main site is https://www.epicsearch.in/
I'm running three browsers here to do all this! (This one while I'm typing)
So if we take their lead site and drop it into vanilla Firefox with Ghostery, Ghostery reports
Whois says: ...
Domain Name:EPICSEARCH.IN
Created On:05-Oct-2011 11:34:48 UTC
Last Updated On:01-Oct-2012 14:02:48 UTC
Expiration Date:05-Oct-2013 11:34:48 UTC
Registrant Name:Alok Bhardwaj
Registrant Organization:Hidden Reflex
So the domain expires ... *next month*??!
I'll stop there because I'm a humanities fella and don't know anything even more telling. But let's try the long shot: Did 'Taco even endorse this for real? Or ... is his name being co-opted for street cred beyond his better judgement!?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Umm... TAILS much?
https://tails.boum.org/
#3 - Must have source and repeatable build process. Trust doesn't work, it is the enemy of security. Transparency works, it is the friend of security.
See ken's Reflections on Trusting Trust, which demonstrates how to set up a very nice repeatable build process producing a security-critical application (the unix 'login' binary) from source.
"Source and repeatable build process" != transparency. When the NSA owns your OS (kernel, system libraries, compiler and all), repeatable build process isn't nearly enough...
Epic blocks loads of fingerprinting scripts which is quite effective in terms of general surveillance that goes on. To otherwise make your browser is un-fingerprintable is very hard to solve unless you block Flash which effectively "breaks the internet". It's no more/less fingeprint-able by the way than any other browser -- and in general you're much safer since we block the known companies that do use fingerprinting. If you're Edward Snowden and you're being targeted, well that's a different story!
Epic is open source code. Sorry, we're a very small team and Chromium is a HUGE code base and we've made tons of code changes all over the place. We've been working very hard to get to this release, and haven't had a chance to release our code in an organized way. Anyone who wants to know any changes or see any code is more than welcome to e-mail me anytime -- alok@hiddenreflex dot com . Sorry for the delay again,
We've been Epic for awhile now (had a previous incarnation:-). It's difficult to hide font lists from Flash, and disabling flash effectively "breaks the internet". We block many fingerprinting scripts though -- and are working on methods that would make your browser un-fingerprintable but it's very difficult (that's why no one has done it!). With your support, I'm sure we can do it but it's not going to happen overnight (or again someone would have done it already!).
Please let us know any Chromium backdoors!!! We have found MANY privacy leaks in default chrome/chromium and closed them...but if you find any backdoors, any privacy leaks we may have missed, let us know! Thanks -- alok, epic browser team , alok at hiddenreflex dot com
An understandable trepidation. Alas, I can't exactly mod you up. Good luck!
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
Sorry -- great catch! Somehow the Sync wasn't removed in the release version. Will remove it in an update very soon. Thanks! We don't have our sync service at this point so it was meant to be removed. Chromium is designed to be somewhat easily brand-able such that changing the name once changes it in many places -- removing the need for a lot of cut&paste (though quite a bit is still necessary actually). Will try to see why google analytics is being pinged -- it did used to run on our search page but has been long removed -- will investigate, thanks! Our domains auto-renew every year. Nothing to worry about!
Thanks, we can allow #1 and will work to add such links though that install process is good for many users with slower connections who'd like to quickly start a background installation process. #4 should have been removed -- will be removed soon though later we would like to offer a privacy-friendly sync service. #3 any code you want to see, just write us, Epic is open source but we just haven't had a chance to release all code in an organized way, chromium is huge. #2 will try to alert the user in-product with more details on the proxy, thanks!
says the cowardly little loser who trolls as anonymous coward.
... at least their top 11 are just annying chrome functions disabled. So use firefox (disable some annoying functions as well) and be happy.
Has anyone done a complete code audit of the Chromium source, as has been mentioned above as having been done on other pieces of open source software?
Liberty in your lifetime
With a challenge to you troll, here http://yro.slashdot.org/comments.pl?sid=4176879&cid=44789325 ? Yes he did. You're reduced to mere trollery instead of disproving what apk says on custom hosts value to end users of them. You can't manage getting the best of apk via facts, and you run (which is all your trolling behaviour illustrates to us).
If it's based on open source software, where's the source for this derivative software? How can we trust it?
And what 'advice' is Rob giving them? How to get ad placement on slashdot?
wrong way to look. You have to look at whether the crypto used is already compromised. It's not even a question of chromium as much as a question of what encryption methods you're using.
If they're NSA approved or FIPS approved, you have no security. That includes the executable's method of encryption, as well.
Anything using AES or triple-DES is guaranteed to be compromised at this point.