I’m looking for an android browser to open webapps isolated from my general browsing

I’ve been using Mull as disposable browsing and brave for login into places (shopping, social), but I don’t like that if I want to stay logged it also keeps history record. I think it would happen with any browser I use, right? Any suggestions?

  • rollingflower@lemmy.kde.social
    link
    fedilink
    arrow-up
    3
    ·
    7 months ago

    I am not sure but Firefox desktop (gecko) and mobile (fenix) are separate projects. I think they share a lot of code though.

    So a browser renders webpages, CSS, Javascript and nowadays even Webassembly and WebGL stuff.

    If you stick to HTML and CSS you are way more secure, Javascript is way more attack surface, and JIT+Webassembly where about 50% of Microsoft Edges security vulnerabilities.

    So if you disable WebGL and JIT+Webassembly by default the attack surface is way lower. But there are websites, especially good stuff like Tuta doing in-browser encryption over advanced quantum resistant protocols, that require JIT. GrapheneOS Vanadium now has a toggle to enable JIT for some sites, Edge Desktop has too afaik (dont use it but its likely the most secure browser on Windows), Chrome-ium desktop allows a policy where you can list JIT exceptions.

    Firefox desktop and mobile both likely allow blocking wasm and jit in about:config but no GUI toggle yet. Torbrowser in “very secure mode” also blocks JIT.

    Coming to the engine, Chrome-ium focuses a lot on sandboxing, while using C and C++ for like everything.

    Firefox has the rendering engine completely rewritten in Rust.

    Assuming that most sandbox escapes come from memory issues, firefoxes sandbox doesnt have to be as secure if they simply dont have memory issues as they use Rust.

    Firefox Desktop uses Seccomp filters for every process (restricting syscalls the processes can make) and separates processes using unprivileged user namespaces for every process (I think they call that fission). Firefox Flatpak can only use seccomp filters but the processes are not isolated from another, which is why you should probably use a system install (binary, .deb, .rpm, …).

    You can sandbox system installed apps using bubblejail and allow access to the syscalls needed to create user namespaces. But it is pretty complicated and incomplete in my experience, even though I dont know why.

    On Android firefox still uses the engine in Rust afaik, but Android has a very different model how to isolate apps. Also only Chrome-ium can isolate every process strongly on Android, yet. It is totally possible but Mozills doesnt seem to care.

    At the same time to be honest I never had a security vulnerability in Firefox affect me, my entire life.

    It is important to protect activists and people that “StAtE ActOrS” want to target, so those people should use the most secure browser possible.

    The problem is simply that we have no privacy respecting variant on the desktop, that also has quick CI/CD updates. Ungoogled Chromium often lacks behind on Updates (and dont mention Thorium please).

    This could be done by people that know how to build such a pipeline on Gitlab, Github etc. and apply all the ungoogle patches to the browser, hardening the build and creating .RPM packages every few days. There just is nobody currently doing that.

    • rollingflower@lemmy.kde.social
      link
      fedilink
      arrow-up
      2
      ·
      7 months ago

      Pinging the people in this thread (another advantage of commenting and not just liking). Plase see the changes in the above comments.